QUESTION 41
A company deploys an application on AWS behind an internet-facing Application Load Balancer (ALB) in the us-west-2 Region. Amazon Route 53 manages DNS cNAME records for the application. The company is replicating its AWS infrastructure to the eu-west-2 Region. A SysOps administrator must implement a Route 53 configuration to distribute application traffic across both Regions. Which solution will meet these requirements with the LEAST application response time?

A. Apply a geolocation routing policy to the CNAME records of both ALBs.
B. Apply a latency-based routing policy to the CNAME records of both ALBs.
C. Create a multivalue answer routing policy. Add the public IP addresses for both ALBs.
D. Create a new private hosted zone that includes a CNAME record for the ALB that is in eu-west-2.

Correct Answer: B

QUESTION 42
A company hosts a database on an Amazon RDS Multi-AZ DB instance. The database is not encrypted. The company’s new security policy requires all AWS resources to be encrypted at rest and in transit. What should a SysOps administrator do to encrypt the database?

A. Configure encryption on the existing DB instance.
B. Take a snapshot of the DB instance. Encrypt the snapshot. Restore the snapshot to the same DB instance.
C. Encrypt the standby replica in a secondary Availability Zone. Promote the standby replica to the primary DB instance.
D. Take a snapshot of the DB instance. Copy and encrypt the snapshot. Create a new DB instance by restoring the encrypted copy.

Correct Answer: D

QUESTION 43
A SysOps administrator needs to collect the content of log files from a custom application that is deployed across hundreds of Amazon EC2 instances running Ubuntu. The log files need to be stored in Amazon CloudWatch Logs. How should the SysOps administrator collect the application log files with the LEAST operational overhead?

A. Configure the syslogd service on each EC2 instance to collect and send the application log files to CloudWatch Logs.
B. Install the CloudWatch agent by using the Amazon Linux package manager on each EC2 instance. Configure each agent to collect the application log files.
C. Install the CloudWatch agent on each EC2 instance by using AWS Systems Manager. Create an agent configuration on each instance by using the CloudWatch configuration wizard. Configure each agent to collect the application log files.
D. Store a CloudWatch agent configuration in AWS Systems Manager Parameter Store. Install the CloudWatch agent on each EC2 instance by using Systems Manager. Configure each agent to collect the application log files.

Correct Answer: D

QUESTION 44
A web application runs on Amazon EC2 instances in the us-east-1 Region and the us-west-2 Region. The instances run behind an Application Load Balancer (ALB) in each Region. An Amazon Route 53 hosted zone controls DNS records. The instances in us-east-1 are production resources. The instances in us-west-2 are for disaster recovery. EC2 Auto Scaling groups are configured based on the ALBRequestCountPer Target metric in both Regions. A SysOps administrator must implement a solution that provides failover from us-east-1 to us-west-2. The instances in us-west-2 must be used only for failover. Which solution will meet these requirements?

A. Implement a Route 53 health check and a failover routing policy for the hosted zone. Configure the failover routing policy to automatically redirect traffic to the resources in us-west-2.
B. Implement a Route 53 health check and a latency routing policy for the hosted zone. Configure the latency routing policy to automatically redirect traffic to the resources in us-west-2.
C. In us-east-1, create an Amazon CloudWatch alarm that enters ALARM state when an EC2 instance is terminated. In us-west-2, create an AWS Lambda function that modifies the Route 53 hosted zone records to send traffic to us-west-2. Configure the CloudWatch alarm to invoke the Lambda function.
D. In us-west-2, create an Amazon CloudWatch alarm that enters ALARM state when resources in us-east-1 cannot be resolved. In us-west-2, create an AWS Lambda function that modifies the Route 53 hosted zone records to send traffic to us-west-2. Configure the CloudWatch alarm to invoke the Lambda function.

Correct Answer: A

QUESTION 45
A company’s reporting job that used to run in 15 minutes is now taking an hour to run. An application generates the reports. The application runs on Amazon EC2 instances and extracts data from an Amazon RDS for MySQL database. A SysOps administrator checks the Amazon CloudWatch dashboard for the RDS instance and notices that the Read IOPS metrics are high, even when the reports are not running. The SysOps administrator needs to improve the performance and the availability of the RDS instance.
Which solution will meet these requirements?

A. Configure an Amazon ElastiCache cluster in front of the RDS instance. Update the reporting job to query the ElastiCache cluster.
B. Deploy an RDS read replica. Update the reporting job to query the reader endpoint.
C. Create an Amazon CloudFront distribution. Set the RDS instance as the origin. Update the reporting job to query the CloudFront distribution.
D. Increase the size of the RDS instance.

Correct Answer: A

QUESTION 46
A SysOps administrator needs to track the costs of data transfer between AWS Regions. The SysOps administrator must implement a solution to send alerts to an email distribution list when transfer costs reach 75% of a specific threshold. What should the SysOps administrator do to meet these requirements?

A. Create an AWS Cost and Usage Report. Analyze the results in Amazon Athena. Configure an alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when costs reach 75% of the threshold. Subscribe the email distribution list to the topic.
B. Create an Amazon CloudWatch billing alarm to detect when costs reach 75% of the threshold. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email distribution list to the topic.
C. Use AWS Budgets to create a cost budget for data transfer costs. Set an alert at 75% of the budgeted amount. Configure the budget to send a notification to the email distribution list when costs reach 75% of the threshold.
D. Set up a VPC flow log. Set up a subscription filter to an AWS Lambda function to analyze data transfer. Configure the Lambda function to send a notification to the email distribution list when costs reach 75% of the threshold.

Correct Answer: C

QUESTION 47
A SysOps administrator is reviewing VPC Flow Logs to troubleshoot connectivity issues in a VPC. While reviewing the logs, the SysOps administrator notices that rejected traffic is not listed. What should the SysOps administrator do to ensure that all traffic is logged?

A. Create a new flow log that has a filter setting to capture all traffic.
B. Create a new flow log. Set the log record format to a custom format. Select the proper fields to include in the log.
C. Edit the existing flow log. Change the filter setting to capture all traffic.
D. Edit the existing flow log. Set the log record format to a custom format. Select the proper fields to include in the log.

Correct Answer: A

QUESTION 48
A company has a core application that must run 24 hours a day, 7 days a week. The application uses Amazon EC2, AWS Fargate, and AWS Lambda. The company uses a combination of operating systems across different AWS Regions. The company needs to maximize cost savings while committing to a pricing model that offers flexibility to make changes. What should the company do to meet these requirements?

A. Purchase a Compute Savings Plan that is based on Savings Plans recommendations.
B. Purchase an EC2 Instance Savings Plan that covers the EC2 instance types and the Fargate and Lambda CPU equivalents.
C. Purchase a Reserved Instance for the instance types, operating systems, Region, and tenancy.
D. Use EC2 Spot Instances that match the type and size of existing instances that run in each Region.

Correct Answer: A

QUESTION 49
A company is using an organization in AWS Organizations to manage its multi-account AWS environment. A SysOps administrator needs to share a new Amazon Machine Image (AMI) with the entire organization. Which solution will meet this requirement in the MOST operationally efficient way?

A. Make the AMI public. Reference the AMMI ID from within the member accounts of the organization.
B. Share the AMI’s associated snapshots with all the accounts in the organization.
C. Share the AMI with the organization by specifying the organization Amazon Resource Name (ARN).
D. Upload the AMI to AWS Marketplace. Search for the uploaded AMI when an instance is launched from a member account in the organization.

Correct Answer: C

QUESTION 50
A company has an application that runs on Amazon EC2 instances. The application stores data on an Amazon RDS for MySQL Single-AZ DB instance. Requests to the DB instance from the application include reads and writes. A SysOps administrator must implement a solution that provides failover for the DB instance. The solution must minimize application downtime. Which solution will meet these requirements?

A. Modify the DB instance to be a Multi-AZ DB instance deployment.
B. Add a read replica in the same Availability Zone where the DB instance is deployed.
C. Add the DB instance to an Auto Scaling group that has a minimum capacity of 2 and a desired capacity of 2.
D. Use RDS Proxy to configure a proxy in front of the DB instance.

Correct Answer: A

QUESTION 51
A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications. A SysOps administrator must prevent users from launching Amazon EC2 instances that do not have a CostCenter-Project tag into any account in the application OU. The restriction must apply only to accounts in the application OU. Which solution will meet these requirements?

A. Create an IAM group that has a policy that allows the ec2:RunInstances action when the CostCenter-Project tag is present. Place all IAM users who need access to the application accounts in the IAM group.
B. Create a service control policy (SCP) that denies the ec2RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the application OU.
C. Create an IAM role that has a policy that allows the ec2:RunInstances action when the CostCenter-Project tag is present. Attach the IAM role to the IAM users that are in the application OU accounts.
D. Create a service control policy (SCP) that denies the ec2RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the root OU.

Correct Answer: B

QUESTION 52
A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company’s risk team must receive immediate notification about any delete events. Which solution will meet these requirements?

A. Enable S3 server access logging for audit logs. Set up an Amazon Simple Notification Service (Amazon SNS) notification for the S3 bucket. Select DeleteObject for the event type for the alert system.
B. Enable 53 server access logging for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance to download the access logs each day and to scan for a DeleteObiect event.
C. Use Amazon CloudWatch Logs for audit logs. Use Amazon CloudWatch alarms with an Amazon Simple Notification Service (Amazon SNS) notification for the alert system.
D. Use Amazon CloudWatch Logs for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance each day to compare the list of the items with the list from the previous day. Configure the cron job to send a notification if an item is missing.

Correct Answer: A

QUESTION 53
A company has an online gaming application that is experiencing increased usage. The application stores data in a single Amazon DynamoDB table. Forecasts indicate that the application will receive more than 2 million requests each second. The load on the DynamoDB table consists mostly of read operations. The reads can have eventual consistency. A SysOps administrator must implement a solution to keep the application’s response times as low as possible. Which solution will meet these requirements?

A. Create an Amazon RDS proxy. Configure the application to access DynamoDB by using the RDS proxy.
B. Create a DynamoDB Accelerator (DAX) cluster. Configure the application to use the DAX client.
C. Load the data into the Amazon S3 Standard storage class. Create an accelerator in AWS Global Accelerator for the application.
D. Configure the application use strongly consistent reads from the DynamoDB table.

Correct Answer: B

QUESTION 54
A company is using AWS to deploy a critical application on a fleet of Amazon EC2 instances. The company is rewriting the application because the application failed a security review. The application will take 12 months to rewrite. While this rewrite happens, the company needs to rotate IAM access keys that the application uses. A SysOps administrator must implement an automated solution that finds and rotates IAM access keys that are at least 30 days old. The solution must then continue to rotate the IAM access keys every 30 days. Which solution will meet this requirement with the MOST operational efficiency?

A. Use an AWS Config rule to identify IAM access keys that are at least 30 days old. Configure AWS Config to invoke an AWS Systems Manager Automation runbook to rotate the identified IAM access keys.
B. Use AWS Trusted Advisor to identify IAM access keys that are at least 30 days old. Configure Trusted Advisor to invoke an AWS Systems Manager Automation runbook to rotate the identified IAM access keys.
C. Create a script that checks the age of IAM access keys and rotates them if they are at least 30 days old. Launch an EC2 instance. Schedule the script to run as a cron expression on the EC2 instance every day.
D. Create an AWS Lambda function that checks the age of IAM access keys and rotates them if they are at least 30 days old. Use an Amazon EventBridge rule to invoke the Lambda function every time a new IAM access key is created.

Correct Answer: A

QUESTION 55
A SysOps administrator needs to set up alerting and remediation for a web application. The application consists of Amazon EC2 instances that have AWS Systems Manager Agent (SSM Agent) installed. Each EC2 instance runs a custom web server. The EC2 instances run behind a load balancer and write logs locally. The SysOps administrator must implement a solution that restarts the web server software automatically if specific web errors are detected in the logs. Which combination of steps will meet these requirements? (Select THREE.)

A. Install the Amazon CloudWatch agent on the EC2 instances.
B. Create an AWS CloudTrail metric filter for the web logs. Configure an alarm for the specific errors.
C. Create an Amazon CloudWatch metric filter for the web logs. Configure an alarm for the specific errors.
D. Publish alarm findings to Amazon Simple Email Service (Amazon SES). Invoke an AWS Lambda function to restart the web server software.
E. Create an Amazon EventBridge rule that responds to the alarm. Configure the rule to invoke an AWS Systems Manager Automation runbook to restart the web server software.
F. Create an Amazon Simple Notification Service (Amazon SNS) notification that responds to the alarm. Configure the notification to invoke an AWS Systems Manager Automation runbook to restart the web server software.

Correct Answer: ACD

QUESTION 56
A company runs an application on hundreds of Amazon EC2 instances in three Availability Zones. The application calls a third-party API over the public internet. A SysOps administrator must provide the third party with a list of static 1P addresses so that the third party can allow traffic from the application. Which solution will meet these requirements?

A. Add a NAT gateway in the public subnet of cach Availability Zone. Make the NAT gateway the default route of all private subnets in those Availability Zones.
B. Allocate one Elastic IP address in each Availability Zone. Associate the Elastic IP address with all the instances in the Availability Zone.
C. Place the instances behind a Network Load Balancer (NLB). Send the traffic to the internet through the private IP address of the NLB.
D. Update the main route table to send the traffic to the internet through an Elastic IP address that is assigned to each instance.

Correct Answer: A

QUESTION 57
A company has an NFS server that runs on a single Amazon EC2 instance. A SysOps administrator needs to replace the NFS server with a highly available file system. A total of 30 EC2 instances must connect to the file system to store and retrieve shared images and data. The EC2 instances are spread across multiple Availability Zones. The SysOps administrator will use Amazon Elastic File System (Amazon EFS) for the file system. Which solution will meet these requirements?

A. Create a new EFS file system in each Availability Zone. Configure the file systems to use the EFS One Zone storage class. Create an Amazon Route 53 alias record. Turn on health checks. Configure the record to resolve to the EFS file systems. Configure each EC2 instance to connect to the alias record.
B. Create a new EFS file system that uses the EFS Standard storage class. Configure each EC2 instance to connect to the mount target in its own AWS Region.
C. Create a new EFS file system in each Availability Zone. Configure the file systems to use the EFS One Zone storage class. Configure each EC2 instance to connect to the mount target in its own Availability Zone.
D. Create a new EFS file system that uses the EFS Standard storage class. Configure each EC2 instance to connect to the mount target in its own Availability Zone.

Correct Answer: D

QUESTION 58
A SysOps administrator launches two Amazon EC2 instances and creates a single public subnet for testing purposes in the same Availability Zone. The SysOps administrator wants Amazon Route 53 to respond with a public IP address only if a test webpage on an instance is running. However, even when the test webpage is unavailable, Route 53 still responds with the public IP addresses from both instances. How can the SysOps administrator resolve this issue?

A. Create a Route 53 multivalue answer routing record. Associate a health check with the record.
B. Configure latency-based routing with a health check in Route 53.
C. Configure weighted routing in Route 53.
D. Create another public subnet in the same Availability Zone for one of the instances.

Correct Answer: A

QUESTION 59
A company’s AWS Lambda function is experiencing performance issues. The Lambda function performs many CPU-intensive operations. The Lambda function is not running fast enough and is creating bottlenecks in the system. What should a SysOps administrator do to resolve this issue?

A. In the CPU launch options for the Lambda function, activate hyperthreading.
B. Turn off the AWS managed encryption.
C. Increase the amount of memory for the Lambda function.
D. Load the required code into a custom layer.

Correct Answer: C

QUESTION 60
A company deploys non-production Amazon EC2 instances in a VPC that has an internet gateway attached. The VPC has a single public subnet and a single private subnet. The EC2 instances in the private subnet cannot communicate outbound to the internet. Which action will give the EC2 instances in the private subnet the ability to communicate outbound to the internet?

A. Create a NAT gateway in the private subnet. Route traffic from the NAT gateway to the internet gateway.
B. Create a NAT gateway in the public subnet. Create an entry in the route table that is associated with the private subnet. Specify 0.0.0.0/0 as the destination. Specify the NAT gateway as the target.
C. Create an entry in the route table that is associated with the private subnet. Specify 0.0.0.0/0 as the destination. Specify the internet gateway as the target.
D. Create a second internet gateway. Associate the second internet gateway with the private subnet.

Correct Answer: B