Free AWS-CERTIFIED-SYSOPS-ADMINISTRATOR-ASSOCIATE Amazon AWS-CERTIFIED-SYSOPS-ADMINISTRATOR-ASSOCIATE Practice Test Question - Page 15

Question 43 (Topic 1)

A company is running an application on a group of Amazon EC2 instances behind an Application Load Balancer. The EC2 instances run across three Availability Zones. The company needs to provide the customers with a maximum of two static IP addresses for their applications. How should a SysOps administrator meet these requirement?

Select an option, then click Submit answer.

○ Add AWS Global Accelerator in front of the Application Load Balancer.
○ Add an internal Network Load Balancer behind the Application Load Balancer.
○ Configure the Application Load Balancer in only two Availability Zones.
○ Create two Elastic IP addresses and assign them to the Application Load Balancer.

Reference / correct answer:

Add AWS Global Accelerator in front of the Application Load Balancer.

Most accepted answer: A. Add AWS Global Accelerator in front of the Application Load Balancer.

Community votes: A=4, B=1

Selected Answer: A "For IPv4, Global Accelerator provides two global static IPv4 addresses". https://docs.aws.amazon.com/global-accelerator/latest/dg/about-accelerators.eip-accelerator.html upvoted 7 times

Selected Answer: A When you create an Application Load Balancer or Network Load Balancer in the AWS Management Console, you can optionally add an accelerator at the same time. Elastic Load Balancing and Global Accelerator work together to transparently add the accelerator for you. The accelerator is created in your account, with the load balancer as an endpoint. Using an accelerator provides static IP addresses and improves the availability and performance of your applications. upvoted 5 times

Selected Answer: A I choose A, although at first was hesitating between A and D Why not D - Cannot assign Elastic IP address (static IP address) to ALB To assign static IP to ALB, there are 2 options: 1. Register ALB as a target of NLB to forward traffic from NLB to ALB, as Network Load Balancer can be assigned one Elastic IP address for each Availability Zone it uses. WHY NOT B - NLB has to be in front of ALB, not behind it 2. Use AWS Global Accelerator to get static IP addresses that act as a fixed entry point to your application endpoints - this is option A https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-lambda-to-enable-static-ip-addresses-for-application-load-balancers/ https://aws.amazon.com/blogs/networking-and-content-delivery/improving-availability-and-performance-for-application-load-balancers-using-one-click-integration-with-aws-global-accelerator/ upvoted 1 times

Selected Answer: B B is correct. You can't assign a static IP address to an Application Load Balancer. If your Application Load Balancer requires a static IP address, then it's a best practice to register it behind a Network Load Balancer. The static IP address that's assigned to a Network Load Balancer doesn't change and provides a fixed entry point for your Application Load Balancer. https://repost.aws/knowledge-center/alb-static-ip upvoted 1 times WinAndWin 2 years, 7 months ago Oh. I read to fast. ". Add an internal Network Load Balancer behind the Application Load Balancer." corect one is "Application Load Balancer behind internal Network Load Balancer". So, B is not correct. D is correct. upvoted 1 times WinAndWin 2 years, 7 months ago sorry, spam message. A is correct not D. upvoted 2 times Aamee 1 year, 9 months ago Dude seems to be in very hurry here :D.. upvoted 1 times ... ... ...

Oh. I read to fast. ". Add an internal Network Load Balancer behind the Application Load Balancer." corect one is "Application Load Balancer behind internal Network Load Balancer". So, B is not correct. D is correct. upvoted 1 times WinAndWin 2 years, 7 months ago sorry, spam message. A is correct not D. upvoted 2 times Aamee 1 year, 9 months ago Dude seems to be in very hurry here :D.. upvoted 1 times ... ...

Question 44 (Topic 1)

A company has attached the following policy to an IAM user: Which of the following actions are allowed for the IAM user?

Select an option, then click Submit answer.

○ Amazon RDS DescribeDBInstances action in the us-east-1 Region
○ Amazon S3 PutObject operation in a bucket named testbucket
○ Amazon EC2 DescribeInstances action in the us-east-1 Region
○ Amazon EC2 AttachNetworkInterface action in the eu-west-1 Region

Reference / correct answer:

Amazon EC2 DescribeInstances action in the us-east-1 Region

Most accepted answer: C. Amazon EC2 DescribeInstances action in the us-east-1 Region

Community votes: A=1, C=5

Selected Answer: C Explicit Deny Overrides Everything - If there is a statement with an Effect: Deny that explicitly denies an action, the action is denied outright, regardless of any "Allow" statements elsewhere in the policy. upvoted 1 times

Selected Answer: C Vote C. The last policy (3° part) deny all actions that are different by ec2:* e s3:GetObject, so the only permsisson are ec2:* e s3:GetObject, based of last policy. This last policy deny the first about allow rds:describe because like i said the only permission is ec2:* e s3:GetObject . So remain the 2° policy where we have ec2 :* with condition of us-east-1 Region. The only action allowed are the actions coming that from us-east-1 Region so the the answer is C. upvoted 1 times

Explicit deny overrides explicit allow. upvoted 1 times

Selected Answer: C C is the only possible answer for me NotAction explicitly matches everything except the specified list of actions. So there is EXPLICIT "Deny" for all actions EXCEPT "ec2:*", "s3:GetObject" , which would deny "rds:Describe*" because it is not in the list. According to AWS policy evaluation logic - "An explicit deny in any policy overrides any allows." - so Allow "rds:Describe*" would be overridden because of the Deny. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html upvoted 3 times

Agree with AC but D also seems fine - note that policy uses the NotAction element. This means it denies all actions EXCEPT listed in the NotAction array. In this case, all ec2:* actions and the s3:GetObject action are not denied, which means they are allowed. upvoted 1 times pawake8973 2 years, 3 months ago Sorry I meant D seems fine - so EC2 action AttachNetworkInterface (it falls under ec2:*) is not denied hence allowed, and the user can perform this action in any region, including eu-west-1. upvoted 1 times ...

Question 45 (Topic 1)

A company has an application that uses an Amazon RDS for MariaDB Multi-AZ database. The application becomes unavailable for several minutes every time the database experiences a failover during a planned maintenance event. What should a SysOps administrator do to reduce the downtime of the application during failover?

Select an option, then click Submit answer.

○ Create an RDS for MariaDB DB cluster that has multiple writer instances. Configure the application to retry failed queries on another primary node during maintenance events.
○ Configure the RDS maintenance window settings to pool connections while a failover is in process.
○ Configure an Amazon ElastiCache write-through cache for the database. Configure the application to connect to the cache instead of directly to the database.
○ Create an RDS proxy that is associated with the database. Configure the application to connect to the proxy instead of directly to the database.

Free AWS-CERTIFIED-SYSOPS-ADMINISTRATOR-ASSOCIATE – Amazon AWS-CERTIFIED-SYSOPS-ADMINISTRATOR-ASSOCIATE Practice Test Question