[Dec 31, 2024] AWS-SysOps Ultimate Study Guide - Lead2PassExam
Ultimate Guide to Prepare AWS-SysOps Certification Exam for SysOps Administrator in 2024
Amazon AWS-SysOps certification exam is designed for individuals who are interested in validating their technical expertise in deploying, managing, and operating highly scalable and fault-tolerant systems on the Amazon Web Services (AWS) platform. AWS-SysOps exam is intended for system administrators, operations managers, and those responsible for ensuring the stability and security of AWS infrastructure.
NEW QUESTION # 533
A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created a public subnet CIDR (20.0.0.0/24) and VPN only subnets CIDR (20.0.1.0/24) along with the VPN gateway (vgw-12345) to connect to the user's data center. The user's data center has CIDR 172.28.0.0/12. The user has also setup a NAT instance (i-123456) to allow traffic to the internet from the VPN subnet. Which of the below mentioned options is not a valid entry for the main route table in this scenario?
- A. Destination: 20.0.1.0/24 and Target: i-12345
- B. Destination: 20.0.0.0/16 and Target: local
- C. Destination: 0.0.0.0/0 and Target: i-12345
- D. Destination: 172.28.0.0/12 and Target: vgw-12345
Answer: A
Explanation:
Explanation/Reference:
Explanation:
The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data center, he can setup a public and VPN only subnet which uses hardware VPN access to connect with his data center. When the user has configured this setup with Wizard, it will create a virtual private gateway to route all traffic of the VPN subnet. If the user has setup a NAT instance to route all the Internet requests, then all requests to the internet should be routed to it. All requests to the organization's DC will be routed to the VPN gateway.
Here are the valid entries for the main route table in this scenario:
Destination: 0.0.0.0/0 & Target: i-12345 (To route all internet traffic to the NAT Instance.
Destination: 172.28.0.0/12 & Target: vgw-12345 (To route all the organization's data center traffic to the VPN gateway).
Destination: 20.0.0.0/16 & Target: local (To allow local routing in VPC).
NEW QUESTION # 534
A user has configured the Auto Scaling group with the minimum capacity as 3 and the maximum capacity as
5. When the user configures the AS group, how many instances will Auto Scaling launch?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
NEW QUESTION # 535
What does enabling a sticky session with ELB do?
- A. Ensures that all requests from the user's session are sent to multiple instances
- B. Binds the user session with a specific instance
- C. Provides a single ELB DNS for each IP address
- D. Routes all the requests to a single DNS
Answer: B
Explanation:
By default, a load balancer routes each request independently to the registered instance with the smallest load.
However, you can use the sticky session feature (also known as session affinity), which enables the load balancer to bind a user's session to a specific instance. This ensures that all requests from the user during the session are sent to the same instance.
Reference:
http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-sticky-sessions.html
NEW QUESTION # 536
An organization has created 10 IAM users. The organization wants each of the IAM users to have access to a separate DyanmoDB table. All the users are added to the same group and the organization wants to setup a group level policy for this. How can the organization achieve this?
- A. Create a DynamoDB table with the same name as the IAM user name and define the policy rule which grants access based on the DynamoDB ARN using a variable
- B. It is not possible to have a group level policy which allows different IAM users to different DynamoDB Tables
- C. Define the group policy and add a condition which allows the access based on the IAM name
- D. Create a separate DynamoDB database for each user and configure a policy in the group based on the DB variable
Answer: B
Explanation:
Explanation/Reference:
Explanation:
AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. AWS DynamoDB has only tables and the organization cannot makeseparate databases. The organization should create a table with the same name as the IAM user name and use the ARN of DynamoDB as part of the group policy. The sample policy is shown below:
NEW QUESTION # 537
A SysOps Administrator needs to create a replica of a company's existing AWS infrastructure in a new AWS account. Currently, an AWS Service Catalog portfolio is used to create and manage resources.
What is the MOST efficient way to accomplish this?
- A. Create an AWS CloudFormation template to use the AWS Service Catalog portfolio in the new AWS account.
- B. Run an AWS Lambda function to create a new AWS Service Catalog portfolio based on the output of the DescribePortfolio API operation.
- C. Share the AWS Service Catalog portfolio with the other AWS accounts and import the portfolio into the other AWS accounts.
- D. Manually create an AWS Service Catalog portfolio in the new AWS account that duplicates the original portfolio.
Answer: C
NEW QUESTION # 538
What does Amazon IAM stand for?
- A. Amazon Integrated Access Management
- B. Amazon Identity and Authentication Mechanism
- C. None of these
- D. Amazon Identity and Access Management
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Amazon IAM stands for Amazon Identity and Access Management. The "identity" aspect of AWS IAM helps you with the question "Who is that user?", often referred to as authentication.
Reference:
http://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_identity-management.html #intro- identity-users
NEW QUESTION # 539
The information within an IAM policy is described through a series of ______.
- A. macros
- B. classes
- C. namespaces
- D. elements
Answer: D
Explanation:
Explanation
While creating an IAM policy, it includes many elements that you can use to define or create a policy. The elements that a policy can contain are as follows: Version, Id, Statement, Sid, Effect, Principal, NotPrincipal, Action, NonAction, Resource, NotResource, Condition, and Supported Data Types.
References:
NEW QUESTION # 540
A user has created a VPC with two subnets: one public and one private. The user is planning to run the patch update for the instances in the private subnet. How can the instances in the private subnet connect to the internet?
- A. Use NAT with an elastic IP
- B. Allow outbound traffic in the security group for port 80 to allow internet updates
- C. Use the internet gateway with a private IP
- D. The private subnet can never connect to the internet
Answer: A
Explanation:
A VirtualPrivate Cloud (VPC) is a virtual network dedicated to the user's AWS account. A user can create a subnet with VPC and launch instances inside that subnet. If the user has created two subnets (one private and one public., he would need a Network Address Translation (NAT.
instance with the elastic IP address. This enables the instances in the private subnet to send requests to the internet (for example, to perform software updates.
NEW QUESTION # 541
Your organization's security policy requires that all privileged users either use frequently rotated passwords or one-time access credentials in addition to username/password.
Which two of the following options would allow an organization to enforce this policy for AWS users?
Choose 2 answers
- A. Configure multi-factor authentication for privileged 1AM users
- B. Create 1AM users for privileged accounts
- C. Implement identity federation between your organization's Identity provider leveraging the 1AM Security Token Service
- D. Enable the 1AM single-use password policy option for privileged users
Answer: C,D
NEW QUESTION # 542
Which of the following statements is true of IAM?
- A. None of these are correct.
- B. If you are configuring MFA for a user who will use a smartphone to generate an OTP, you must have the smartphone available in order to finish the wizard.
- C. If you are configuring MFA for a user who will use a smartphone to generate an OTP, the smartphone is not required in order to finish the wizard.
- D. If you are configuring MFA for a user who will use a smartphone to generate an OTP, you can finish the wizard on any device and later use the smartphone for authentication.
Answer: B
Explanation:
MFA can be used either with a specific MFA-enabled device or by installing an application on a smartphone. If a user chooses to use her smartphone, physical access to the device is required in order to complete the configuration wizard.
Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/GenerateMFAConfig.html
NEW QUESTION # 543
A company has adopted a security policy that requires all customer data to be encrypted at rest. Currently, customer data is stored on a central Amazon EFS file system and accessed by a number of different applications from Amazon EC2 instances.
How can the SysOps Administrator ensure that all customer data stored on the EFS file system meets the new requirement?
- A. Create a new encrypted EFS file system and copy the data from the unencrypted EFS file system to the new encrypted EFS file system.
- B. Use AWS CloudHSM to encrypt the files directly before storing them in the EFS file system.
- C. Modify the EFS file system mount options to enable Transport Layer Security (TLS) on each of the EC2 instances.
- D. Update the EFS file system settings to enable server-side encryption using AES-256.
Answer: D
Explanation:
Explanation/Reference:
Reference: https://docs.aws.amazon.com/efs/latest/ug/encryption.html
NEW QUESTION # 544
A user has launched an EC2 instance. However, due to some reason the instance was terminated. If the user wants to find out the reason for termination, where can he find the details?
- A. The user can get information from the AWS console, by checking the Instance description under the State transition reason label
- B. The user can get information from the AWS console, by checking the Instance description under the Instance Termination reason label
- C. The user can get information from the AWS console, by checking the Instance description under the Instance Status Change reason label
- D. It is not possible to find the details after the instance is terminated
Answer: A
Explanation:
Explanation
An EC2 instance, once terminated, may be available in the AWS console for a while after termination. The user can find the details about the termination from the description tab under the label State transition reason.
If the instance is still running, there will be no reason listed. If the user has explicitly stopped or terminated the instance, the reason will be "User initiated shutdown".
References:
NEW QUESTION # 545
A user has launched an EC2 instance. However, due to some reason the instance was terminated. If the user wants to find out the reason for termination, where can he find the details?
- A. The user can get information from the AWS console, by checking the Instance description under the State transition reason label
- B. The user can get information from the AWS console, by checking the Instance description under the Instance Termination reason label
- C. The user can get information from the AWS console, by checking the Instance description under the Instance Status Change reason label
- D. It is not possible to find the details after the instance is terminated
Answer: A
Explanation:
Explanation
Explanation:
An EC2 instance, once terminated, may be available in the AWS console for a while after termination. The user can find the details about the termination from the description tab under the label State transition reason. If the instance is still running, there will be no reason listed. If the user has explicitly stopped or terminated the instance, the reason will be "User initiated shutdown".
Reference:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_InstanceStraightToTerminated.html
NEW QUESTION # 546
A SysOps Administrator has configured a CloudWatch agent to send custom metrics to Amazon CloudWatch and is now assembling a CloudWatch dashboard to display these metrics.
What steps should be the Administrator take to complete this task?
- A. Select the appropriate widget and metrics from the custom namespace, then add to the dashboard.
- B. Add a text widget, select the appropriate metric from the custom namespace, then add to the dashboard.
- C. Select the AWS Namespace, filter by metric name, then add to the dashboard.
- D. Open the CloudWatch console, from the CloudWatch Events, add all custom metrics.
Answer: A
Explanation:
Explanation
https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure
NEW QUESTION # 547
What is a placement group?
- A. A collection of authorized Cloud Front edge locations for a distribution
- B. A collection of Elastic Load Balancers in the same Region or Availability Zone
- C. Feature that enables EC2 instances to interact with each other via nigh bandwidth, low latency connections
- D. A collection of Auto Scaling groups in the same Region
Answer: C
Explanation:
Explanation
NEW QUESTION # 548
A user has launched multiple EC2 instances for the purpose of development and testing in the same
region. The user wants to find the separate cost for the production and development instances. How can
the user find the cost distribution?
- A. It is not possible to get the AWS cost usage data of single region instances separately
- B. The user should download the activity report of the EC2 services as it has the instance ID wise data
- C. The user should use Cost Distribution Metadata and AWS detailed billing
- D. The user should use Cost Allocation Tags and AWS billing reports
Answer: D
Explanation:
AWS provides cost allocation tags to categorize and track the AWS costs. When the user applies tags to
his AWS resources (such as Amazon EC2 instances or Amazon S3 buckets), AWS generates a cost
allocation report as a comma-separated value (CSV file) with the usage and costs aggregated by those
tags. The user can apply tags which represent business categories (such as cost centres, application
names, or instance type - Production/Dev) to organize usage costs across multiple services.
Reference: http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation.html
NEW QUESTION # 549
A user has setup a CloudWatch alarm on the EC2 instance for CPU utilization. The user has setup to receive a notification on email when the CPU utilization is higher than 60%. The user is running a virus scan on the same instance at a particular time. The user wants to avoid receiving an email at this time. What should the user do?
- A. Remove the alarm
- B. Modify the CPU utilization by removing the email alert
- C. Disable the alarm for a while using the console
- D. Disable the alarm for a while using CLI
Answer: D
Explanation:
Amazon CloudWatch alarm watches a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. When the user has setup an alarm and it is know that for some unavoidable event the status may change to Alarm, the user can disable the alarm using the DisableAlarmActions API or from the command line mondisable-alarm-actions.
NEW QUESTION # 550
You are running a database on an EC2 instance, with the data stored on Elastic Block Store (EBS) for persistence at times throughout the day, you are seeing large variance in the response times of the database queries Looking into the instance with the isolate command you see a lot of wait time on the disk volume that the database's data is stored on.
What two ways can you improve the performance of the database's storage while maintaining the current persistence of the data? (Choose two.)
- A. Use the ephemeral storage on an m2 4xiarge Instance Instead
- B. Move to an SSD backed instance
- C. Move the database to anEBS-Optimized Instance
- D. T Use Provisioned IOPs EBS
Answer: B,C
NEW QUESTION # 551
Malicious traffic is reaching company web servers from a single IP address located in another country. The SysOps Administrator is tasked with blocking this IP address.
How should the Administrator implement the restriction?
- A. Edit the VPC route table to route the malicious IP address to a black hole
- B. Use Amazon CloudFront's geo restriction feature to block traffic from the IP address
- C. Edit the network access control list for the web server subnet and add a deny entry for the IP address
- D. Edit the security group for the web servers and add a deny entry for the IP address
Answer: C
Explanation:
Explanation
References: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison
NEW QUESTION # 552
An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants a particular group of IAM users to access only the test instances and not the production ones. They want to deploy the instances in various locations based on the factors that will change from time to time, especially in the test group. They expect instances will often need to be churned, i.e. deleted and replaced, especially in the testing group. This means the five instances they have created now will soon be replaced by a different set of five instances. The members of each group, production and testing, will not change in the foreseeable future. Given the situation, what choice below is the most efficient and time-saving strategy to define the IAM policy?
- A. By defining the IAM policy that allows access based on the instance ID
- B. By creating an IAM policy with a condition that allows access to only small instances
- C. By defining the tags on the test and production team members IAM user IDs, and adding a condition to the IAM policy that allows access to specific tags
- D. By launching the test and production instances in separate regions and allowing region wise access to the group
Answer: C
Explanation:
AWS Identity and Access Management is a web service that allows organizations to manage users and user permissions for various AWS services. The user can add conditions as a part of the IAM policies. The condition can be set on AWS Tags, Time, and Client IP as well as on various parameters. If the organization wants the user to access only specific instances, he should define proper tags and add to the IAM policy condition. The sample policy is shown below.
"Statement": [
{
"Action": "ec2:*",
"Effect": "Allow",
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/InstanceType": "Production"
}
}
}
]
Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/ExampleIAMPolicies.html
NEW QUESTION # 553
......
SysOps Administrator Fundamentals-AWS-SysOps Exam-Practice-Dumps: https://examsforall.lead2passexam.com/Amazon/valid-AWS-SysOps-exam-dumps.html