S3 Lifecycle rules<\/span><\/li>\n<\/ol>\nCorrect Answer: 3. S3 Versioning<\/b><\/p>\n
Explanation:<\/b><\/p>\n
S3 Versioning helps protect objects from accidental deletion or overwriting by maintaining multiple versions of objects. When an object is deleted in a versioned bucket, S3 can place a delete marker rather than permanently removing the underlying object version, allowing administrators to recover the previous data when appropriate. S3 Object Lock provides stronger write-once-read-many retention controls and is intended for immutability requirements. Lifecycle rules automate object transitions and expiration, while Transfer Acceleration improves transfer performance over long distances. Therefore, for general protection against accidental object deletion or overwriting, S3 Versioning is an appropriate operational feature.<\/span><\/p>\nQuestion 282. An operations team wants to identify incomplete Amazon S3 multipart uploads and automatically remove them after a defined period. Which configuration should be used?<\/b><\/h3>\n\n- <\/b> S3 Lifecycle rule<\/span><\/li>\n
- <\/b> S3 Versioning<\/span><\/li>\n
- <\/b> S3 Replication<\/span><\/li>\n
- <\/b> S3 Access Point<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. S3 Lifecycle rule<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon S3 Lifecycle rules can automatically abort incomplete multipart uploads after a specified number of days. This is useful because incomplete multipart uploads can consume storage even though the final object was never successfully completed. An operations team can configure a lifecycle rule specifically for incomplete multipart uploads and establish an appropriate cleanup period. Versioning manages multiple object versions, replication copies objects between supported S3 destinations, and access points provide customized access configurations. Therefore, a lifecycle rule is the appropriate operational mechanism for automatically cleaning up incomplete multipart uploads and preventing unnecessary storage consumption.<\/span><\/p>\nQuestion 283. An EC2 instance uses an EBS volume that is approaching its required storage capacity. The operations team wants to increase the volume size without detaching it. Which capability should be used?<\/b><\/h3>\n\n- <\/b> EBS snapshot restore<\/span><\/li>\n
- <\/b> Elastic Volumes<\/span><\/li>\n
- <\/b> EBS Fast Snapshot Restore<\/span><\/li>\n
- <\/b> EBS encryption<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Elastic Volumes<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon EBS Elastic Volumes allows supported EBS volumes to be modified while they remain attached to an EC2 instance. Operations teams can increase volume size and, for supported volume types, modify performance characteristics such as IOPS without requiring the traditional process of detaching and recreating the volume. After the volume modification, the operating system may also require filesystem expansion so the additional capacity becomes usable. EBS snapshots provide point-in-time copies, Fast Snapshot Restore improves snapshot-based volume initialization, and encryption protects data. Therefore, Elastic Volumes is the appropriate capability for increasing attached EBS storage with minimal disruption.<\/span><\/p>\nQuestion 284. An EC2 instance must retrieve instance metadata securely, and the organization wants to require the latest recommended metadata authentication mechanism. Which configuration should be enforced?<\/b><\/h3>\n\n- <\/b> IMDSv2<\/span><\/li>\n
- <\/b> Instance termination protection<\/span><\/li>\n
- <\/b> EBS encryption<\/span><\/li>\n
- <\/b> EC2 user data<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. IMDSv2<\/b><\/p>\n
Explanation:<\/b><\/p>\n
EC2 Instance Metadata Service Version 2 (IMDSv2) provides a session-oriented method for accessing instance metadata and uses a token-based request process. Requiring IMDSv2 can help reduce exposure to certain classes of metadata-access attacks compared with allowing unrestricted IMDSv1 access. An operations team can configure the instance metadata options so that IMDSv2 is required. Termination protection helps prevent accidental instance termination, EBS encryption protects stored block data, and user data supplies startup configuration. Therefore, when the operational requirement is to enforce the recommended metadata access mechanism, IMDSv2 is the appropriate configuration.<\/span><\/p>\nQuestion 285. An Auto Scaling group manages instances through a launch template. The operations team needs to update the AMI and instance configuration for future launches without modifying the existing template version. What should be used?<\/b><\/h3>\n\n- <\/b> Auto Scaling lifecycle hook<\/span><\/li>\n
- <\/b> Launch template version<\/span><\/li>\n
- <\/b> Security group rule<\/span><\/li>\n
- <\/b> EBS snapshot<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Launch template version<\/b><\/p>\n
Explanation:<\/b><\/p>\n
EC2 launch templates support multiple versions, allowing an operations team to create a new version containing updated settings while preserving previous versions for rollback or controlled migration. For example, a new version can specify a different AMI, instance type, security group configuration, user data, or other launch parameters. The Auto Scaling group can then be configured to use the desired launch template version. Lifecycle hooks control actions during instance launch or termination but do not provide configuration versioning. Security groups manage network access, while EBS snapshots provide storage backups. Therefore, creating a new launch template version is the appropriate approach.<\/span><\/p>\nQuestion 286. An ALB receives requests for several applications hosted behind different target groups. The operations team wants to route requests according to the requested hostname. Which feature should be configured?<\/b><\/h3>\n\n- <\/b> ALB listener host-header rules<\/span><\/li>\n
- <\/b> ALB health checks<\/span><\/li>\n
- <\/b> NLB static IP addresses<\/span><\/li>\n
- <\/b> Route 53 failover routing<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. ALB listener host-header rules<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Application Load Balancer listener rules can inspect HTTP request attributes such as the Host header and route requests to different target groups based on hostname. For example, requests for one application domain can be forwarded to one target group while requests for another domain are sent to a different group. This provides Layer 7 routing flexibility for multiple applications sharing an ALB. Health checks determine whether registered targets can receive traffic, NLBs provide Layer 4 load balancing characteristics, and Route 53 failover routing operates at the DNS level. Therefore, host-header listener rules are the appropriate feature for hostname-based application routing.<\/span><\/p>\nQuestion 287. An operations team needs a record of HTTP requests received by an Application Load Balancer for troubleshooting and traffic analysis. Which feature should be enabled?<\/b><\/h3>\n\n- <\/b> ALB target health checks<\/span><\/li>\n
- <\/b> ALB access logs<\/span><\/li>\n
- <\/b> VPC DHCP options<\/span><\/li>\n
- <\/b> Security group flow logging<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. ALB access logs<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Application Load Balancer access logs provide detailed information about requests processed by the load balancer. They can be useful for troubleshooting application traffic, identifying request patterns, analyzing response codes, investigating client behavior, and diagnosing performance issues. Access logs are different from target health checks, which determine whether registered targets are healthy enough to receive traffic. DHCP options control network configuration for instances, while security groups do not generate the same type of HTTP request records. Therefore, enabling ALB access logs is the appropriate operational solution when a team needs a detailed record of requests handled by the load balancer.<\/span><\/p>\nQuestion 288. A Network Load Balancer target is intermittently unavailable. The operations team wants the load balancer to determine whether the target is healthy before sending traffic to it. Which feature should be configured?<\/b><\/h3>\n\n- <\/b> NLB access logging only<\/span><\/li>\n
- <\/b> NLB health checks<\/span><\/li>\n
- <\/b> Route 53 weighted routing<\/span><\/li>\n
- <\/b> VPC peering<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. NLB health checks<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Network Load Balancer health checks allow the load balancer to determine whether registered targets are capable of receiving traffic. Depending on the configuration, health checks can use supported protocols and ports to verify target availability. When a target fails its health checks, the load balancer can stop routing new traffic to that unhealthy target and continue using healthy targets. Access logging provides request information but does not determine target health. Route 53 weighted routing distributes DNS responses according to configured weights, while VPC peering connects networks. Therefore, NLB health checks are the correct operational feature for detecting unavailable targets.<\/span><\/p>\nQuestion 289. An organization needs DNS records that should only be resolvable by resources inside a specific VPC. Which Route 53 feature should be used?<\/b><\/h3>\n\n- <\/b> Public hosted zone<\/span><\/li>\n
- <\/b> Private hosted zone<\/span><\/li>\n
- <\/b> Route 53 traffic flow<\/span><\/li>\n
- <\/b> Route 53 global accelerator<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Private hosted zone<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A Route 53 private hosted zone contains DNS records that can be resolved from associated Amazon VPCs rather than being publicly available through the internet. This is useful for internal applications, private service endpoints, internal load balancers, and other resources that require private DNS naming. A public hosted zone is intended for internet-facing DNS resolution. Route 53 traffic flow provides advanced traffic routing management, while Global Accelerator is a separate networking service designed to improve application availability and performance through static anycast IP addresses. Therefore, a private hosted zone is the appropriate choice when DNS names should remain accessible only within associated VPC environments.<\/span><\/p>\nQuestion 290. A company connects multiple VPCs through AWS Transit Gateway. An application in one VPC cannot reach another VPC even though both are attached to the Transit Gateway. What should the operations team inspect first?<\/b><\/h3>\n\n- <\/b> S3 bucket versioning<\/span><\/li>\n
- <\/b> Transit Gateway route tables<\/span><\/li>\n
- <\/b> IAM password policy<\/span><\/li>\n
- <\/b> CloudFront cache policy<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. Transit Gateway route tables<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Transit Gateway uses route tables to determine how traffic is forwarded between attached networks. Simply attaching multiple VPCs to a Transit Gateway does not automatically guarantee that all attachments can communicate with each other. The operations team should verify that the relevant attachments are associated with the correct Transit Gateway route table and that appropriate routes are present or propagated. The VPC route tables and security controls should also be checked as part of broader troubleshooting, but the first area matching this specific Transit Gateway routing problem is the Transit Gateway route table configuration. Therefore, Transit Gateway route tables should be inspected first.<\/span><\/p>\nQuestion 291. A VPC uses a Site-to-Site VPN connection. One tunnel is down, but the second tunnel remains available. Which operational characteristic helps maintain connectivity?<\/b><\/h3>\n\n- <\/b> VPN provides two tunnels for redundancy<\/span><\/li>\n
- <\/b> VPN automatically creates a public hosted zone<\/span><\/li>\n
- <\/b> VPN disables route propagation<\/span><\/li>\n
- <\/b> VPN requires an S3 endpoint<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. VPN provides two tunnels for redundancy<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AWS Site-to-Site VPN connections are designed with two tunnels between the AWS side and the customer gateway side. Having two tunnels provides redundancy and allows connectivity to continue when one tunnel experiences an outage, assuming routing and customer-side configuration support the available tunnel. Operations teams should monitor tunnel status and relevant CloudWatch metrics and verify routing behavior when troubleshooting VPN availability. Public hosted zones, S3 endpoints, and route propagation are separate networking or DNS concepts and do not explain the built-in tunnel redundancy. Therefore, the presence of two VPN tunnels is the operational characteristic that helps maintain connectivity when one tunnel fails.<\/span><\/p>\nQuestion 292. Two VPCs are connected using VPC peering. An instance in VPC-A can communicate with VPC-B, but VPC-B cannot use the peering connection to reach VPC-C through VPC-A. What explains this behavior?<\/b><\/h3>\n\n- <\/b> Security groups always block peering traffic<\/span><\/li>\n
- <\/b> VPC peering is non-transitive<\/span><\/li>\n
- <\/b> VPC peering requires a NAT Gateway<\/span><\/li>\n
- <\/b> VPC peering only supports IPv6<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. VPC peering is non-transitive<\/b><\/p>\n
Explanation:<\/b><\/p>\n
VPC peering connections do not provide transitive routing. If VPC-A is peered with VPC-B and separately peered with VPC-C, traffic from VPC-B cannot automatically traverse VPC-A to reach VPC-C through the two peering relationships. Each required network relationship must be explicitly established or another architecture, such as AWS Transit Gateway, should be considered for centralized connectivity. Security groups can affect traffic, but they are not the reason for this specific routing limitation. NAT Gateway is not required for VPC peering, and VPC peering supports more than IPv6. Therefore, non-transitive routing is the key concept.<\/span><\/p>\nQuestion 293. A security group allows inbound TCP traffic from another security group attached to application servers. Which statement describes this configuration?<\/b><\/h3>\n\n- <\/b> The rule can reference another security group<\/span><\/li>\n
- <\/b> The rule requires a public IP address for every instance<\/span><\/li>\n
- <\/b> The rule creates a network ACL automatically<\/span><\/li>\n
- <\/b> The rule becomes stateless<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. The rule can reference another security group<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon VPC security groups can use another security group as the source of an inbound rule in supported configurations. This allows administrators to define access based on the identity of resources associated with a security group rather than maintaining individual IP addresses. For example, a database security group can permit inbound traffic from an application-server security group on the database port. Security groups remain stateful, meaning return traffic is automatically allowed when the corresponding connection is permitted. The rule does not require public IP addresses and does not create a network ACL. Therefore, referencing another security group is the appropriate configuration.<\/span><\/p>\nQuestion 294. A VPC subnet needs additional private IP address space without creating a new VPC. Which approach should the operations team consider?<\/b><\/h3>\n\n- <\/b> Add a secondary CIDR block to the VPC<\/span><\/li>\n
- <\/b> Enable CloudFront<\/span><\/li>\n
- <\/b> Create an S3 bucket<\/span><\/li>\n
- <\/b> Add a Route 53 health check<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Add a secondary CIDR block to the VPC<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Amazon VPC allows an organization to associate additional IPv4 CIDR blocks with an existing VPC, providing additional address space for creating subnets and allocating private IP addresses. This can be useful when an existing VPC is running short of available addresses and the network design permits expansion. The additional CIDR block must comply with AWS networking requirements and should not overlap with existing connected networks where that would create routing conflicts. CloudFront is a content delivery service, S3 provides object storage, and Route 53 health checks monitor endpoints. Therefore, adding a secondary CIDR block is the relevant VPC expansion mechanism.<\/span><\/p>\nQuestion 295. An organization wants a centralized service to help plan, monitor, and manage IP address allocation across multiple VPCs and AWS accounts. Which AWS service should be evaluated?<\/b><\/h3>\n\n- <\/b> AWS VPC IPAM<\/span><\/li>\n
- <\/b> Amazon CloudFront<\/span><\/li>\n
- <\/b> AWS CloudTrail<\/span><\/li>\n