A company has an application running on a fleet of Microsoft Windows instances. Patches to the operating system need to be applied each month. flaws Systems
Manager Patch Manager is used to apply the patches on a schedule.
When the fleet is being patched, customers complain about delayed service responses.
What can be done to ensure patches are deployed with MINIMAL customer impact?

A. Change the number of instances patched at any one time to 100%.

B. Create a snapshot of each server in the fleet using a Systems Manager Automation document before starting the patch process.

C. Configure the maintenance window to patch 10% of the instances in the patch group at a time.

D. Create a patched Amazon Machine Image (AMI). Configure the maintenance window option to deploy the patched AMI on only 10% of the fleet at a time.

According to the shared responsibility model, for which of the following Amazon EC2 activities is flaws responsible? (Choose two.)

A. Patching the guest operating system

B. Monitoring memory utilization

C. Configuring network ACLs

D. Patching the hypervisor

E. Maintaining network infrastructure

What is Amazon WorkSpaces?

A. Amazon WorkSpaces is a fully managed desktop computing service in the cloud, allowing end-users to access the documents, applications, and resources they need with the device of their choice.

B. Amazon WorkSpaces is a flexible application management solution with automation tools that enable you to model and control your applications and their supporting infrastructure.

C. Amazon WorkSpaces is a fully redundant data storage infrastructure for storing and retrieving any amount of data, at any time, from anywhere on the web.

D. Amazon WorkSpaces is a web service that enables businesses, researchers, data analysts, and de-velopers to easily and cost-effectively process vast amounts of data.

Which of the following terms is NOT a key CloudWatch concept?

A. Namespaces

B. Units

C. Time Stamps

D. Indexes

A user is collecting 1000 records per second. The user wants to send the data to CloudWatch using a custom namespace. Which of the below mentioned options is recommended for this activi-ty?

A. Create one csv file of all the data and send a single file to CloudWatch

B. Aggregate the data with statistics, such as Min, max, Average, Sum and Sample data and send the data to CloudWatch

C. It is not possible to send all the data in one call. Thus, it should be sent one by one. CloudWatch will aggregate the data automatically

D. Send all the data values to CloudWatch in a single command by separating them with a comma. CloudWatch will parse automatically

Which of the following are the customer's responsibilities, according to the flaws Shared Responsibility Security Model? (Choose two.)

A. Operating system, network, and firewall configuration

B. Client-side data encryption and data integrity authentication

C. flaws data center access logs

D. Hypervisor updates and configuration

E. Physical media destruction

A custom application must be installed on all Amazon EC2 instances. The application is small, updated frequently and can be installed automatically.
How can the application be deployed on new EC2 instances?

A. Launch a script that downloads and installs the application using the Amazon EC2 user data.

B. Create a custom API using Amazon API Gateway to call an installation executable from an flaws CloudFormation Template.

C. Use flaws Systems Manager to inject the application into an AMI.

D. Configure flaws CodePipeline to deploy code changes and updates.

An application is running on Amazon EC2 instances and storing all application data in Amazon S3. The company wants to archive all files older than 30 days to reduce costs. Archived files are used for auditing purposes only; however, the audit team may need to retrieve files in under a minute.
How should the SysOps administrator implement these requirements?

A. Configure an S3 bucket policy to move all objects older than 30 days to S3 Standard-Infrequent Access (S3 Standard-IA).

B. Create a lifecycle rule to move all objects older than 30 days to S3 Glacier.

C. Create a lifecycle rule to move all objects older than 30 days to S3 Standard-Infrequent Access (S3 Standard-IA).

D. Use S3 Intelligent-Tiering to move files older than 30 days to S3 Glacier Deep Archive.

You have a web-style application with a stateless but CPU and memory-intensive web tier running on a cc2 8xlarge EC2 instance inside of a VPC The instance when under load is having problems returning requests within the SLA as defined by your business The application maintains its state in a DynamoDB table, but the data tier is properly provisioned and responses are consistently fast.
How can you best resolve the issue of the application responses not meeting your SLA?

A. Add another cc2 8xlarge application instance, and put both behind an Elastic Load Balancer

B. Move the cc2 8xlarge to the same Availability Zone as the DynamoDB table

C. Cache the database responses in ElastiCache for more rapid access

D. Move the database from DynamoDB to RDS MySQL in scale-out read-replica configuration

An organization is concerned that its Amazon RDS databases are not protected. The solution to address this issue must be low cost, protect against table corruption that could be overlooked for several days, and must offer a 30-day window of protection.
How can these requirements be met?

A. Enable Multi-AZ on the RDS instance to maintain the data in a second Availability Zone.

B. Create a read replica of the RDS instance to maintain the data in a second region.

C. Ensure that automated backups are enabled and set the appropriate retention period.

D. Enable versioning in RDS to recover altered table data when needed.

A user is trying to connect to a running EC2 instance using SSH. However, the user gets an Unprotected Private Key File error. Which of the below mentioned options can be a possible reason for rejection?

A. The private key file has the wrong file permission

B. The ppk file used for SSH is read only

C. The public key file has the wrong permission

D. The user has provided the wrong user name for the OS login

On a weekly basis, the Administrator for a photo sharing website receives an archive of all files users have uploaded the previous week. these file archives can be as large as 10TB in size. For legal reasons, these archives must be saved with no possibility of someone deleting or modifying these archives. Occasionally, there may be a need to view the contents, but it is expected that retrieving them can take three or more hours.
What should the Administrator do with the weekly archive?

A. Upload the file to Amazon S3 through the flaws Management Console and apply a lifecycle policy to change the storage class to Amazon Glacier.

B. Upload the archive to the Amazon Glacier with the flaws CLI and enable Vault Lock.

C. Create a Linux EC2 instance with an encrypted Amazon EBS volume and copy each weekly archive file for this instance.

D. Create a file gateway attached to a file share on an S3 bucket with the storage class S3 Infrequent Access. Upload the archives via the gateway.

A company has deployed a fleet of Amazon EC2 web servers for the upcoming release of a new product. The SysOps Administrator needs to test the Amazon
CloudWatch notification settings for this deployment to ensure that a notification is sent using Amazon SNS if the CPU utilization of an EC2 instance exceeds 70%
How should the Administrator accomplish this?

A. Use the set-alarm-state command in flaws CloudTrail to invoke the Amazon SNS notification

B. Use CloudWatch custom metrics to set the alarm state in flaws CloudTrail and enable Amazon SNS notifications

C. Use EC2 instance metadata to manually set the CPU utilization to 75% and invoke the alarm state

D. Use the set-alarm-state command in the flaws CLI for CloudWatch

A SysOps Administrator has been asked to configure user-defined cost allocation tags for a new flaws account. The company is using flaws Organizations for account management.
What should the Administrator do to enable user-defined cost allocation tags?

A. Log in to the flaws Billing and Cost Management console of the new account, and use the Cost Allocation Tags manager to create the new user-defined cost allocation tags.

B. Log in to the flaws Billing and Cost Management console of the payer account, and use Cost Allocation Tags manager to create the new user-defined cost allocation tags.

C. Log in to the flaws Management Console of the new account, use the Tag Editor to create the new user-defined tags, then use the Cost Allocation Tags manager in the new account to mark the tags as cost allocation tags.

D. Log in to the flaws Management Console of the new account, use the Tag Editor to create the new user-defined tags, then use the Cost Allocation Tags manager in the payer account to mark the tags as cost allocation tags.

You have set up Individual flaws accounts for each project. You have been asked to make sure your flaws Infrastructure costs do not exceed the budget set per project for each month.
Which of the following approaches can help ensure that you do not exceed the budget each month?

A. Consolidate your accounts so you have a single bill for all accounts and projects

B. Set up auto scaling with CloudWatch alarms using SNS to notify you when you are running too many Instances in a given account

C. Set up CloudWatch billing alerts for all flaws resources used by each project, with a notification occurring when the amount for each resource tagged to a particular project matches the budget allocated to the project.

D. Set up CloudWatch billing alerts for all flaws resources used by each account, with email notifications when it hits 50%. 80% and 90% of its budgeted monthly spend

A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL. When the IAM user logs in to the S3 console, which actions can he perform?

A. He can just view the content of the bucket

B. He can do all the operations on the bucket

C. It is not possible to give access to an IAM user using ACL

D. The IAM user can perform all operations on the bucket using only API/SDK

A SysOps Administrator is in the process of setting up a new flaws Storage Gateway. The Storage Gateway activation is failing when the Administrator attempts to activate the Storage Gateway from the Storage Gateway console.
What are the potential causes of this error? (Choose two.)

A. The Storage Gateway does not have an upload buffer configured.

B. The Storage Gateway does not have a backing Amazon S3 bucket configured.

C. The Storage Gateway does not have a cache volume configured.

D. The Storage Gateway does not have the correct time.

E. The Storage Gateway is not accessible from the Administrator’s client over port 80.

The fastest way to load 300 TB of data to flaws is _____.

A. to directly upload all data to S3 over a dedicated 100 Mbps connection

B. to use flaws Import/Export Snowball

C. to use VM Import/Export

D. to zip all the data and then upload to S3

A sysops administrator set up an Amazon ElastiCache for Memcached cluster for an application. During testing, the application experiences increased latency.
Amazon CloudWatch metrics for the Memcached cluster show CPUUtilization is consistently above 95% and FreeableMemory is consistently under 1 MB.
Which action will solve the problem?

A. Configure ElastiCache automatic scaling for the Memcached cluster. Set the CPUUtilization metrics as a scaling trigger above 75% and FreeableMemory below 10 MB.

B. Configure ElastiCache read replicas for each Memcached node in different Availability Zones to distribute the workload.

C. Deploy an Application Load Balancer to distribute the workload to Memcached cluster nodes.

D. Replace the Memcached cluster and select a node type that has a higher CPU and memory.

A company is evaluating solutions for connecting its data centers to a VPC in an flaws Region running a mission-critical application. A secondary Region has already been set up as a disaster recovery solution. The company needs a consistent, low-latency connection of at least 10 Gbps that must be highly resilient and fault tolerant.
Which solution meets these requirements?

A. Set up a 10 Gbps flaws Direct Connect connection at two Direct Connect locations. Use two customer routers and dynamically routed, active/active connections.

B. Set up a 10 Gbps flaws Direct Connect connection. Use a Direct Connect gateway to support both Regions.

C. Establish an flaws Direct Connect connection for the primary connection to the VPC with an flaws-managed VPN connection as a backup.

D. Establish 10 VPN connections to the VPC. Enable the VPN Equal Cost Multipath (ECMP) feature to balance traffic over the active connections.

Amazon EC2 provides virtual computing environments known as _____.

A. instances

B. volumes

C. microsystems

D. servers

A user runs the command `dd if=/dev/xvdf of=/dev/null bs=1M` on an EBS volume created from a snapshot and attached to a Linux instance. Which of the below mentioned activities is the user performing with the step given above?

A. Pre warming the EBS volume

B. Initiating the device to mount on the EBS volume

C. Formatting the volume

D. Copying the data from a snapshot to the device

A user has launched an RDS MySQL DB with the Multi AZ feature. The user has scheduled the scaling of instance storage during maintenance window. What is the correct order of events during maintenance window?
1. Perform maintenance on standby
2. Promote standby to primary
3. Perform maintenance on original primary
4. Promote original master back as primary

A. 1, 2, 3, 4

B. 1, 2, 3

C. 2, 3, 1, 4

A user is trying to send custom metrics to CloudWatch using the PutMetricData APIs. Which of the below mentioned points should the user needs to take care while sending the data to CloudWatch?

A. The size of a request is limited to 8KB for HTTP GET requests and 40KB for HTTP POST requests

B. The size of a request is limited to 128KB for HTTP GET requests and 64KB for HTTP POST requests

C. The size of a request is limited to 40KB for HTTP GET requests and 8KB for HTTP POST requests

D. The size of a request is limited to 16KB for HTTP GET requests and 80KB for HTTP POST requests

A user has created a web application with Auto Scaling. The user is regularly monitoring the application and he observed that the traffic is highest on Thursday and Friday between 8 AM to 6 PM. What is the best solution to handle scaling in this case?

A. Add a new instance manually by 8 AM Thursday and terminate the same by 6 PM Friday

B. Schedule Auto Scaling to scale up by 8 AM Thursday and scale down after 6 PM on Friday

C. Schedule a policy which may scale up every day at 8 AM and scales down by 6 PM

D. Configure a batch process to add an instance by 8 AM and remove it by Friday 6 PM

A user has enabled termination protection on an EC2 instance. The user has also set Instance initiated shutdown behavior to terminate. When the user shuts down the instance from the OS, what will happen?

A. The OS will shutdown but the instance will not be terminated due to protection

B. It will terminate the instance

C. It will not allow the user to shutdown the instance from the OS

D. It is not possible to set the termination protection when an Instance initiated shutdown is set to Terminate

You run a web application where web servers on EC2 Instances are in an Auto Scaling group. Monitoring over the last 6 months shows that 6 web servers are necessary to handle the minimum load During the day up to 12 servers are needed five to six days per year, the number of web servers required might go up to
What would you recommend to minimize costs while being able to provide hill availability?

A. 6 Reserved instances (heavy utilization). 6 Reserved instances {medium utilization), rest covered by On-Demand instances

B. 6 Reserved instances (heavy utilization). 6 On-Demand instances, rest covered by Spot Instances

C. 6 Reserved instances (heavy utilization) 6 Spot instances, rest covered by On-Demand instances

D. 6 Reserved instances (heavy utilization) 6 Reserved instances (medium utilization) rest covered by Spot instances

Is it possible to access S3 objects from the Internet?

A. Yes, but it has to pass through EC2.

B. Yes, it is possible if proper public readable accesses and ACLs are set.

C. No, there is no way to access any S3 objects from the Internet.

D. No, only a general overview of S3 objects can be read from the Internet.

A Systems Administrator is responsible for maintaining custom, approved AMIs for a company. These AMIs must be shared with each of the company's flaws accounts.
How can the Administrator address this issue?

A. Contact flaws Support for sharing AMIs with other flaws accounts.

B. Modify the permissions on the AMIs so that they are publicly accessible.

C. Modify the permissions on the IAM role that are associated with the AMI.

D. Share the AMIs with each flaws account using the console or CLI.

A SysOps Administrator must provide data to show the overall usage of Amazon EC2 instances within each department, and must determine if the purchased
Reserved Instances are being used effectively.
Which service should be used to provide the necessary information?

A. flaws Personal Health Dashboard

B. flaws Cost Explorer

C. flaws Service Catalog

D. flaws Application Discovery Service

A SysOps Administrator noticed that a large number of Elastic IP addresses are being created on the company's flaws account., but they are not being associated with Amazon EC2 instances, and are incurring Elastic IP address charges in the monthly bill.
How can the Administrator identify who is creating the Elastic IP address?

A. Attach a cost-allocation tag to each requested Elastic IP address with the IAM user name of the Developer who creates it.

B. Query flaws CloudTrail logs by using Amazon Athena to search for Elastic IP address events.

C. Create a CloudWatch alarm on the EIPCreated metric and send an Amazon SNS notification when the alarm triggers.

D. Use Amazon Inspector to get a report of all Elastic IP addresses created in the last 30 days.

A company's application stores documents within an Amazon S3 bucket. The application is running on Amazon EC2 in a VPC. A recent change in security requirements states that traffic between the company's application and the S3 bucket must never leave the Amazon network.
What flaws feature can provide this functionality?

A. Security groups

B. NAT gateways

C. Virtual private gateway

D. Gateway VPC endpoints

An application running on Amazon EC2 needs login credentials to access a database. The login credentials are stored in flaws Systems Manager Parameter Store as secure string parameters.
What is the MOST secure way to grant the application access to the credentials?

A. Create an IAM EC2 role for the EC2 instances and grant the role permission to read the Systems Manager parameters

B. Create an IAM group for the application and grant the group permissions to read the Systems Manager parameters

C. Create an IAM policy for the application and grant the policy permission to read the Systems Manager parameters

D. Create an IAM user for the application and grant the user permission to read the Systems Manager parameters

A company received its latest bill with a large increase in the number of requests against Amazon SQS as compared to the month prior. The company is not aware of any changes in its SQS usage. The company is concerned about the cost increase and who or what was making these calls.
What should the SysOps Administrator use to validate the calls made to SQS?

A. flaws CloudTrail

B. Amazon CloudWatch

C. flaws Cost Explorer

D. Amazon S3 server access logs

Based on the flaws Shared Responsibility Model, which of the following actions are the responsibility of the customer for an Aurora database?

A. Performing underlying OS updates

B. Provisioning of storage for database

C. Scheduling maintenance, patches, and other updates

D. Executing maintenance, patches, and other updates

A SysOps Administrator must evaluate storage solutions to replace a company's current user-shared drives infrastructure. Any solution must support security controls that enable Portable Operating System Interface (POSIX) permissions and Network File System protocols. Additionally, any solution must be accessible from multiple Amazon EC2 instances and on-premises servers connected to the Amazon VPC.
Which flaws service meets the user drive requirements?

A. Amazon S3

B. Amazon EFS

C. Amazon EBS

D. Amazon SQS

In a hardware security module (HSM), what is the function of a Transparent Data Encryption (TDE)?

A. To reduce the risk of confidential data theft

B. To decrease latency

C. To store SSL certificates

D. To provide backup

Two companies will be working on several development projects together. Each company has an flaws account with a single VPC in us-east-1. Two companies would like to access one another's development servers. The IPv4 CIDR blocks in the two VPCs does not overlap.
What can the SysOps Administrators for each company do to set up network routing?

A. Each Administrator should create a custom routing table that points to the other company’s internet gateway public IP address.

B. Both Administrators should set up a NAT gateway in a public subnet in their respective VPCs. Then. using the public IP address from the NAT gateway, the Administrators should enable routing between the two VPCs.

C. Both Administrators should install a 1 Gbps flaws Direct Connect circuit in their respective environments. Then, using the flaws Management Console, the Administrators should create an flaws Direct Connect routing requests to enable connectivity.

D. One Administrator should create a VPC peering request and send it to the other Administrator’s account. Once the other Administrator accepts the request, update the routing tables to enable traffic.

A SysOps Administrator is running an automatically scaled application behind an Application Load Balancer. Scaling out is triggered when the CPUUtilization instance metric is more than 75% across the Auto Scaling group. The Administrator noticed aggressive scaling out. Developers suspect an application memory leak that is causing aggressive garbage collection cycles.
How can the Administrator troubleshoot the application without triggering the scaling process?

A. Suspend the scaling process before troubleshooting.

B. Delete the Auto Scaling group and recreate it when troubleshooting is complete.

C. Remove impacted instances from the Application Load Balancer.

D. Create a scale down trigger when the CPUUtilization instance metric is at 70%.

A user is trying to aggregate all the CloudWatch metric data of the last 1 week. Which of the below mentioned statistics is not available for the user as a part of data aggregation?

A. Aggregate

B. Sum

C. Sample data

D. Average

A user has launched two EBS backed EC2 instances in the US-East-1a region. The user wants to change the zone of one of the instances. How can the user change it?

A. Stop one of the instances and change the availability zone

B. The zone can only be modified using the flaws CLI

C. From the flaws EC2 console, select the Actions – > Change zones and specify new zone

D. Create an AMI of the running instance and launch the instance in a separate AZ

A user has launched an EC2 Windows instance from an instance store backed AMI. The user has also set the Instance initiated shutdown behavior to stop. What will happen when the user shuts down the OS?

A. It will not allow the user to shutdown the OS when the shutdown behavior is set to Stop

B. It is not possible to set the termination behavior to Stop for an Instance store backed AMI instance

C. The instance will stay running but the OS will be shutdown

D. The instance will be terminated

A user creates an Auto Scaling group from the Amazon flaws Console and assigned a tag with a key of "environment" and a value of "Prod". Can the user assign tags to instances launched in the Auto Scaling group, to organize and manage them?

A. Yes, this is possible only if the tags are configured at the launch configuration with a maximum length of 300 characters.

B. Yes

C. Yes, this is possible only if the tags are in the same AZ and the tag names are uppercase.

D. No

A company is migrating its exchange server from its on-premises location to a VPC in the flaws Cloud. Users working from home connect using a secure, encrypted channel over the internet to the exchange server. However, after the migration to flaws, users are having trouble receiving email.
The VPC flow log records display the following.
What is the root cause of the problem?

A. SMTP traffic from the network interface was blocked by an outbound network ACL.

B. SMTP traffic from the network interface was blocked by an outbound security group.

C. SMTP traffic to the network interface was blocked by an inbound network ACL.

D. SMTP traffic to the network interface was blocked by an inbound security group.

A company's website went down for several hours. The root cause was a full disk on one of the company's Amazon EC2 instances.
Which steps should the SysOps Administrator take to prevent this from happening in the future?

A. Configure Amazon CloudWatch Events to filter and forward flaws Health events for disk space utilization to an Amazon SNS topic to notify the Administrator.

B. Create an flaws Lambda function to describe the volume status for each EC2 instance. Post a notification to an Amazon SNS topic when a volume status is impaired.

C. Enable detailed monitoring for the EC2 instances. Create an Amazon CloudWatch alarm to notify the Administrator when disk space is running low.

D. Use the Amazon CloudWatch agent on the EC2 instances to collect disk metrics. Create a CloudWatch alarm to notify the Administrator when disk space is running low.

An application is running on multiple EC2 instances. As part of an initiative to improve overall infrastructure security, the EC2 instances were moved to a private subnet. However, since moving, the EC2 instances have not been able to automatically update, and a SysOps Administrator has not been able to SSH into them remotely.
Which two actions could the Administrator take to securely resolve these issues? (Choose two.)

A. Set up a bastion host in a public subnet, and configure security groups and route tables accordingly.

B. Set up a bastion host in the private subnet, and configure security groups accordingly.

C. Configure a load balancer in a public subnet, and configure the route tables accordingly.

D. Set up a NAT gateway in a public subnet, and change the private subnet route tables accordingly.

E. Set up a NAT gateway in a private subnet, and ensure that the route tables are configured accordingly.

A popular auctioning platform requires near-real-time access to dynamic bidding information. The platform must be available at all times. The current Amazon
RDS instance often reaches 100% CPU utilization during the weekend auction and can no longer be resized. To improve application performance, a sysops administrator is evaluating Amazon ElastiCache, and has chosen Redis (cluster mode enabled) instead of Memcached.
What are reasons for making this choice? (Choose two.)

A. Data partitioning

B. Multi-threaded processing

C. Multi-AZ with automatic failover

D. Multi-region with automatic failover

E. Online resharding

A web application's performance has been degrading. Historically, the application has had highly-variable workloads, but lately, there has been a steady growth in traffic as the result of a new product launch. After reviewing several Amazon CloudWatch metrics, it is discovered that over the last two weeks the balance of CPU credits has dropped to zero several times.
Which solutions will improve performance? (Choose two.)

A. Begin using the T2 instance type

B. Purchase more CPU credits for the existing instance

C. Increase the size of the current instance type

D. Configure a CloudWatch alarm on the CPU credits metric

An application running on Amazon EC2 instances needs to write files to an Amazon S3 bucket.
What is the MOST secure way to grant the application access to the S3 bucket?

A. Create an IAM user with the necessary privileges. Generate an access key and embed the key in the code running on the EC2 instances.

B. Install secure FTP (SFTP) software on the EC2 instances. Use an flaws Lambda function to copy the files from the EC2 instances to Amazon S3 using SFTP.

C. Create an IAM role with the necessary privileges. Associate the role with the EC2 instances at launch.

D. Use rsync and cron to set up the transfer of files from the EC2 instances to the S3 bucket. Enable flaws Shield to protect the data.

What is the default maximum number of VPCs allowed per region?

A. 5

B. 15

C. 100

D. 10