AWS Associate Certified SysOps Administrator - Associate 2 — Questions and Answers
Question 1: A SysOps Administrator needs to ensure that EC2 instances in a private subnet can access S3 without traversing the public internet. Which solution achieves this?
- Create a NAT Gateway and add a route to S3 in the route table
- Create a VPC Gateway Endpoint for S3 and update the route table (Correct answer)
- Enable VPC Flow Logs and add an S3 bucket policy
- Attach an IAM role with S3 access to the EC2 instances only
Correct answer: Create a VPC Gateway Endpoint for S3 and update the route table
A VPC Gateway Endpoint for S3 allows private subnet instances to reach S3 without traversing the internet, using the AWS internal network.
Question 2: An Auto Scaling group is not launching instances because the launch template references an AMI that no longer exists. What is the fastest remediation?
- Delete and recreate the Auto Scaling group with a new AMI
- Update the launch template with a valid AMI ID and set it as the default version (Correct answer)
- Modify the existing launch template version in-place to fix the AMI
- Suspend the Auto Scaling group and manually launch replacement instances
Correct answer: Update the launch template with a valid AMI ID and set it as the default version
Creating a new launch template version with a valid AMI and setting it as default allows the Auto Scaling group to resume launching instances immediately.
Question 3: Which CloudWatch metric should a SysOps Administrator monitor to detect when an EBS gp2 volume is exhausting its I/O credit balance?
- VolumeQueueLength
- BurstBalance (Correct answer)
- VolumeWriteOps
- VolumeIdleTime
Correct answer: BurstBalance
BurstBalance tracks the percentage of I/O credits remaining for gp2 volumes; when it reaches 0, throughput is throttled to the baseline.
Question 4: A company wants RDS Multi-AZ failover to complete as fast as possible. Which action reduces failover time the most?
- Enable RDS Proxy in front of the database endpoint (Correct answer)
- Increase the instance class to a larger size
- Enable automated backups with a 1-day retention period
- Switch from Multi-AZ to a Read Replica for high availability
Correct answer: Enable RDS Proxy in front of the database endpoint
RDS Proxy maintains a pool of connections and redirects them to the new primary during failover, reducing application-visible downtime from ~60s to seconds.
Question 5: A SysOps Administrator receives a notification that an EC2 instance's system status check has failed. Which action should be taken first?
- Reboot the instance from the console
- Stop and start the instance to migrate it to new hardware (Correct answer)
- Terminate the instance and launch a replacement from its AMI
- Submit a support ticket and wait for AWS to remediate the hardware
Correct answer: Stop and start the instance to migrate it to new hardware
A failed system status check indicates an AWS infrastructure problem; stopping and starting the instance migrates it to healthy hardware in the same AZ.
Question 6: An S3 bucket has versioning enabled. A user accidentally deleted an object. How can the SysOps Administrator restore it without enabling MFA Delete?
- Restore the object from an S3 Glacier archive
- Delete the delete marker for that object version (Correct answer)
- Re-upload the object from a local backup
- Use AWS Backup to restore from the latest recovery point
Correct answer: Delete the delete marker for that object version
When versioning is enabled, a delete operation creates a delete marker; removing the delete marker restores the previous version as the current object.
Question 7: A company needs to enforce that all new S3 buckets block public access at the account level. Which service and feature accomplishes this with a single configuration?
- AWS Config with a managed rule for S3 public access
- S3 Block Public Access settings at the account level (Correct answer)
- IAM Service Control Policy that denies s3:PutBucketAcl
- CloudTrail alerts on s3:CreateBucket API calls
Correct answer: S3 Block Public Access settings at the account level
The S3 Block Public Access settings applied at the AWS account level prevent any bucket in that account from being made public, overriding bucket-level settings.
AWS Associate Certified SysOps Administrator - Associate 2
A SysOps Administrator needs to ensure that EC2 instances in a private subnet can access S3 without traversing the public internet.
Which solution achieves this?