AWS Certified SysOps Administrator – Associate — All Questions
5 questions
Instances in a private subnet must download OS updates from the internet but must not be reachable from it. What should the administrator add?
- a.An internet gateway route from the private subnet
- b.A public IP on each instance
- c.A VPC peering connection
- d.A NAT gateway with the private subnet routing to it✓
A NAT gateway lets private-subnet instances make outbound internet connections while remaining unreachable inbound. Routing the private subnet to an internet gateway or assigning public IPs would make instances reachable, and VPC peering connects VPCs rather than providing internet egress.
An administrator wants EC2 instances to reach Amazon S3 without their traffic traversing the public internet. Which feature accomplishes this?
- a.A VPC endpoint for S3✓
- b.A second internet gateway
- c.A larger NAT gateway
- d.A Route 53 private hosted zone
A VPC endpoint keeps traffic to supported AWS services such as S3 on the AWS network, avoiding the public internet. Additional internet or NAT gateways route traffic over the internet, and a private hosted zone handles DNS, not private service connectivity.
A global application needs to route users to the AWS Region with the lowest latency. Which Route 53 routing policy should be used?
- a.Weighted routing
- b.Failover routing
- c.Latency-based routing✓
- d.Simple routing
Latency-based routing sends users to the Region that provides the lowest network latency for them. Weighted routing splits traffic by proportion, failover routing is for active/passive DR, and simple routing returns a single record without latency awareness.
To reduce latency for globally distributed users downloading static assets and to lower load on the origin, which service should an administrator use?
- a.A larger EC2 instance
- b.Amazon CloudFront✓
- c.A second NAT gateway
- d.Amazon SQS
CloudFront caches content at edge locations near users, cutting latency and offloading the origin. A larger instance does not address geographic distance, a NAT gateway handles egress, and SQS is a messaging service.
A workload runs 24/7 at steady utilization for the next year. Which purchase option most reduces its EC2 cost?
- a.A Compute Savings Plan or Reserved Instances✓
- b.On-Demand only
- c.Spot Instances for the whole tier
- d.A larger On-Demand instance
Committing to a Savings Plan or Reserved Instances gives a significant discount for steady, predictable usage over one or three years. On-Demand is the most expensive for steady load, Spot risks interruption for a persistent workload, and a larger On-Demand instance increases cost.