AWS Associate Certified SysOps Administrator - Associate 5 — Questions and Answers
Question 1: A production RDS MySQL instance is experiencing high CPU utilization. The DBA confirms that long-running read queries are the cause. Which solution offloads reads with the least downtime?
- Enable RDS Multi-AZ to distribute read traffic to the standby
- Create one or more RDS Read Replicas and direct read traffic to them (Correct answer)
- Increase the RDS instance class to a compute-optimized type
- Enable RDS Performance Insights and set a CPU alarm
Correct answer: Create one or more RDS Read Replicas and direct read traffic to them
RDS Read Replicas asynchronously replicate data from the primary and can serve SELECT queries, reducing CPU load on the primary instance with no downtime to create.
Question 2: A SysOps Administrator wants to enforce that all EC2 instances must have a specific tag (Environment) before they can be launched. Which service enforces this?
- AWS Config with a tag compliance rule
- IAM policy with a condition on ec2:RunInstances requiring the tag (Correct answer)
- CloudTrail with an EventBridge rule to stop untagged instances
- AWS Trusted Advisor tagging recommendations
Correct answer: IAM policy with a condition on ec2:RunInstances requiring the tag
An IAM policy with a Condition block using aws:RequestTag can deny ec2:RunInstances if the required tag is not present at launch time.
Question 3: An Elastic Load Balancer's access logs show a high number of HTTP 502 errors. What is the most common cause?
- The load balancer security group is blocking port 80
- The target instances are returning invalid responses or are unhealthy (Correct answer)
- The SSL certificate attached to the listener has expired
- The ALB idle timeout is set too low
Correct answer: The target instances are returning invalid responses or are unhealthy
HTTP 502 (Bad Gateway) from an ALB indicates the load balancer received an invalid response from the target instance, often caused by an unhealthy or misconfigured application.
Question 4: A company uses AWS Organizations with Service Control Policies. Developers report they cannot create resources in us-west-1 even though their IAM permissions allow it. What is the cause?
- The IAM policy has an explicit Deny for us-west-1
- An SCP applied to the account or OU restricts API calls to allowed regions only (Correct answer)
- The developer's MFA device is not registered for that region
- CloudTrail logging is not enabled in us-west-1
Correct answer: An SCP applied to the account or OU restricts API calls to allowed regions only
SCPs act as guardrails and can restrict which AWS regions member accounts can use; if us-west-1 is not in the allow list, IAM permissions in that account cannot override the SCP.
Question 5: A SysOps Administrator needs to securely store and automatically rotate database credentials used by an EC2 application. Which AWS service is purpose-built for this?
- AWS Systems Manager Parameter Store with SecureString
- AWS Secrets Manager with automatic rotation enabled (Correct answer)
- AWS KMS with customer-managed keys stored in S3
- AWS Certificate Manager for credential storage
Correct answer: AWS Secrets Manager with automatic rotation enabled
AWS Secrets Manager stores credentials, supports automatic rotation using Lambda functions, and integrates natively with RDS for seamless credential rotation.
Question 6: A CloudFormation stack update fails and rolls back. The SysOps Administrator needs to understand exactly which resource caused the failure. Where should they look first?
- The CloudTrail event history for the stack update API call
- The CloudFormation stack events tab filtered by FAILED status (Correct answer)
- The CloudWatch Logs group for the CloudFormation service
- The AWS Config timeline for the affected resources
Correct answer: The CloudFormation stack events tab filtered by FAILED status
The CloudFormation stack events tab shows a chronological log of each resource's status; filtering for FAILED events identifies which resource caused the rollback and displays the error message.
Question 7: A SysOps Administrator needs to ensure that objects uploaded to an S3 bucket are always encrypted at rest, even if the uploader forgets to specify encryption. Which bucket setting enforces this?
- Enable S3 Versioning with MFA Delete
- Configure a bucket policy that denies s3:PutObject without server-side encryption
- Enable S3 default encryption on the bucket (SSE-S3 or SSE-KMS) (Correct answer)
- Apply an S3 Object Lock policy in Governance mode
Correct answer: Enable S3 default encryption on the bucket (SSE-S3 or SSE-KMS)
S3 default encryption automatically encrypts all new objects uploaded to the bucket using SSE-S3 or SSE-KMS even if the request doesn't specify an encryption header.
AWS Associate Certified SysOps Administrator - Associate 5
A production RDS MySQL instance is experiencing high CPU utilization.
The DBA confirms that long-running read queries are the cause.
Which solution offloads reads with the least downtime?