AWS Associate Certified SysOps Administrator - Associate 3 — Questions and Answers
Question 1: A SysOps Administrator needs to patch all EC2 instances in a fleet during a maintenance window without writing custom scripts. Which AWS service automates this?
- AWS CodeDeploy with a rolling deployment
- AWS Systems Manager Patch Manager with a maintenance window (Correct answer)
- AWS OpsWorks with a lifecycle hook
- AWS Elastic Beanstalk managed platform updates
Correct answer: AWS Systems Manager Patch Manager with a maintenance window
Systems Manager Patch Manager scans instances for missing patches and installs them during a defined maintenance window using Run Command.
Question 2: CloudWatch Logs are not appearing for an EC2 instance. The CloudWatch agent is installed. What is the most likely cause?
- The instance type does not support CloudWatch agent
- The IAM instance profile lacks the CloudWatchAgentServerPolicy permission (Correct answer)
- CloudWatch Logs requires VPC Flow Logs to be enabled first
- The instance must be in a public subnet to reach CloudWatch endpoints
Correct answer: The IAM instance profile lacks the CloudWatchAgentServerPolicy permission
The CloudWatch agent requires the IAM instance profile to have permissions (typically CloudWatchAgentServerPolicy) to publish logs and metrics to CloudWatch.
Question 3: A SysOps Administrator wants to receive an alert when AWS costs exceed $500 in a single month. Which combination of services achieves this?
- AWS Cost Explorer anomaly detection + SNS
- AWS Budgets with an SNS alert action (Correct answer)
- CloudWatch billing alarm + Lambda notification
- AWS Trusted Advisor + CloudWatch Events
Correct answer: AWS Budgets with an SNS alert action
AWS Budgets allows you to define a cost threshold and trigger an SNS notification or email alert when actual or forecasted costs exceed the budget.
Question 4: An application deployed across three AZs shows that one AZ is receiving significantly more traffic than the others through an Application Load Balancer. What should the administrator check?
- Enable cross-zone load balancing on the ALB (Correct answer)
- Increase the instance count in the overloaded AZ
- Switch from ALB to NLB for more even distribution
- Enable sticky sessions to rebalance connections
Correct answer: Enable cross-zone load balancing on the ALB
Cross-zone load balancing distributes requests evenly across all registered instances regardless of AZ, preventing uneven distribution when AZs have different instance counts.
Question 5: Which feature of AWS CloudFormation allows a SysOps Administrator to preview the changes that will be made to a stack before executing an update?
- Stack policy
- Change set (Correct answer)
- Drift detection
- Stack rollback triggers
Correct answer: Change set
A CloudFormation change set shows a preview of how proposed changes will modify existing stack resources before the update is actually applied.
Question 6: A SysOps Administrator needs to grant temporary AWS console access to a third-party auditor without creating an IAM user. Which approach is correct?
- Share the root account credentials with MFA enabled
- Create a role with a trust policy for the auditor's AWS account and use AssumeRole (Correct answer)
- Generate temporary access keys using IAM and email them to the auditor
- Add the auditor's IP to a condition in an existing policy
Correct answer: Create a role with a trust policy for the auditor's AWS account and use AssumeRole
Creating an IAM role with a cross-account trust policy allows the auditor to assume the role using their own AWS credentials via AssumeRole, providing temporary scoped access.
Question 7: An S3 bucket is configured for static website hosting. Users report intermittent 403 errors on specific files. The bucket policy allows public read. What is the most likely cause?
- The files are encrypted with SSE-KMS, which is not supported for static websites
- The individual object ACLs are set to private, overriding the bucket policy (Correct answer)
- The bucket is in a region that does not support static website hosting
- CloudFront caching is serving stale 403 responses
Correct answer: The individual object ACLs are set to private, overriding the bucket policy
Object-level ACLs set to private can override the bucket policy's public-read grant, causing 403 errors for those specific objects.
AWS Associate Certified SysOps Administrator - Associate 3
A SysOps Administrator needs to patch all EC2 instances in a fleet during a maintenance window without writing custom scripts.
Which AWS service automates this?