NEW
Font size
WorksheetsSysOps Evaluation 2
Total questions: 11
Worksheet time: 6mins
A company has a tagging strategy for controlling access to Amazon EC2 across their AWS Organization units. The system administrator noticed that some tags do not follow the company’s naming convention which causes permission issues.
Which solution can help the administrator identify the affected resources with non-compliant tags?
Write a Lambda function that runs compliance checks whenever CloudTrail records a CreateTag API event
Apply a service control policy (SCP) that detects noncompliance tags
Set up the require-tags managed rule in AWS Config
Create a tag policy that standardizes the naming of tags across OUs
Whenever you are launching EC2 instances, you bootstrap package installations and application deployments through EC2 user-data fields that is executed at first boot of the instance. But since it is script-based, the user-data field is immutable. So you instead opt to use CloudFormation metadata, which can be updated dynamically.
Which of the following CloudFormation helper scripts allows you to retrieve and interpret the resource metadata, install packages, create files, and start services?
cfn-signal
cfn-init
cfn-get-metadata
cfn-hup
A SysOps Administrator needs to install and configure software applications to an EC2 instance that will be deployed using CloudFormation. The Administrator has to ensure that the applications are properly running before the stack creation proceeds. Which of the following options can satisfy the given requirement?
Add a CreationPolicy attribute to the instance then send a success signal after the applications are installed and configured. Use the cfn-signal helper script to signal a resource.
Use the UpdateReplacePolicy attribute and send a success signal after the applications are installed and configured using the cfn-signal helper script.
Add a UpdatePolicy attribute to the instance then send a success signal after the applications are installed and configured. Use the cfn-signal helper script to signal a resource.
Use the DependsOn attribute and send a success signal after the applications are installed and configured using the cfn-init helper script.
A commercial bank has recently adopted a hybrid cloud architecture which prompted them to migrate most of their applications to AWS. You are creating multiple CloudFormation stacks for all of the applications that will be used by different departments. You are tasked to ensure that all RDS database instances that you deploy should be kept even if the stack is deleted.
How can you satisfy this requirement?
Enable termination protection of the stack
Set the DeletionPolicy attribute for the stack resource to false
Set the DeletionPolicy attribute for the stack resource to Snapshot
Set the DeletionPolicy attribute for the stack resource to Retain
Due to the tight deadline of your project, your team needs to quickly update an RDS instance, deploy a new Application Load Balancer and launch multiple EC2 instances on your current CloudFormation stack. You want to be able to preview the proposed changes to your stack carefully to make sure the new infrastructure is correctly provisioned as you planned and to avoid any possible service disruptions.
Which of the following is the most suitable solution that you have to implement to meet the requirement?
Update the CloudFormation stack directly. The proposed changes will be shown before provisioning the stack.
Use CloudFormation StackSets to review the proposed changes to be made on your stack.
Use Nested Stacks to create a side-by-side comparison of your current stack and the proposed changes.
Use Change Sets when updating stacks to view the proposed changes.
A commercial bank plans to use AWS to host its application. The SysOps Administrator is instructed to create a CloudFormation template that will launch a large On-Demand EC2 Instance and install the 3rd-party application package. Once the instance has been launched and the application installed successfully, it should signal AWS CloudFormation that the process is complete. Conversely, it should also signal AWS CloudFormation if the installation fails.
Which of the following options should the Administrator use to achieve this requirement?
Use the cfn-hup and cfn-init helper scripts.
Use the cfn-get-metadata and cfn-init helper scripts.
Use the cfn-signal and cfn-init helper scripts.
Use the cfn-init helper script to install the third-party package and send notification back to AWS CloudFormation.
A mobile payment startup is leveraging AWS services for its global infrastructure. The SysOps Administrator manages several AWS accounts for staging and production environments, which are used by several development teams. The developers use a similar base CloudFormation template for their applications.
Which of the following options can help the Administrator effectively manage the updates on this template across all AWS accounts with minimal effort?
Use CloudFormation StackSets to update the stacks on multiple AWS accounts.
Use CloudFormation Change Sets to create and manage stacks on multiple AWS accounts.
Use CloudFormation Stack Instances to define and manage stack instances on multiple AWS Accounts.
Use the drift detection feature to view the updates made on the stacks.
A company plans to set up a bucket policy in Amazon S3 to allow users to list all the objects in the jumpingbrains bucket and retrieve them. The SysOps Administrator prepared the below policy using the AWS Policy Generator. What will happen if the Administrator applies this bucket policy in S3?
You will be prompted with an "Action does not apply to any resource(s) in statement" error.
The jumpingbrains bucket including all its objects will be publicly visible to anyone.
The jumpingbrains bucket including all its objects will be publicly accessible and downloadable to anyone.
The jumpingbrains bucket including all its objects will be publicly visible to anyone but downloading the objects is not allowed.
An international IT Consulting company is planning on setting up multiple accounts in AWS to separate their various departments and projects teams. For security purposes, the IT Security department has a requirement to ensure that certain services and actions are not allowed across all the accounts.
How would you achieve this in the most effective way?
Create a common IAM policy that can be applied across all accounts.
Contact AWS and request for them to deny the services not allowed to be used across accounts.
Activate Consolidated Billing feature across the account to control the services on each account.
Use AWS Organizations and Service Control Policies to control services on each account.
A global technology company has thousands of employees around the globe that are using Amazon VPC Cloud. As part of the company’s security compliance, IT auditors have requested a Credential report which contains a list of AWS users that contains their current status, their access key usage, and if they are using Multi-Factor Authentication (MFA) or not.
How can the SysOps Administrator generate the report required by the auditors?
Go to AWS EC2 dashboard and download the Credential report.
You can contact an AWS partner to generate the Credential report.
You can call up AWS support and have them generate the Credential report for you.
You can go to AWS IAM Console and download the Credential report.
A tech startup company plans to develop a web application hosted on EC2 that sends and fetches data to a DynamoDB table. The app is using the DynamoDB SDK and root account access keys to connect to DynamoDB.
Which of the following is the best option to improve the security of this architecture?
Nothing, because EC2 can use DynamoDB as their both are AWS Services and the required permissions are already configured
Create an IAM user and generate its access keys. Attach the policies that provide access to DynamoDB to this IAM user. Configure the Access keys inside the EC2 Instance
You should provision an IAM role with DynamoDB access. Attach the IAM role to the EC2 instances which will route all calls coming from the web app to the DynamoDB table.
You should create a separate IAM user for the web app with policies that provides access to DynamoDB.
