AWS Certified SysOps Administrator – Associate — All Questions

Before applying an update to a CloudFormation stack, an administrator wants to preview exactly which resources will be modified or replaced. What should they use?

• a.Drift detection
• b.A change set✓
• c.StackSets
• d.A nested stack

A change set previews the additions, modifications, and replacements a stack update would make before you execute it. Drift detection compares actual resources to the template, StackSets deploy across accounts and Regions, and nested stacks decompose templates.

An administrator must obtain interactive shell access to EC2 instances in private subnets without opening inbound SSH ports. Which tool should they use?

• a.Systems Manager Session Manager✓
• b.A bastion host with port 22 open to the internet
• c.Direct SSH over the internet gateway
• d.CloudFront

Session Manager provides browser or CLI shell access through the SSM Agent and IAM, with no inbound ports and full logging. A bastion or direct SSH requires open ports and more management, and CloudFront is a content delivery network.

To apply operating-system security patches to a fleet of EC2 instances on a defined schedule, which Systems Manager capability is appropriate?

• a.Session Manager
• b.Parameter Store
• c.Patch Manager✓
• d.Cost Explorer

Patch Manager scans and applies OS and application patches to managed instances on a maintenance-window schedule. Session Manager provides shell access, Parameter Store holds configuration, and Cost Explorer analyzes spend.

CloudFormation reports that a stack has drifted. What does this indicate?

• a.The template has a syntax error
• b.The stack failed to create
• c.Costs exceeded a budget
• d.Resources were changed outside CloudFormation and no longer match the template✓

Drift detection reports that the actual configuration of stack resources differs from the template, typically because someone made manual changes. It is not a syntax error, a failed create, or a budget event.

What is the recommended way to store a database password used by Systems Manager automation and CloudFormation without hard-coding it?

• a.A plaintext String parameter
• b.A SecureString parameter in Parameter Store encrypted with KMS✓
• c.An environment variable in the template
• d.A public S3 object

A SecureString parameter encrypts the value with KMS and can be referenced by automation and CloudFormation, keeping secrets out of templates. A plaintext parameter or template variable exposes the value, and a public S3 object leaks it.