Systems Operations on AWS - 3rd Day (s1)

What level of VPC Flow Logs can be enabled through the AWS Console? (Select THREE.)

• You can enable Flow Logs for your subnets

• You can enable Flow Logs for your EC2 instances

• You can enable Flow Logs for your VPCs

• You can enable Flow Logs for your network interfaces

Tags

d3

m11

Which of the following is NOT recommended by AWS as a best practice when using IAM?

• Use a “least privilege” IAM policy when assigning permissions

• Create IAM users with required privileges instead of using the root account

• Enable Access Keys for every user created on your environment, to avoid issues when developers need to use the AWS CLI

• To provide an additional level of account security, enable multi-factor authentication (MFA)

Tags

d1

m2

AWS Budgets can be configured to send notifications directly to which endpoints. (Select TWO.)

• Email

• SNS

• Lambda

• SQS

Tags

d3

m14

What types of health checks can be configured in an Auto Scaling Group? (Select TWO.)

• EC2

• EKS

• ECS

• ELB

• Route 53

Tags

d2

m8

A user wants to connect to a Windows instance using Remote Desktop, but the Ops team wants to encourage using Systems Manager features. Which statement is true?

• Session Manager supports port forwarding.  Map a local port to the RDP port on the instance and start a session.  The user can then use remote desktop

• Native RDP support was announced at re:Invent 2020.  You just have to enable it in the session properties so the user can view the desktop instead of the PowerShell prompt

• RDP is not supported by SSM. You must open port 3389 in the instance security group

• RDP is not supported by SSM. Use Apache Guacamole over port 80 instead

Tags

d2

m6

You are managing a CloudFormation template that specifies an S3 bucket as a resource. You created a stack with this template. The next day, when you tried to delete this stack, it went into DELETE_IN_PROGRESS status and then DELETE_FAILED and the deletion failed. Which of the following could be the cause of the deletion failure?

• Server-side encryption is enabled on your S3 bucket

• The S3 bucket contains objects.

• When the stack is deleted, the S3 bucket is retained without being deleted

• Termination protection is enabled on the stack

Tags

d2

m5

cfn

You've successfully created a Windows AMI. After the instance has joined a domain, you notice a "Duplicate SID" error. What's the problem and solution?

• The AMI was created without running SysPrep. Create a new AMI after running SysPrep, then launch a new instance

• The AMI was created without running SysPrep. Reboot the machine to fix the current instance, and update the User Data script for future instances

• This is a common Windows error. Reboot the instance

• The instance was launched by a PowerShell command without providing a unique SID. Launch a new instance after updating the PowerShell command.

Tags

m12

d3

AWS Config, Amazon GuardDuty, and Amazon Inspector can detect and remediate issues.  Which statements are correct? (Select TWO.)

• AWS Config and Amazon GuardDuty rules can be customized

• Amazon Inspector rules packages can only be used if the Inspector agent is installed on an EC2 instance or on-premises server

• All three services include built-in remediation options

• AWS Config remediation can be manual or automatic

TRUE or FALSE. CloudFormation can infer the order of creating resources based on intrinsic function.

• True

• False

Tags

m5

d1

Which of the following are design principles based on the Operational Excellence pillar in the AWS Well-Architected Framework? (Select TWO.)

• Stop spending money on undifferentiated heavy lifting

• Analyze and attribute expenditure

• Perform operations as code

• Make frequent, small, reversible changes

• Adopt a consumption model

Tags

m1

d1