AWS SysOps Administrator - Intermediate Quiz

← Back to Quiz Home

---

This quiz covers more complex troubleshooting scenarios, billing management, and recovery procedures.

---

#

How do you recover a lost Key Pair for a Linux EC2 instance?

Stop the instance, detach the root volume, attach it to a helper instance, mount it, append your new public key to ~/.ssh/authorized_keys, unmount, reattach, and start.

You cannot.

Use ec2-reset-password.

Reboot into recovery mode.

This is the standard "surgical" recovery procedure.

#

What metric helps you determine if a T3 instance is being throttled?

CPUCreditBalance. If it hits zero, the instance is throttled to baseline performance.

CPUUtilization.

StatusCheckFailed.

DiskQueueLength.

Monitoring credit balance is vital for burstable instances to prevent performance cliffs.

#

How do you troubleshoot a "Connection Refused" error when SSHing to an instance?

The instance is reachable, but the SSH service (sshd) is down or not listening on port 22. Check System Logs or use Session Manager.

The Security Group is blocking it.

The NACL is blocking it.

The key is wrong.

"Connection Refused" is distinctly different from "Connection Timed Out" (Firewall).

#

What is a "StackSet" in CloudFormation?

A feature that lets you create, update, or delete stacks across multiple accounts and regions with a single operation.

A set of stacks.

A nested stack.

A failed stack.

StackSets are crucial for multi-account governance (e.g., rolling out a Config Rule to 100 accounts).

#

What is the difference between Savings Plans and Reserved Instances (RIs)?

Savings Plans offer more flexibility (apply to any instance family/region for Compute SP) in exchange for $ commit; RIs require committing to specific instance type/OS/Region.

RIs are cheaper.

SPs are for savings.

RIs are for storage.

Compute Savings Plans are generally preferred today due to flexibility (e.g., move from C5 to M6g).

#

How do you implement "Cross-Account Access" securely?

Create an IAM Role in the target account with a Trust Policy allowing the source account's ID. Users in the source account assume this role.

Share access keys.

Create a user in target account.

Use VPC Peering.

Role assumption avoids the anti-pattern of sharing long-term credentials.

#

Which file system allows you to mount a shared file system on 100 EC2 instances simultaneously (Linux)?

Amazon EFS (Elastic File System).

EBS.

S3.

Glacier.

EBS is Multi-Attach (limited), but EFS is the standard "NAS" solution.

#

How do you enable detailed monitoring for EC2?

Enable "Detailed Monitoring" in the console/CLI. It increases metric frequency from 5 minutes to 1 minute (additional cost).

Install agent.

Reboot.

It is on by default.

1-minute granularity is essential for auto-scaling based on rapid spikes.

#

What is "AWS Compute Optimizer"?

A service that recommends optimal AWS resources for your workloads to reduce costs and improve performance by analyzing historical utilization metrics.

A compiler.

A load balancer.

A cost explorer.

It tells you "You are using an m5.xlarge but only using 5% CPU. Downgrade to m5.large."

#

How do you automate the creation of AMIs (Snapshots)?

Use Amazon Data Lifecycle Manager (DLM) to create snapshot policies based on tags.

Write a script.

Do it manually.

Use Backup.

DLM (and AWS Backup) replaces the old "Lambda scheduled event" pattern.

#

What does "Source/Destination Check" do on an EC2 instance?

By default, it ensures the instance is either the source or destination of traffic. You must disable this for NAT instances or VPN appliances to route traffic.

It checks for viruses.

It checks costs.

It blocks traffic.

If you don't disable this on a NAT instance, it will drop forwarded packets.

#

How do you identify which user terminated an instance yesterday?

Look in CloudTrail Event History, filter by EventName = TerminateInstances.

Look in CloudWatch Logs.

Look in VPC Flow Logs.

Ask the team.

CloudTrail keeps 90 days of history searchable in the console for free.

#

What is "S3 Intelligent-Tiering"?

A storage class that automatically moves objects between two access tiers (Frequent and Infrequent) based on access patterns, without performance impact or operational overhead.

A backup tool.

A costly tier.

A slow tier.

It eliminates the risk of retrieving data from Glacier or S3-IA (retrieval fees).

#

How do you investigate high latency on an Application Load Balancer (ALB)?

Check TargetResponseTime metric. If high, the backend is slow. Check access logs for details.

Check Latency metric.

Check SurgeQueue.

Check Spillover.

TargetResponseTime measures the time from when the LB sends the request to the target until the target starts sending headers.

#

What does the "Burst Balance" metric track for EBS volumes?

The available I/O credits for GP2 volumes. If it hits 0, IOPS are throttled to baseline (3 IOPS/GB).

CPU credits.

Network credits.

Disk space.

GP3 volumes solve this by decoupling IOPS from size, but GP2 users must monitor this.

#

How do you set up a billing alert?

Enable Billing Alerts in preferences, then create a CloudWatch Alarm on the EstimatedCharges metric.

Send an email.

It is automatic.

Call support.

This prevents "bill shock" at the end of the month.

#

What is a "Placement Group" (Cluster strategy)?

A logical grouping of instances within a single Availability Zone to achieve low network latency and high packet-per-second performance (HPC).

Spreading instances across regions.

Any group of instances.

A scaling group.

Cluster placement groups pack instances physically close together.

#

How do you handle a "StatusCheckFailed_System" alert?

Stop and Start the instance to migrate it to a healthy host.

Reboot only.

Wait.

Terminate.

Rebooting keeps it on the same (bad) host. Stop/Start moves it.

#

What is "AWS Shield Standard"?

A free service that automatically protects all AWS customers from common infrastructure (Layer ¾) DDoS attacks.

A paid service.

A weak firewall.

A VPN.

All customers benefit from AWS's massive global network scrubbing.

#

What is "S3 Lifecycle Policy"?

A set of rules to define actions that Amazon S3 applies to a group of objects (e.g., Transition to Glacier after 30 days, Expire after 365 days).

A security policy.

A backup policy.

A replication policy.

Lifecycle policies are the primary mechanism for S3 cost optimization.

Quiz Progress

0 / 0 questions answered (0%)

0 correct

Quiz Complete!

0%

Reset quiz

---

📚 Study Guides

• AWS SysOps Administrator Interview Questions

---

📬 Weekly DevOps, Cloud & Gen AI quizzes & guides