AWS-SysOps Free Practice Test

- (Exam Topic 1)
A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API calls using the CLI. However. users are not prompted to enter MFA tokens, and are able to run CLI commands without MFA. In an attempt to enforce MFA, the company attached an IAM policy to all users that denies API calls that have not been authenticated with MFA.
What additional step must be taken to ensure that API calls are authenticated using MFA?

1. A. Enable MFA on IAM roles, and require IAM users to use role credentials to sign API calls.
2. B. Ask the IAM users to log into the AWS Management Console with MFA before making API calls using the CLI.
3. C. Restrict the IAM users to use of the console, as MFA is not supported for CLI use.
4. D. Require users to use temporary credentials from the get-session token command to sign API calls.

Correct Answer: D

- (Exam Topic 1)
An application team uses an Amazon Aurora MySQL DB cluster with one Aurora Replica. The application team notices that the application read performance degrades when user connections exceed 200. The number of user connections is typically consistent around 180. with occasional sudden increases above 200 connections. The application team wants the application to automatically scale as user demand increases or decreases.
Which solution will meet these requirements?

1. A. Migrate to a new Aurora multi-master DB cluste
2. B. Modify the application database connection string.
3. C. Modify the DB cluster by changing to serverless mode whenever user connections exceed 200.
4. D. Create an auto scaling policy with a target metric of 195 DatabaseConnections
5. E. Modify the DB cluster by increasing the Aurora Replica instance size.

Correct Answer: C

- (Exam Topic 1)
A SysOps administrator is unable to authenticate an AWS CLI call to an AWS service Which of the following is the cause of this issue?

1. A. The IAM password is incorrect
2. B. The server certificate is missing
3. C. The SSH key pair is incorrect
4. D. There is no access key

Correct Answer: C

- (Exam Topic 1)
A company's SysOps administrator attempts to restore an Amazon Elastic Block Store (Amazon EBS) snapshot. However, the snapshot is missing because another system administrator accidentally deleted the snapshot. The company needs the ability to recover snapshots for a specified period of time after snapshots are deleted.
Which solution will provide this functionality?

1. A. Turn on deletion protection on individual EBS snapshots that need to be kept.
2. B. Create an 1AM policy that denies the deletion of EBS snapshots by using a condition statement for the snapshot age Apply the policy to all users
3. C. Create a Recycle Bin retention rule for EBS snapshots for the desired retention period.
4. D. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule an AWS Lambda function to copy EBS snapshots to Amazon S3 Glacier.

Correct Answer: B

- (Exam Topic 1)
A team of On-call engineers frequently needs to connect to Amazon EC2 Instances In a private subnet to troubleshoot and run commands. The Instances use either the latest AWS-provided Windows Amazon Machine Images (AMIs) or Amazon Linux AMIs.
The team has an existing IAM role for authorization. A SysOps administrator must provide the team with
access to the Instances by granting IAM permissions to this Which solution will meet this requirement?

1. A. Add a statement to the IAM role policy to allow the ssm:StartSession action on the instance
2. B. Instruct the team to use AWS Systems Manager Session Manager to connect to the Instances by using the assumed IAM role.
3. C. Associate an Elastic IP address and a security group with each instanc
4. D. Add the engineers' IP addresses to the security group inbound rule
5. E. Add a statement to the IAM role policy to allow the ec2:AuthoflzeSecurityGroupIngress action so that the team can connect to the Instances.
6. F. Create a bastion host with an EC2 Instance, and associate the bastion host with the VP
7. G. Add a statement to the IAM role policy to allow the ec2:CreateVpnConnection action on the bastion hos
8. H. Instruct the team to use the bastion host endpoint to connect to the instances.D Create an internet-facing Network Load Balance
9. I. Use two listener
10. J. Forward port 22 to a target group of Linux instance
11. K. Forward port 3389 to a target group of Windows Instance
12. L. Add a statement to the IAM role policy to allow the ec2:CreateRoute action so that the team can connect to the Instances.

Correct Answer: A