- (Exam Topic 1)
A company runs a stateless application that is hosted on an Amazon EC2 instance. Users are reporting performance issues. A SysOps administrator reviews the Amazon CloudWatch metrics for the application and notices that the instance's CPU utilization frequently reaches 90% during business hours.
What is the MOST operationally efficient solution that will improve the application's responsiveness?

1. A. Configure CloudWatch logging on the EC2 instanc
2. B. Configure a CloudWatch alarm for CPU utilization to alert the SysOps administrator when CPU utilization goes above 90%.
3. C. Configure an AWS Client VPN connection to allow the application users to connect directly to the EC2 instance private IP address to reduce latency.
4. D. Create an Auto Scaling group, and assign it to an Application Load Balance
5. E. Configure a target tracking scaling policy that is based on the average CPU utilization of the Auto Scaling group.
6. F. Create a CloudWatch alarm that activates when the EC2 instance's CPU utilization goes above 80%.Configure the alarm to invoke an AWS Lambda function that vertically scales the instance.

Correct Answer: C

- (Exam Topic 1)
A manufacturing company uses an Amazon RDS DB instance to store inventory of all stock items. The company maintains several AWS Lambda functions that interact with the database to add, update, and delete items. The Lambda functions use hardcoded credentials to connect to the database.
A SysOps administrator must ensure that the database credentials are never stored in plaintext and that the password is rotated every 30 days.
Which solution will meet these requirements in the MOST operationally efficient manner?

1. A. Store the database password as an environment variable for each Lambda functio
2. B. Create a new Lambda function that is named PasswordRotat
3. C. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and update the environment variable for each Lambda function.
4. D. Use AWS Key Management Service (AWS KMS) to encrypt the database password and to store the encrypted password as an environment variable for each Lambda functio
5. E. Grant each Lambda function access to the KMS key so that the database password can be decrypted when require
6. F. Create a new Lambda function that is named PasswordRotate to change the password every 30 days.
7. G. Use AWS Secrets Manager to store credentials for the databas
8. H. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automaticall
9. I. Specify an automatic rotation schedule of 30 day
10. J. Update each Lambda function to access the database password from SecretsManager.
11. K. Use AWS Systems Manager Parameter Store to create a secure string to store credentials for the databas
12. L. Create a new Lambda function called PasswordRotat
13. M. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and to update the secret within Parameter Stor
14. N. Update each Lambda function to access the database password from Parameter Store.

Correct Answer: C
When you choose to enable rotation, Secrets Manager supports the following Amazon Relational Database Service (Amazon RDS) databases with AWS written and tested Lambda rotation function templates, and full configuration of the rotation process:
Amazon Aurora on Amazon RDS MySQL on Amazon RDS PostgreSQL on Amazon RDS Oracle on Amazon RDS MariaDB on Amazon RDS
Microsoft SQL Server on Amazon RDS https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

- (Exam Topic 1)
A SysOps administrator has created an AWS Service Catalog portfolio and has shared the portfolio with a second AWS account in the company. The second account is controlled by a different administrator.
Which action will the administrator of the second account be able to perform?

1. A. Add a product from the imported portfolio to a local portfolio.
2. B. Add new products to the imported portfolio.
3. C. Change the launch role for the products contained in the imported portfolio.
4. D. Customize the products in the imported portfolio.

Correct Answer: A

- (Exam Topic 1)
A large company is using AWS Organizations to manage its multi-account AWS environment. According to company policy, all users should have read-level access to a particular Amazon S3 bucket in a central account. The S3 bucket data should not be available outside the organization. A SysOps administrator must set up the permissions and add a bucket policy to the S3 bucket.
Which parameters should be specified to accomplish this in the MOST efficient manner?

1. A. Specify '*' as the principal and PrincipalOrgld as a condition.
2. B. Specify all account numbers as the principal.
3. C. Specify PrincipalOrgld as the principal.
4. D. Specify the organization's management account as the principal.

Correct Answer: C

- (Exam Topic 1)
A SysOps administrator has Nocked public access to all company Amazon S3 buckets. The SysOps administrator wants to be notified when an S3 bucket becomes publicly readable in the future.
What is the MOST operationally efficient way to meet this requirement?

1. A. Create an AWS Lambda function that periodically checks the public access settings for each S3 bucket.Set up Amazon Simple Notification Service (Amazon SNS) to send notifications.
2. B. Create a cron script that uses the S3 API to check the public access settings for each S3 bucke
3. C. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications
4. D. Enable S3 Event notified tons for each S3 bucke
5. E. Subscribe S3 Event Notifications to an Amazon Simple Notification Service (Amazon SNS) topic.
6. F. Enable the s3-bucket-public-read-prohibited managed rule in AWS Confi
7. G. Subscribe the AWS Config rule to an Amazon Simple Notification Service (Amazon SNS) topic.

Correct Answer: D