AWS Certified SysOps Administrator – Associate — All Questions
22 questions
An administrator needs per-minute CPU metrics from EC2 instances instead of the default interval. What should they enable?
- a.The CloudWatch agent for CPU
- b.A custom metric filter
- c.Detailed monitoring on the instances✓
- d.AWS CloudTrail data events
Enabling detailed monitoring reports EC2 metrics every one minute instead of the default five-minute basic monitoring. The CloudWatch agent is needed for memory and disk metrics, not CPU frequency, metric filters extract metrics from logs, and CloudTrail records API activity.
Memory utilization is not appearing among an instance's default CloudWatch metrics. Why, and what is the fix?
- a.Memory is not collected by the hypervisor by default; install the CloudWatch agent to publish it✓
- b.Memory metrics require enabling CloudTrail
- c.Memory is only visible in Cost Explorer
- d.Detailed monitoring adds memory metrics automatically
The hypervisor cannot see guest OS memory, so CloudWatch does not collect it by default; the CloudWatch agent running inside the instance publishes memory and disk metrics. CloudTrail and Cost Explorer are unrelated, and detailed monitoring only increases the frequency of existing metrics.
Which service should an administrator use to determine which IAM principal deleted a security group last week?
- a.Amazon CloudWatch metrics
- b.AWS Config only
- c.VPC Flow Logs
- d.AWS CloudTrail✓
CloudTrail records management API calls including who made them and when, so it identifies the principal that deleted the security group. CloudWatch tracks operational metrics, Config tracks configuration state changes over time, and VPC Flow Logs capture network traffic, not API identity.
An administrator wants to automatically run a remediation Lambda whenever an EC2 instance enters the stopped state. Which service triggers this?
- a.AWS Config rules
- b.Amazon EventBridge✓
- c.Amazon SQS
- d.AWS Trusted Advisor
EventBridge rules match events such as an EC2 state-change and invoke targets like Lambda or Systems Manager Automation for remediation. Config evaluates configuration compliance, SQS is a message queue, and Trusted Advisor gives best-practice recommendations, not real-time event triggering.
How can an administrator turn a recurring error string in application logs into something they can alarm on?
- a.Export logs to S3 nightly
- b.Enable detailed monitoring
- c.Create a CloudWatch Logs metric filter that counts the pattern, then alarm on the metric✓
- d.Increase log retention
A metric filter scans a log group for a pattern and publishes a numeric CloudWatch metric that an alarm can watch. Exporting to S3 or extending retention stores logs but does not create alarms, and detailed monitoring only affects metric frequency.
A web tier must add capacity automatically when average CPU exceeds 60% and remove it when demand drops. Which configuration achieves this?
- a.A single large instance with detailed monitoring
- b.An Auto Scaling group with a target tracking policy on average CPU✓
- c.Manually launching instances during peaks
- d.A Reserved Instance purchase
A target tracking scaling policy adjusts the Auto Scaling group to keep average CPU near the target, adding and removing instances automatically. A single instance cannot scale horizontally, manual launching is not automatic, and Reserved Instances are a pricing commitment, not a scaling mechanism.
To protect a production database against an Availability Zone failure with automatic failover, which RDS option should be used?
- a.Multi-AZ deployment with a synchronous standby✓
- b.A single-AZ instance with frequent snapshots
- c.A read replica in the same AZ
- d.Larger instance class
RDS Multi-AZ maintains a synchronous standby in another Availability Zone and fails over automatically if the primary fails. Snapshots aid recovery but do not provide automatic failover, a same-AZ read replica does not survive that AZ's failure, and a larger instance does not add availability.
An organization wants one service to centrally schedule and enforce backups across EBS, RDS, and DynamoDB with retention policies. Which service fits?
- a.EBS snapshots created by a cron job
- b.S3 versioning
- c.CloudFormation
- d.AWS Backup✓
AWS Backup centralizes backup scheduling, retention, and vault policies across multiple services from one place. Cron-based snapshots cover only EBS and add operational burden, S3 versioning protects objects not databases, and CloudFormation provisions infrastructure rather than managing backups.
A business states it can tolerate at most 15 minutes of data loss during a disaster. Which metric does this define?
- a.RTO (recovery time objective)
- b.SLA
- c.RPO measured in dollars✓
- d.RPO (recovery point objective)
The recovery point objective is the maximum acceptable amount of data loss measured in time, so 15 minutes is an RPO. RTO defines acceptable downtime, an SLA is a service commitment, and RPO is measured in time, not dollars.
Before applying an update to a CloudFormation stack, an administrator wants to preview exactly which resources will be modified or replaced. What should they use?
- a.Drift detection
- b.A change set✓
- c.StackSets
- d.A nested stack
A change set previews the additions, modifications, and replacements a stack update would make before you execute it. Drift detection compares actual resources to the template, StackSets deploy across accounts and Regions, and nested stacks decompose templates.
An administrator must obtain interactive shell access to EC2 instances in private subnets without opening inbound SSH ports. Which tool should they use?
- a.Systems Manager Session Manager✓
- b.A bastion host with port 22 open to the internet
- c.Direct SSH over the internet gateway
- d.CloudFront
Session Manager provides browser or CLI shell access through the SSM Agent and IAM, with no inbound ports and full logging. A bastion or direct SSH requires open ports and more management, and CloudFront is a content delivery network.
To apply operating-system security patches to a fleet of EC2 instances on a defined schedule, which Systems Manager capability is appropriate?
- a.Session Manager
- b.Parameter Store
- c.Patch Manager✓
- d.Cost Explorer
Patch Manager scans and applies OS and application patches to managed instances on a maintenance-window schedule. Session Manager provides shell access, Parameter Store holds configuration, and Cost Explorer analyzes spend.
CloudFormation reports that a stack has drifted. What does this indicate?
- a.The template has a syntax error
- b.The stack failed to create
- c.Costs exceeded a budget
- d.Resources were changed outside CloudFormation and no longer match the template✓
Drift detection reports that the actual configuration of stack resources differs from the template, typically because someone made manual changes. It is not a syntax error, a failed create, or a budget event.
What is the recommended way to store a database password used by Systems Manager automation and CloudFormation without hard-coding it?
- a.A plaintext String parameter
- b.A SecureString parameter in Parameter Store encrypted with KMS✓
- c.An environment variable in the template
- d.A public S3 object
A SecureString parameter encrypts the value with KMS and can be referenced by automation and CloudFormation, keeping secrets out of templates. A plaintext parameter or template variable exposes the value, and a public S3 object leaks it.
An administrator needs an auditable record of how each resource's configuration has changed over time and whether it complies with rules. Which service provides this?
- a.AWS Config✓
- b.Amazon CloudFront
- c.AWS Lambda
- d.Amazon SQS
AWS Config records configuration history for resources and evaluates them against rules to flag noncompliance, giving an auditable posture over time. CloudFront delivers content, Lambda runs code, and SQS queues messages.
Which tool helps identify S3 buckets or IAM roles that are shared with external accounts so an administrator can tighten access?
- a.Amazon Inspector
- b.AWS Shield
- c.IAM Access Analyzer✓
- d.Amazon Athena
IAM Access Analyzer evaluates resource policies and reports where resources grant access to external principals, helping enforce least privilege. Inspector scans for software vulnerabilities, Shield protects against DDoS, and Athena queries data in S3.
To automatically provision and renew the TLS certificate used by an Application Load Balancer, which service should be used?
- a.AWS KMS
- b.AWS Certificate Manager (ACM)✓
- c.AWS Secrets Manager
- d.Amazon Route 53
ACM provisions, manages, and automatically renews TLS certificates for integrated services such as load balancers and CloudFront. KMS manages encryption keys, Secrets Manager stores secrets, and Route 53 handles DNS.
Instances in a private subnet must download OS updates from the internet but must not be reachable from it. What should the administrator add?
- a.An internet gateway route from the private subnet
- b.A public IP on each instance
- c.A VPC peering connection
- d.A NAT gateway with the private subnet routing to it✓
A NAT gateway lets private-subnet instances make outbound internet connections while remaining unreachable inbound. Routing the private subnet to an internet gateway or assigning public IPs would make instances reachable, and VPC peering connects VPCs rather than providing internet egress.
An administrator wants EC2 instances to reach Amazon S3 without their traffic traversing the public internet. Which feature accomplishes this?
- a.A VPC endpoint for S3✓
- b.A second internet gateway
- c.A larger NAT gateway
- d.A Route 53 private hosted zone
A VPC endpoint keeps traffic to supported AWS services such as S3 on the AWS network, avoiding the public internet. Additional internet or NAT gateways route traffic over the internet, and a private hosted zone handles DNS, not private service connectivity.
A global application needs to route users to the AWS Region with the lowest latency. Which Route 53 routing policy should be used?
- a.Weighted routing
- b.Failover routing
- c.Latency-based routing✓
- d.Simple routing
Latency-based routing sends users to the Region that provides the lowest network latency for them. Weighted routing splits traffic by proportion, failover routing is for active/passive DR, and simple routing returns a single record without latency awareness.
To reduce latency for globally distributed users downloading static assets and to lower load on the origin, which service should an administrator use?
- a.A larger EC2 instance
- b.Amazon CloudFront✓
- c.A second NAT gateway
- d.Amazon SQS
CloudFront caches content at edge locations near users, cutting latency and offloading the origin. A larger instance does not address geographic distance, a NAT gateway handles egress, and SQS is a messaging service.
A workload runs 24/7 at steady utilization for the next year. Which purchase option most reduces its EC2 cost?
- a.A Compute Savings Plan or Reserved Instances✓
- b.On-Demand only
- c.Spot Instances for the whole tier
- d.A larger On-Demand instance
Committing to a Savings Plan or Reserved Instances gives a significant discount for steady, predictable usage over one or three years. On-Demand is the most expensive for steady load, Spot risks interruption for a persistent workload, and a larger On-Demand instance increases cost.