AWS Certified SysOps Administrator Page3(Dump)

Question No:-21

Your entire AWS infrastructure lives inside of one Amazon VPC. You have an Infrastructure monitoring application running on an Amazon instance in Availability Zone (AZ) A of the region, and another application instance running in AZ B. The monitoring application needs to make use of ICMP ping to confirm network reachability of the instance hosting the application.

Can you configure the security groups for these instances to only allow the ICMP ping to pass from the monitoring instance to the application instance and nothing else? If so how?

  1. No, two instances in two different AZ's can't talk directly to each other via ICMP ping as that protocol is not allowed across subnet (iebroadcast) boundaries
  2. Yes, both the monitoring instance and the application instance have to be a part of the same security group, and that security group needs to allow inbound ICMP
  3. Yes, the security group for the monitoring instance needs to allow outbound ICMP and the application instance's security group needs to allow Inbound ICMP
  4. Yes, both the monitoring instance's security group and the application instance's security group need to allow both inbound and outbound ICMP ping packets since ICMP is not a connection-oriented protocol

Question No:-22

You have two Elastic Compute Cloud (EC2) instances inside a Virtual Private Cloud (VPC) in the same Availability Zone (AZ) but in different subnets. One instance is running a database and the other instance an application that will interface with the database. You want to confirm that they can talk to each other for your application to work properly.

Which two things do we need to confirm in the VPC settings so that these EC2 instances can communicate inside the VPC? (Choose two.)

  1. A network ACL that allows communication between the two subnets.
  2. Both instances are the same instance class and using the same Key-pair.
  3. That the default route is set to a NAT instance or internet Gateway (IGW) for them to communicate.
  4. Security groups are set to allow the application host to talk to the database on the right port/protocol.

Question No:-23

Which services allow the customer to retain full administrative privileges of the underlying EC2 instances? (Choose two.)

  1. Amazon Elastic Map Reduce
  2. Elastic Load Balancing
  3. AWS Elastic Beanstalk
  4. Amazon Elasticache
  5. Amazon Relational Database service

Question No:-24

You have a web-style application with a stateless but CPU and memory-intensive web tier running on a cc2 8xlarge EC2 instance inside of a VPC The instance when under load is having problems returning requests within the SLA as defined by your business The application maintains its state in a DynamoDB table, but the data tier is properly provisioned and responses are consistently fast.

How can you best resolve the issue of the application responses not meeting your SLA?

  1. Add another cc2 8xlarge application instance, and put both behind an Elastic Load Balancer
  2. Move the cc2 8xlarge to the same Availability Zone as the DynamoDB table
  3. Cache the database responses in ElastiCache for more rapid access
  4. Move the database from DynamoDB to RDS MySQL in scale-out read-replica configuration

Question No:-25

You are managing a legacy application Inside VPC with hard coded IP addresses in its configuration.

Which two mechanisms will allow the application to failover to new instances without the need for reconfiguration? (Choose two.)

  1. Create an ELB to reroute traffic to a failover instance
  2. Create a secondary ENI that can be moved to a failover instance
  3. Use Route53 health checks to fail traffic over to a failover instance
  4. Assign a secondary private IP address to the primary ENIO that can be moved to a failover instance

Question No:-26

You are designing a system that has a Bastion host. This component needs to be highly available without human intervention.

Which of the following approaches would you select?

  1. Run the bastion on two instances one in each AZ
  2. Run the bastion on an active Instance in one AZ and have an AMI ready to boot up in the event of failure
  3. Configure the bastion instance in an Auto Scaling group. Specify the Auto Scaling group to include multiple AZs but have a min-size of 1 and max-size of 1
  4. Configure an ELB in front of the bastion instance

Question No:-27

Which of the following statements about this S3 bucket policy is true?

  1. Denies the server with the IP address 192 168 100 0 full access to the "mybucket" bucket
  2. Denies the server with the IP address 192 168 100 188 full access to the "mybucket" bucket
  3. Grants all the servers within the 192 168 100 0/24 subnet full access to the "mybucket" bucket
  4. Grants all the servers within the 192 168 100 188/32 subnet full access to the "mybucket" bucket

Question No:-28

Which of the following requires a custom CloudWatch metric to monitor?

  1. Data transfer of an EC2 instance
  2. Disk usage activity of an EC2 instance
  3. Memory Utilization of an EC2 instance
  4. CPU Utilization of an EC2 instance

Question No:-29

You run a web application where web servers on EC2 Instances are in an Auto Scaling group. Monitoring over the last 6 months shows that 6 web servers are necessary to handle the minimum load During the day up to 12 servers are needed five to six days per year, the number of web servers required might go up to 15.

What would you recommend to minimize costs while being able to provide hill availability?

  1. 6 Reserved instances (heavy utilization). 6 Reserved instances {medium utilization), rest covered by On-Demand instances
  2. 6 Reserved instances (heavy utilization). 6 On-Demand instances, rest covered by Spot Instances
  3. 6 Reserved instances (heavy utilization) 6 Spot instances, rest covered by On-Demand instances
  4. 6 Reserved instances (heavy utilization) 6 Reserved instances (medium utilization) rest covered by Spot instances

Question No:-30

You have been asked to propose a multi-region deployment of a web-facing application where a controlled portion of your traffic is being processed by an alternate region.

Which configuration would achieve that goal?

  1. Route53 record sets with weighted routing policy
  2. Route53 record sets with latency based routing policy
  3. Auto Scaling with scheduled scaling actions set
  4. Elastic Load Balancing with health checks enabled