AWS SysOps Administrator Associate – Free Practice Exam Questions

The correct answer is C. “Create a change set for the running stack”.

Explanation:

Change sets allow you to preview how proposed changes to a stack might impact your running resources. For example, you can check whether your changes will delete or replace any critical resources.

AWS CloudFormation makes the changes to your stack only when you decide to execute the change set, allowing you to decide whether to proceed with your proposed changes or explore other changes by creating another change set. You can create and manage change sets using the AWS CloudFormation console, AWS CLI, or AWS CloudFormation API.

A. “Implement a blue/green strategy using AWS Elastic Beanstalk” is incorrect. In this case, Elastic Beanstalk is not being used, the Administrator needs to review changes directly to an AWS CloudFormation infrastructure stack. If you use Elastic Beanstalk you would make change in the EB console, not in the CloudFormation stack.

B. “Perform a canary deployment using Application Load Balancers and target groups” is incorrect. You cannot perform canary deployments of CloudFormation updates using ALBs and target groups. This is a strategy you might use with AWS CodeDeploy.

D. “Submit the update using the UpdateStack API call” is incorrect. This API action will immediately start the update. The correct API action would be “create-change-set”.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html

https://digitalcloud.training/certification-training/aws-certified-sysops-administrator-associate/aws-cloudformation/

The correct answer is A. “Enable flow logs on the NAT gateway elastic network interface and use Amazon CloudWatch insights to filter data based on the source IP addresses”.

Explanation:

VPC flow logs can be enabled on either the NAT gateway elastic network interface or the VPC. Amazon CloudWatch Insights can then be used to filter the data based on the source IP addresses.

For example, to find which instances are sending the most traffic through your NAT gateway, run the following query:

Note: you don’t need to know the specifics of how to define a filter; the above is purely to illustrate how you might do this if you’re interested (also see article linked below).

B. “Run an AWS Cost and Usage report and group the findings by instance ID” is incorrect. You cannot find this information in the cost and usage report.

C. “Use an Elastic IP on each instance, monitor the metrics generated in Amazon CloudWatch, and filter by instance ID” is incorrect. There is no need to add an EIP to each instance and you will not find this information in CloudWatch (it has performance metrics, not flow logs).

D. “View the Amazon CloudTrail logs and look for the API actions to use the NAT gateway” is incorrect. CloudTrail monitors API actions and there are no API actions issued to send data through a NAT gateway.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/vpc-find-traffic-sources-nat-gateway/

https://digitalcloud.training/certification-training/aws-certified-sysops-administrator-associate/amazon-virtual-private-cloud-vpc/

The correct answers are B. “Attach a virtual private gateway to the VPC and configure routing” and D. “Configure a VPN connection back to the corporate office”.

Explanation:

The best solution for this requirement is to configure an AWS site-to-site virtual private network (VPN). To do this you must add a virtual private gateway to the VPC, update the route table, and configure the customer gateway to connect the VPN to the corporate office.

The following diagram shows the key components of the configuration for this scenario.

A. “Attach a NAT gateway to the VPC and configure routing” is incorrect. NAT gateways are used to enable internet connectivity for instances in private subnets. In this case, internet connectivity should be restricted.

C. “Attach an internet gateway to the VPC and configure routing” is incorrect. An internet gateway is used for internet connectivity which should be restricted in this case. An internet gateway is not required for a VPN connection.

E. “Configure a Network Load Balancer in front of the EC2 instances” is incorrect. This does not enable secure access to the corporate network that avoids the internet.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario4.html

https://digitalcloud.training/certification-training/aws-certified-sysops-administrator-associate/amazon-virtual-private-cloud-vpc/