- (Exam Topic 1)
A company's SysOps administrator deploys a public Network Load Balancer (NLB) in front of the company's web application. The web application does not use any Elastic IP addresses. Users must access the web application by using the company's domain name. The SysOps administrator needs to configure Amazon Route 53 to route traffic to the NLB.
Which solution will meet these requirements MOST cost-effectively?

1. A. Create a Route 53 AAAA record for the NLB.
2. B. Create a Route 53 alias record for the NLB.
3. C. Create a Route 53 CAA record for the NLB.
4. D. Create a Route 53 CNAME record for the NLB.

Correct Answer: B

- (Exam Topic 1)
A large company is using AWS Organizations to manage hundreds of AWS accounts across multiple AWS Regions. The company has turned on AWS Config throughout the organization.
The company requires all Amazon S3 buckets to block public read access. A SysOps administrator must generate a monthly report that shows all the S3 buckets and whether they comply with this requirement.
Which combination of steps should the SysOps administrator take to collect this data? {Select TWO).

1. A. Create an AWS Config aggregator in an aggregator accoun
2. B. Use the organization as the source.Retrieve the compliance data from the aggregator.
3. C. Create an AWS Config aggregator in each accoun
4. D. Use an S3 bucket in an aggregator account as the destinatio
5. E. Retrieve the compliance data from the S3 bucket
6. F. Edit the AWS Config policy in AWS Organization
7. G. Use the organization's management account to turn on the s3-bucket-public-read-prohibited rule for the entire organization.
8. H. Use the AWS Config compliance report from the organization's management accoun
9. I. Filter the results by resource, and select Amazon S3.
10. J. Use the AWS Config API to apply the s3-bucket-public-read-prohibited rule in all accounts for all available Regions.

Correct Answer: CD

- (Exam Topic 1)
A company's SysOps administrator deploys four new Amazon EC2 instances by using the standard Amazon Linux 2 Amazon Machine Image (AMI). The company needs to be able to use AWS Systems Manager to manage the instances The SysOps administrator notices that the instances do not appear in the Systems Manager console
What must the SysOps administrator do to resolve this issue?

1. A. Connect to each instance by using SSH Install Systems Manager Agent on each instance Configure Systems Manager Agent to start automatically when the instances start up
2. B. Use AWS Certificate Manager (ACM) to create a TLS certificate Import the certificate into each instance Configure Systems Manager Agent to use the TLS certificate for secure communications
3. C. Connect to each instance by using SSH Create an ssm-user account Add the ssm-user account to the/etcsudoers d directory
4. D. Attach an IAM instance profile to the instances Ensure that the instance profile contains the AmazonSSMManagedinstanceCore policy

Correct Answer: D

- (Exam Topic 1)
A SysOps administrator is trying to set up an Amazon Route 53 domain name to route traffic to a website hosted on Amazon S3. The domain name of the website is www.anycompany.com and the S3 bucket name is anycompany-static. After the record set is set up in Route 53, the domain name www.anycompany.com does not seem to work, and the static website is not displayed in the browser.
Which of the following is a cause of this?

1. A. The S3 bucket must be configured with Amazon CloudFront first.
2. B. The Route 53 record set must have an IAM role that allows access to the S3 bucket.
3. C. The Route 53 record set must be in the same region as the S3 bucket.
4. D. The S3 bucket name must match the record set name in Route 53.

Correct Answer: D

- (Exam Topic 1)
A company needs to view a list of security groups that are open to the internet on port 3389. What should a SysOps administrator do to meet this requirement?

1. A. Configure Amazon GuardDuly to scan security groups and report unrestricted access on port 3389.
2. B. Configure a service control policy (SCP) to identify security groups that allow unrestricted access on port 3389
3. C. Use AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.
4. D. Use AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389.

Correct Answer: D