AWS SysOps Practice Exam 1
1. A company has deployed a new web application. AWS WAF
Following the release, penetration testing revealed
a cross-site scripting vulnerability that could expose
user data.
Which AWS service will mitigate this issue?
- Amazon GuardDuty
- AWS Shield Standard
- AWS KMS
- AWS WAF
2. A company is implementing cross-account access from A SysOps Administrator is
a production account to a development account. An responsible for creating
IAM role must be created and a permissions policy the role and attaching the
must be attached. policy.
According to the AWS shared responsibility model,
who is responsible for creating the IAM role and at-
taching the policy?
- AWS is responsible for creating the role and attaching
the policy.
- A SysOps Administrator is responsible for creating the
role, and AWS is responsible for attaching the policy to
the role.
- A SysOps Administrator is responsible for creating the
role and attaching the policy.
- AWS is responsible for creating the role, and a SysOps
Administrator is responsible for attaching the policy to
the role.
, AWS SysOps Practice Exam 1
3. A SysOps Administrator needs to restrict access to Change Effect from Allow
a bucket to users connecting from the company to Deny in the second
IP address range. The company address range is: statement of the policy to
51.210.100.0/24 and the Administrator has created the deny requests not from the
following policy: source IP range.
"Version": "2008-10-17",
"Id": "S3BuccketPolicyId",
"Statement": [
{
"Sid": "S3Allow",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:53:::examples3bucket",
"arn:aws:53:::examples3bucket/*"
]
},
{
"Sid": "IPAllow",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:53:::examples3bucket",
"arn:aws:53:::examples3bucket/*"
],
"Condition": {
"NoIpAddress": {
"aws: SourceIP: "51.210.100.0/24"
, AWS SysOps Practice Exam 1
During testing it has been identified that users can
connect from IP addresses outside the company IP
address range.
How can the Administrator address this issue?
- Change Effect from Allow to Deny in the second
statement of the policy to deny requests not from the
source IP range.
- Modify the Condition element from the IAM policy to
aws:StringEquals instead of aws:SourceIp.
- Modify the IAM policy instead of the bucket policy to
restrict users from accessing the bucket based on their
source IP addresses.
- Modify the Condition operator to include both NotI-
pAddress and IpAddress to prevent unauthorized ac-
cess to the S3 bucket.
4. A SysOps Administrator manages an Auto Scaling Managing the health of
group of Amazon EC2 instances in an Amazon VPC. the underlying EC2 hosts.
The EC2 instances use a NAT instance to access the
internet.
Based on the shared responsibility model, AWS is re-
sponsible for managing which element of this deploy-
ment?
- Configuring the route table with the NAT instance ID.
- Ensuring high availability of the NAT instance.
- Managing scaling policies for the Auto Scaling group.
- Managing the health of the underlying EC2 hosts.
, AWS SysOps Practice Exam 1
5. A SysOps Administrator has started to use Amazon Verify that the Amazon In-
Inspector to assess Amazon EC2 instances for security spector agent is installed
and compliance. The Administrator noticed that some and running on the af-
security findings are missing for some instances. fected instances and then
Which action should the Administrator take to attempt restart the agent.
to resolve this issue?
- Generate the missing security findings list manually
by logging in to the affected EC2 instances and running
CLI commands.
- Verify that the unified agent for Amazon CloudWatch
is installed on the instances and collecting the neces-
sary metrics.
- Verify that the Amazon Inspector agent is installed
and running on the affected instances and then restart
the agent.
- Move the instances to a public subnet and attach an
Elastic IP address to ensure connectivity to the Amazon
Inspector service.
6. A company uses an Amazon ElastiCache Memcached Vertically scale the Elasti-
cluster for a popular website. The SysOps Administra- Cache cluster by changing
tor received reports of performance issues. The Ad- the node type.
ministrator checked the CloudWatch metrics and no- Add additional nodes to
ticed high CPU utilization. the existing ElastiCache
Which remediation steps should be taken to resolve cluster.
this issue? (Select TWO.)
(The Memcached engine
- Create an Auto Scaling group for the ElastiCache clus- horizontally scales easily,
ter. and it scales vertically by
1. A company has deployed a new web application. AWS WAF
Following the release, penetration testing revealed
a cross-site scripting vulnerability that could expose
user data.
Which AWS service will mitigate this issue?
- Amazon GuardDuty
- AWS Shield Standard
- AWS KMS
- AWS WAF
2. A company is implementing cross-account access from A SysOps Administrator is
a production account to a development account. An responsible for creating
IAM role must be created and a permissions policy the role and attaching the
must be attached. policy.
According to the AWS shared responsibility model,
who is responsible for creating the IAM role and at-
taching the policy?
- AWS is responsible for creating the role and attaching
the policy.
- A SysOps Administrator is responsible for creating the
role, and AWS is responsible for attaching the policy to
the role.
- A SysOps Administrator is responsible for creating the
role and attaching the policy.
- AWS is responsible for creating the role, and a SysOps
Administrator is responsible for attaching the policy to
the role.
, AWS SysOps Practice Exam 1
3. A SysOps Administrator needs to restrict access to Change Effect from Allow
a bucket to users connecting from the company to Deny in the second
IP address range. The company address range is: statement of the policy to
51.210.100.0/24 and the Administrator has created the deny requests not from the
following policy: source IP range.
"Version": "2008-10-17",
"Id": "S3BuccketPolicyId",
"Statement": [
{
"Sid": "S3Allow",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:53:::examples3bucket",
"arn:aws:53:::examples3bucket/*"
]
},
{
"Sid": "IPAllow",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:53:::examples3bucket",
"arn:aws:53:::examples3bucket/*"
],
"Condition": {
"NoIpAddress": {
"aws: SourceIP: "51.210.100.0/24"
, AWS SysOps Practice Exam 1
During testing it has been identified that users can
connect from IP addresses outside the company IP
address range.
How can the Administrator address this issue?
- Change Effect from Allow to Deny in the second
statement of the policy to deny requests not from the
source IP range.
- Modify the Condition element from the IAM policy to
aws:StringEquals instead of aws:SourceIp.
- Modify the IAM policy instead of the bucket policy to
restrict users from accessing the bucket based on their
source IP addresses.
- Modify the Condition operator to include both NotI-
pAddress and IpAddress to prevent unauthorized ac-
cess to the S3 bucket.
4. A SysOps Administrator manages an Auto Scaling Managing the health of
group of Amazon EC2 instances in an Amazon VPC. the underlying EC2 hosts.
The EC2 instances use a NAT instance to access the
internet.
Based on the shared responsibility model, AWS is re-
sponsible for managing which element of this deploy-
ment?
- Configuring the route table with the NAT instance ID.
- Ensuring high availability of the NAT instance.
- Managing scaling policies for the Auto Scaling group.
- Managing the health of the underlying EC2 hosts.
, AWS SysOps Practice Exam 1
5. A SysOps Administrator has started to use Amazon Verify that the Amazon In-
Inspector to assess Amazon EC2 instances for security spector agent is installed
and compliance. The Administrator noticed that some and running on the af-
security findings are missing for some instances. fected instances and then
Which action should the Administrator take to attempt restart the agent.
to resolve this issue?
- Generate the missing security findings list manually
by logging in to the affected EC2 instances and running
CLI commands.
- Verify that the unified agent for Amazon CloudWatch
is installed on the instances and collecting the neces-
sary metrics.
- Verify that the Amazon Inspector agent is installed
and running on the affected instances and then restart
the agent.
- Move the instances to a public subnet and attach an
Elastic IP address to ensure connectivity to the Amazon
Inspector service.
6. A company uses an Amazon ElastiCache Memcached Vertically scale the Elasti-
cluster for a popular website. The SysOps Administra- Cache cluster by changing
tor received reports of performance issues. The Ad- the node type.
ministrator checked the CloudWatch metrics and no- Add additional nodes to
ticed high CPU utilization. the existing ElastiCache
Which remediation steps should be taken to resolve cluster.
this issue? (Select TWO.)
(The Memcached engine
- Create an Auto Scaling group for the ElastiCache clus- horizontally scales easily,
ter. and it scales vertically by
