AWS-SysOps無料問題集「Amazon AWS Certified SysOps Administrator

質問 1

A company recently migrated from a third-party security application to Amazon Inspector. A sysops administrator discovered that a list of security findings is missing for some Amazon EC2 instances.
Which action will resolve this problem?

（A）Log in to the affected EC2 instances. Download and install the Amazon Inspector agent from AWS Marketplace on each instance.

（B）Use a network reachability package to analyze network configurations to find security vulnerabilities on the affected EC2 instances.

（C）Verify that the Amazon Inspector agent is installed and running on the affected instances. Restart the Amazon Inspector agent.

（D）Generate the missing security findings list manually by logging in to the affected EC2 instances and running CLI commands.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

A company manages more than 1,000 Amazon EC2 instances running Amazon Linux 2 in multiple VPCs. A SysOps administrator must change the statically configured DNS server IP address on all the EC2 instances.
Which solution will require the LEAST amount of effort?

（A）Develop an AWS Lambda function to update the corporate DNS IP address on all the EC2 instances.

（B）Update the Amazon Machine Images (AMIs) of the EC2 instances to configure the updated corporate DNS IP address.

（C）Run a shell script to update the corporate DNS IP address on each EC2 instance.

（D）Use the AWS Systems Manager Run Command to update the corporate DNS IP address on all the EC2 instances.

正解：D 解答を投票する

質問 3

A SysOps Administrator observes a large number of rogue HTTP requests on an Application Load Balancer (ALB). The requests originate from various IP addresses.
Which action should be taken to block this traffic?

（A）Use Amazon GuardDuty to protect the web servers from bots and scrapers

（B）Use Amazon CloudFront to cache the traffic and block access to the web servers

（C）Use AWS Lambda to analyze the web server logs, detect bot traffic, and block the IP address in the security groups

（D）Use AWS WAF rate-based blacklisting to block this traffic when it exceeds a defined threshold

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

A company is operating a multi-account environment under a single organization using AWS Organizations. The Security team discovers that some employees are using AWS services in ways that violate company policies. A SysOps Administrator needs to prevent all users of an account, including the root user, from performing certain restricted actions.
What should be done to accomplish this?

（A）Define permissions boundaries to allow approved actions only

（B）Apply service control policies (SCPs) to allow approved actions only

（C）Apply service control policies (SCPs) to prevent restricted actions

（D）Define permissions boundaries to prevent restricted actions

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

An organization is using cost allocation tags to find the cost distribution of different departments and projects.
One of the instances has two separate tags with the key/value as "InstanceName/HR",
"CostCenter/HR".
What will AWS do in this case?

（A）InstanceName is a reserved tag for AWS.
Thus, AWS will not allow this tag

（B）AWS will allow both the tags and show properly in the cost distribution report

（C）AWS will not allow the tags as the value is the same for different keys

（D）AWS will allow tags but will not show correctly in the cost allocation report due to the same value of the two separate keys

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

A user has enabled versioning on an S3 bucket.
The user is using server side encryption for data at Rest.
If the user is supplying his own keys for encryption (SSE-C., which of the below mentioned statements is true?

（A）The user should use the same encryption key for all versions of the same object

（B）It is possible to have different encryption keys for different versions of the same object

（C）AWS S3 does not allow the user to upload his own keys for server side encryption

（D）The SSE-C does not work when versioning is enabled

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

A company uses LDAP-based credentials and has a Security Assertion Markup Language (SAML) 2.0 identity provider. A SysOps administrator has configured various federated roles in a new AWS account to provide AWS Management Console access for groups of users that use the existing LDAP-based credentials. Several groups want to use the AWS CLI on their workstations to automate daily tasks. To enable them to do so, the SysOps administrator has created an application that authenticates a user and generates a SAML assertion Which API call should be used to retrieve credentials for federated programmatic access?

（A）sts:GetFederationToken

（B）sts:AssumeRole

（C）sts:AssumeRoleWithSAML

（D）sts:AssumeRoleWithWebIdentity

正解：C 解答を投票する

質問 8

You can create a CloudWatch alarm that watches a single metric. The alarm performs one or more actions based on the value of the metric relative to a threshold over a number of time periods. Which of the following states is possible for the CloudWatch alarm?

（A）OK

（B）THRESHOLD

（C）ERROR

（D）ALERT

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

You have set up Individual AWS accounts for each project.
You have been asked to make sure your AWS Infrastructure costs do not exceed the budget set per project for each month.
Which of the following approaches can help ensure that you do not exceed the budget each month?

（A）Set up auto scaling with CloudWatch alarms using SNS to notify you when you are running too many Instances in a given account

（B）Consolidate your accounts so you have a single bill for all accounts and projects

（C）Set up CloudWatch billing alerts for all AWS resources used by each project, with a notification occurring when the amount for each resource tagged to a particular project matches the budget allocated to the project.

（D）Set up CloudWatch billing alerts for all AWS resources used by each account, with email notifications when it hits 50%. 80% and 90% of its budgeted monthly spend

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

A SysOps Administrator noticed that a large number of Elastic IP addresses are being created on the company's AWS account., but they are not being associated with Amazon EC2 instances, and are incurring Elastic IP address charges in the monthly bill.
How can the Administrator identify who is creating the Elastic IP address?

（A）Query AWS CloudTrail logs by using Amazon Athena to search for Elastic IP address events.

（B）Create a CloudWatch alarm on the EIPCreated metric and send an Amazon SNS notification when the alarm triggers.

（C）Use Amazon Inspector to get a report of all Elastic IP addresses created in the last 30 days.

（D）Attach a cost-allocation tag to each requested Elastic IP address with the IAM user name of the Developer who creates it.

正解：A 解答を投票する

質問 11

By default, how many Elastic IP addresses can you have per region for your EC2 instances?

（A）20

（B）5

（C）10

（D）2

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 12

While setting up an AWS managed VPN connection, a SysOPs Administrator creates a customer gateway resource in AWS. The customer gateway device resides in a data center with a NAT gateway in front of it.
What address should be used to create the customer gateway resource?

（A）The private IP address of the customer gateway device

（B）The public IP address of the NAT device in front of the customer gateway device

（C）The MAC address of the NAT device in front of the customer gateway device

（D）The public IP address of the customer gateway device

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 13

A user is trying to understand AWS SNS.
To which of the below mentioned end points is SNS unable to send a notification?

（A）AWS SES

（B）HTTP

（C）Email JSON

（D）AWS SQS

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 14

A SysOps Administrator is deploying a website with dynamic content. Company policy requires that users from certain countries or regions cannot access the web content and should receive an error page.
Which of the following can be used to implement this policy? (Choose two.)

（A）Network access control list (NACL) restriction

（B）Amazon GuardDuty geo-blocking

（C）AWS Shield geo-restriction

（D）Amazon CloudFront geo-restriction

（E）Amazon Route 53 geolocation routing

正解：D、E 解答を投票する

AWS-SysOps 無料問題集「Amazon AWS Certified SysOps Administrator - Associate」

弊社を連絡する

関連リンク

トップ試験