A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted.
What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?

• A.Set up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
• B.Create an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
• C.Use AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.
• D.Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.

Comment: *

Name: *

Email: *

Verification: *

An organization with a large IT department has decided to migrate to AWS With different job functions in the IT department it is not desirable to give all users access to all AWS resources Currently the organization handles access via LDAP group membership What is the BEST method to allow access using current LDAP credentials?

• A.Federate the LDAP directory with IAM using SAML Create different IAM roles to correspond to different LDAP groups to limit permissions
• B.Create a Lambda function to read LDAP groups and automate the creation of IAM users
• C.Create an AWS Directory Service Simple AD Replicate the on-premises LDAP directory to Simple AD
• D.Use AWS CloudFormation to create IAM roles Deploy Direct Connect to allow access to the on-premises LDAP server

Comment: *

Name: *

Email: *

Verification: *

A SysOps administrator has created a VPC that contains a public subnet and a private subnet. Amazon EC2 instances that were launched in the private subnet cannot access the internet. The default network ACL is active on all subnets in the VPC, and all security groups allow all outbound traffic:
Which solution will provide the EC2 instances in the private subnet with access to the internet?

• A.Create a NAT gateway in the private subnet. Create a route from the private subnet to the NAT gateway.
• B.Create a NAT gateway in the private subnet. Create a route from the public subnet to the NAT gateway.
• C.Create a NAT gateway in the public subnet. Create a route from the private subnet to the NAT gateway.
• D.Create a NAT gateway in the public subnet. Create a route from the public subnet to the NAT gateway.

Comment: *

Name: *

Email: *

Verification: *

A company uses an AWS CloudFormation template to provision an Amazon EC2 instance and an Amazon RDS DB instance. A SysOps administrator must update the template to ensure that the DB instance is created before the EC2 instance is launched.
What should the SysOps administrator do to meet this requirement?

• A.Create multiple templates. Use AWS CloudFormation StackSets to wait for one stack to complete before the second stack is created.
• B.Add a wait condition to the template. Update the EC2 instance user data script to send a signal after the EC2 instance is started.
• C.Add the DependsOn attribute to the EC2 instance resource, and provide the logical name of the RDS resource.
• D.Change the order of the resources in the template so that the RDS resource is listed before the EC2 instance resource.

Comment: *

Name: *

Email: *

Verification: *

A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted.
What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?

• A.Set up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
• B.Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.
• C.Create an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
• D.Use AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.

Comment: *

Name: *

Email: *

Verification: *