A company needs to deploy a new workload on AWS. The company must encrypt all data at rest and must rotate the encryption keys once each year. The workload uses an Amazon RDS for MySQL Multi-AZ database for data storage.
Which configuration approach will meet these requirements?

• A.Enable Transparent Data Encryption (TDE) in the MySQL configuration file. Manually rotate the key every 12 months.
• B.Enable RDS encryption on the database at creation time by using the AWS managed key for Amazon RDS.
• C.Create a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable RDS encryption on the database at creation time by using the KMS key.
• D.Create a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the RDS DB instance.

Comment: *

Name: *

Email: *

Verification: *

A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted.
What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?

• A.Use AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.
• B.Create an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
• C.Set up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
• D.Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.

Comment: *

Name: *

Email: *

Verification: *

A company needs to view a list of security groups that are open to the internet on port 3389.
What should a SysOps administrator do to meet this requirement?

• A.Use AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389.
• B.Configure a service control policy (SCP) to identify security groups that allow unrestricted access on port 3389
• C.Use AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.
• D.Configure Amazon GuardDuly to scan security groups and report unrestricted access on port 3389.

Comment: *

Name: *

Email: *

Verification: *

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A SysOpe administrator notices that some of these EC2 instances show up as heathy in the Auto Scaling g-out but show up as unhealthy in the ALB target group.
What is a possible reason for this issue?

• A.The Auto Seating group health check is configured for EC2 status checks
• B.The EC2 instances are failing to launch and failing EC2 status checks.
• C.The target group health check is configured with an incorrect port or path
• D.Security groups ate rot allowing traffic between the ALB and the failing EC2 instances

Comment: *

Name: *

Email: *

Verification: *

A company has a stateful web application that is hosted on Amazon EC2 instances in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) that has a single target group. The ALB is configured as the origin in an Amazon CloudFront distribution. Users are reporting random logouts from the web application.
Which combination of actions should a SysOps administrator take to resolve this problem? (Select TWO.)

• A.Change to the least outstanding requests algorithm on the ALB target group.
• B.Configure cookie forwarding in the CloudFront distribution cache behavior.
• C.Configure header forwarding in the CloudFront distribution cache behavior.
• D.Enable group-level stickiness on the ALB listener rule.
• E.Enable sticky sessions on the ALB target group.

Comment: *

Name: *

Email: *

Verification: *