I85PREP
⌘ K
Alibaba SysOps Administrator study materials
Alibaba SysOps Administrator study resources

Alibaba SysOps Administrator practice questions

One question at a time. Build your Alibaba SysOps Administrator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ECS and compute operations

Which Alibaba Cloud service provides resizable virtual servers with selectable CPU, memory, and disk configurations?

  1. Server Load Balancer (SLB)
  2. Object Storage Service (OSS)
  3. ApsaraDB for RDS
  4. Elastic Compute Service (ECS) Correct answer.

Explanation

ECS is the core IaaS offering that delivers configurable virtual machine instances. SLB distributes traffic, OSS stores objects, and RDS is a managed database, none of which provision general-purpose compute instances.

Question 2ECS and compute operations

An ECS instance type name such as ecs.g7.large primarily encodes which two pieces of information?

  1. Region and zone placement
  2. Operating system and network type
  3. Billing method and disk type
  4. Instance family and size Correct answer.

Explanation

ECS type naming follows a family-plus-size convention where the family letter indicates the workload class and the size suffix indicates the resource magnitude. Region, billing, and OS are chosen separately during instance creation.

Question 3ECS and compute operations

A team needs an ECS instance whose disk data persists after the instance is released. Which disk category satisfies this requirement?

  1. A cloud disk configured as a data disk Correct answer.
  2. Local ephemeral disk bundled with the instance
  3. The instance's system disk
  4. A swap partition on the system disk

Explanation

Cloud disks are independent block storage resources that survive instance release and can be reattached elsewhere. Local and system disks are tied to the instance lifecycle and are destroyed with it.

Question 4ECS and compute operations

Which ECS network construct provides an isolated virtual network in which you define subnets and route tables?

  1. Security group
  2. Elastic IP address
  3. Virtual Private Cloud (VPC) Correct answer.
  4. Internet NAT Gateway

Explanation

A VPC is the logically isolated network boundary that contains switches (subnets) and route tables. Security groups are instance-level firewalls, EIPs are public addresses, and NAT Gateways provide outbound internet access within a VPC.

Question 5ECS and compute operations

What is the primary purpose of an ECS image?

  1. To serve as a template for creating instances Correct answer.
  2. To cache frequently read objects
  3. To back up data disks on a schedule
  4. To encrypt network traffic between instances

Explanation

An image captures the OS, configuration, and installed software used as the template when launching new instances. Backups, caching, and encryption are handled by other services.

Question 6ECS and compute operations

An operator wants to automatically add or remove ECS instances based on CPU utilization. Which capability should be used?

  1. Auto Scaling Correct answer.
  2. Elastic Container Instance
  3. CloudMonitor alarm-only notification
  4. Resource Orchestration Service

Explanation

Auto Scaling adjusts the number of instances in a scaling group according to scaling rules tied to metrics such as CPU. CloudMonitor can raise alarms but does not itself change capacity.

Question 7ECS and compute operations

Which ECS feature lets you run a script automatically the first time an instance boots?

  1. Serial console
  2. User data Correct answer.
  3. Cloud Assistant inventory
  4. Instance metadata

Explanation

User data passes a startup script to the instance that runs on initial boot for automated configuration. Metadata exposes instance attributes, Cloud Assistant runs commands later, and the serial console is for interactive troubleshooting.

Question 8ECS and compute operations

Which statement correctly describes the relationship between a security group and an ECS instance?

  1. An instance can belong to multiple security groups Correct answer.
  2. A security group can contain only one instance
  3. Security groups are attached at the VPC level, not the instance level
  4. Security groups apply only to outbound traffic

Explanation

An ECS instance can be associated with one or more security groups, and the effective rules are the union of their allow rules. Security groups are instance-level stateful filters that govern both inbound and outbound traffic.

Question 9ECS and compute operations

An application on an ECS instance must call an Alibaba Cloud API without storing a long-term AccessKey on disk. Which approach is recommended?

  1. Embed an AccessKey pair in the application source code
  2. Use an instance RAM role to obtain temporary credentials Correct answer.
  3. Store the AccessKey in a world-readable file
  4. Disable the instance's security group

Explanation

An instance RAM role lets the instance obtain rotating temporary STS credentials through metadata, avoiding hard-coded long-term keys. Embedding keys in code or readable files creates a persistent credential leak.

Question 10ECS and compute operations

A workload requires very high random IOPS and the lowest possible latency for a database. Which cloud disk category is most appropriate?

  1. Basic cloud disk
  2. Standard SSD
  3. Ultra disk
  4. ESSD with a high PL performance level Correct answer.

Explanation

ESSD with an elevated performance level (PL) delivers the highest IOPS and lowest latency among cloud disk categories. Ultra and standard disks offer lower performance tiers.

Question 11ECS and compute operations

A user needs a fixed public IPv4 address that can be detached from one ECS instance and remapped to another. Which resource provides this?

  1. An Elastic IP address Correct answer.
  2. A public bandwidth package
  3. A VPC route entry
  4. A NAT Gateway EIP binding

Explanation

An Elastic IP is a standalone public IP that can be associated and reassociated across instances. Route entries and bandwidth packages do not provide a movable public address.

Question 12ECS and compute operations

After changing a security group rule to allow TCP port 443, users still cannot connect. Which step is most likely missing?

  1. Convert the security group to a VPC-level policy
  2. Attach an EIP to the security group
  3. Confirm the rule direction is inbound and the source CIDR includes the clients Correct answer.
  4. Restart the instance to apply the rule

Explanation

Security group rules take effect immediately, so the common cause is a wrong direction or a source range that excludes the client. Restarting is unnecessary and EIPs attach to instances, not groups.

Question 13ECS and compute operations

Which action reduces the risk of losing an ECS instance's system disk contents after accidental deletion?

  1. Enable a public bandwidth package
  2. Change the instance to a burstable type
  3. Enable automatic snapshots for the disk Correct answer.
  4. Increase the system disk size

Explanation

Automatic snapshots create point-in-time copies of a disk that can be used to restore data after deletion. Resizing, changing instance type, and bandwidth do not protect against data loss.

Question 14ECS and compute operations

An operator wants to run a shell command across hundreds of ECS instances and collect the output. Which service is designed for this?

  1. Cloud Assistant Correct answer.
  2. ActionTrail
  3. Server Load Balancer
  4. Resource Access Management

Explanation

Cloud Assistant executes commands and scripts on managed instances at scale and returns results. ActionTrail audits API calls, RAM governs permissions, and SLB balances traffic.

Question 15ECS and compute operations

A scaling group must keep at least two instances running at all times during a rolling configuration update. Which setting governs this?

  1. The scaling group's minimum size Correct answer.
  2. The cooldown period
  3. The health check grace period
  4. The scaling group's maximum size

Explanation

The minimum size sets the floor on instance count that Auto Scaling maintains. Maximum size caps growth, cooldown throttles consecutive actions, and grace period delays health checks.

Question 16ECS and compute operations

An instance in a VPC needs outbound internet access for software updates but must not accept inbound connections from the internet. Which design achieves this?

  1. Assign a public IP directly to the instance
  2. Route outbound traffic through a NAT Gateway Correct answer.
  3. Attach an EIP and open all inbound ports
  4. Place the instance in a subnet with a default route to the internet gateway

Explanation

A NAT Gateway lets instances in a private subnet initiate outbound connections without exposing them to inbound internet traffic. Direct public IPs or internet gateway routes expose the instance to inbound access.

Question 17ECS and compute operations

A team needs to create an identical fleet of 50 ECS instances with the same OS and preinstalled software. What is the most efficient approach?

  1. Clone the instance's security group 50 times
  2. Launch one instance, configure it, and create a custom image to deploy Correct answer.
  3. Use snapshots of each data disk
  4. Manually install software on each instance after launch

Explanation

A custom image captures the configured OS and software so all instances launch preconfigured. Manual installation is slow and error-prone, and snapshots and security groups do not template software.

Question 18ECS and compute operations

An operator wants to be notified when an ECS instance's CPU exceeds 80% for five minutes. Which service combination is appropriate?

  1. CloudMonitor alarm with a message notification Correct answer.
  2. Auto Scaling with a scheduled task
  3. ActionTrail with a log delivery rule
  4. VPC flow logs with a route change

Explanation

CloudMonitor evaluates metric thresholds and can trigger alarm notifications through message channels. ActionTrail audits API calls, flow logs record traffic, and scheduled tasks do not monitor metrics.

Question 19ECS and compute operations

A user wants to reduce cost for a batch job that can tolerate interruption and runs for a few hours. Which purchasing option best fits?

  1. Subscription (prepaid) for one year
  2. Pay-as-you-go on-demand instances
  3. Dedicated host
  4. Spot (preemptible) instances Correct answer.

Explanation

Spot instances offer large discounts in exchange for possible reclamation, which suits fault-tolerant batch work. Prepaid subscriptions commit for long periods, and dedicated hosts are for isolation needs.

Question 20ECS and compute operations

Which statement about ECS instance metadata access is correct?

  1. Metadata stores the instance's data disk contents
  2. Metadata requires an internet connection to retrieve
  3. Metadata is only available through the console
  4. Metadata is reachable from inside the instance via a link-local address Correct answer.

Explanation

The instance metadata service is reachable from within the instance over a link-local address and returns attributes such as instance ID and RAM role credentials. It does not require internet access and does not store disk data.

Question 21ECS and compute operations

An instance type family optimized for memory-intensive in-memory databases should be selected based on which characteristic?

  1. A large local ephemeral disk
  2. A high memory-to-vCPU ratio Correct answer.
  3. A high network bandwidth only
  4. A burstable CPU credit model

Explanation

Memory-optimized families provide a high memory-to-vCPU ratio suited to in-memory workloads. Network bandwidth, local disk, and burstable credits address different bottlenecks.

Question 22ECS and compute operations

A security group allows inbound SSH from 0.0.0.0/0, and the instance is later found compromised. Which change most directly reduces this exposure?

  1. Enable a public bandwidth package
  2. Change the instance's private IP address
  3. Increase the system disk size
  4. Restrict the inbound rule to a trusted administrative CIDR Correct answer.

Explanation

Limiting the source range of the SSH rule to trusted networks removes broad internet exposure. Bandwidth, private IP changes, and disk size do not restrict who can reach the port.

Question 23ECS and compute operations

An application must survive the failure of a single availability zone. Which deployment approach satisfies this?

  1. Distribute instances across multiple zones in the same region Correct answer.
  2. Place all instances behind a single NAT Gateway
  3. Deploy all instances in one zone with snapshots
  4. Deploy instances across multiple regions behind one SLB

Explanation

Spreading instances across zones within a region protects against a single-zone failure while keeping low-latency connectivity. Multi-region adds complexity beyond the stated requirement, and single-zone placement does not survive a zone outage.

Question 24ECS and compute operations

A team wants to replace an instance's system disk with a snapshot of a previously configured instance. Which operation achieves this?

  1. Create a new instance from a custom image built from that snapshot Correct answer.
  2. Clone the instance's security group
  3. Resize the existing system disk
  4. Attach the snapshot as a data disk to the running instance

Explanation

A snapshot can be used to create a custom image, which then serves as the system disk template for a new instance. Attaching a snapshot as a data disk does not replace the system disk.

Question 25ECS and compute operations

An operator needs to confirm which API calls were made against ECS resources and by which identity. Which service should be consulted?

  1. CloudMonitor
  2. ActionTrail Correct answer.
  3. Cloud Assistant
  4. Auto Scaling

Explanation

ActionTrail records API activity including the caller identity, which supports auditing and investigation. CloudMonitor tracks metrics, Cloud Assistant runs commands, and Auto Scaling manages capacity.

Question 26ECS and compute operations

An operator needs to attach a data disk to an ECS instance so that it is automatically mounted and formatted on first boot without manual intervention. Which approach accomplishes this?

  1. Configure the mount and format commands in the instance user data script. Correct answer.
  2. Enable the automatic disk initialization switch in the security group.
  3. Attach the disk and rely on the OS to auto-mount it by default.
  4. Convert the data disk to a system disk so it mounts automatically.

Explanation

User data scripts execute on first boot and can format and mount attached data disks automatically. The OS does not auto-mount newly attached cloud disks by default. Security groups do not control disk initialization.

Question 27ECS and compute operations

Which ECS instance type family characteristic is the primary selection criterion when choosing an instance for a compute-bound video encoding workload?

  1. The number of vCPUs and the CPU-to-memory ratio. Correct answer.
  2. The burst bandwidth of the attached cloud disk.
  3. The maximum number of attached elastic network interfaces.
  4. The number of secondary private IP addresses supported.

Explanation

Compute-bound workloads are matched to instance families by vCPU count and CPU-to-memory ratio. Network interfaces and disk burst bandwidth are secondary considerations. Secondary IP support is unrelated to compute capacity.

Question 28ECS and compute operations

Which statement describes how an ECS instance's system disk differs from its data disks?

  1. The system disk cannot be snapshotted, while data disks can.
  2. The system disk can be shared across multiple instances simultaneously; data disks cannot.
  3. The system disk holds the OS image and is created with the instance; data disks are attached separately. Correct answer.
  4. The system disk is always faster than any data disk because it uses local SSD.

Explanation

The system disk is provisioned from the selected image and contains the operating system. Data disks are independent block devices attached after creation. Both disk types can be snapshotted, and the system disk is not shareable across instances.

Question 29ECS and compute operations

An operator wants to stop an instance temporarily and later restart it with the same private IP address and disks preserved. Which action preserves the instance identity?

  1. Detach the system disk and delete the instance record.
  2. Convert the instance to a spot instance before stopping.
  3. Stop the instance in stopped mode rather than releasing it. Correct answer.
  4. Release the instance and recreate it from the same image.

Explanation

Stopping an instance (without release) preserves its disks and configuration so it can be restarted with the same identity. Releasing or deleting destroys the instance and its system disk unless separately retained.

Question 30ECS and compute operations

A workload runs on multiple instances behind a load balancer and must handle the loss of one instance without manual intervention. Which configuration achieves this?

  1. Use one instance with a larger instance type to absorb failures.
  2. Assign all instances the same public IP address.
  3. Place instances in a scaling group with health checks and a minimum capacity greater than one. Correct answer.
  4. Attach all instances to a single shared system disk.

Explanation

A scaling group with health checks automatically replaces unhealthy instances, and a minimum capacity above one ensures redundancy. Scaling vertically or sharing disks does not provide fault isolation.

Question 31ECS and compute operations

An operator must run a command on 200 ECS instances at once and verify exit codes for each. Which ECS capability is intended for this?

  1. Instance RAM roles.
  2. Cloud Assistant commands. Correct answer.
  3. Security group rule updates.
  4. Snapshot policies.

Explanation

Cloud Assistant executes commands or scripts on one or many instances and returns per-instance output and exit codes. Security groups, RAM roles, and snapshot policies serve different purposes.

Question 32ECS and compute operations

A user attached a new data disk to a running Linux instance but the OS does not show the additional capacity. What is the most likely explanation?

  1. The disk has not been partitioned, formatted, and mounted inside the OS. Correct answer.
  2. The security group is blocking the disk device.
  3. The disk must be converted to a system disk first.
  4. The instance lacks a public IP address.

Explanation

Attaching a data disk makes the block device available, but the OS must partition, format, and mount it before capacity is usable. Network configuration and public IPs are unrelated to local disk visibility.

Question 33ECS and compute operations

An operator wants to create a custom image from a configured ECS instance so the exact OS and software can be reused. Which prerequisite is required before creating the image?

  1. The instance must use a spot instance billing method.
  2. The instance must have a public IP address assigned.
  3. The instance must be in the stopped state or use a supported online image creation method. Correct answer.
  4. The instance must belong to at least two security groups.

Explanation

Creating a custom image generally requires stopping the instance or using a supported method that ensures a consistent disk state. Public IPs, security group membership, and billing method are not prerequisites.

Question 34ECS and compute operations

A user wants to change the instance type of an existing ECS instance to scale up CPU. Which condition must typically be met?

  1. The instance must be moved to a different region first.
  2. The instance must have no data disks attached.
  3. The instance must be released and recreated from a snapshot.
  4. The instance must be stopped before the instance type can be changed. Correct answer.

Explanation

Changing an instance type generally requires the instance to be stopped so the compute resources can be reallocated. Releasing and recreating is unnecessary, and data disks do not prevent a type change.

Question 35ECS and compute operations

An operator wants a scheduled automatic snapshot of an ECS data disk every night and retention limited to seven days. Which feature should be configured?

  1. A security group outbound rule.
  2. An automatic snapshot policy applied to the disk. Correct answer.
  3. A scaling group scheduled task.
  4. An instance user data script.

Explanation

Automatic snapshot policies define a schedule and retention period and are applied to disks. Scaling scheduled tasks and user data scripts do not manage disk snapshot retention.

Question 36ECS and compute operations

An operator must ensure that an ECS instance's OS disk and data disk are captured together in a consistent state for disaster recovery. Which approach is most appropriate?

  1. Copy the disks to another region without snapshots.
  2. Rely on the instance image alone without disk snapshots.
  3. Create separate snapshots at random times for each disk.
  4. Create a consistent snapshot group covering the involved disks. Correct answer.

Explanation

A snapshot group creates crash-consistent snapshots across multiple disks so they can be restored together. Independent snapshots taken at different times may not be mutually consistent. An image alone does not capture later data disk changes.

Question 37ECS and compute operations

A team needs instances in a VPC to resolve internal DNS names of other instances. Which configuration supports automatic hostname resolution within the VPC?

  1. Use the VPC's built-in DNS and private domain resolution with hostnames configured. Correct answer.
  2. Assign each instance a public IP address.
  3. Attach all instances to the same data disk.
  4. Disable the security group on all instances.

Explanation

VPC DNS and private domain features allow internal name resolution among instances. Public IPs expose instances externally but do not provide private name resolution. Security groups and shared disks do not affect DNS.

Question 38ECS and compute operations

An operator needs to run a short, interruption-tolerant batch job at the lowest cost and can accept that the instance may be reclaimed. Which purchasing model fits?

  1. Subscription instances.
  2. Reserved instance plans.
  3. Spot instances. Correct answer.
  4. Dedicated hosts.

Explanation

Spot instances offer large discounts but can be reclaimed, making them suitable for interruption-tolerant work. Subscription and reserved plans are for steady, long-running workloads, and dedicated hosts are for isolation and licensing needs.

Question 39ECS and compute operations

An instance must be reachable from the internet on port 80, but the operator wants to avoid exposing it directly. Which design achieves this?

  1. Assign the instance a public IP and allow all inbound traffic.
  2. Enable the instance's public bandwidth to the maximum value.
  3. Attach the instance to multiple security groups with open rules.
  4. Place the instance behind a load balancer and allow inbound traffic only from the load balancer. Correct answer.

Explanation

Placing the instance behind a load balancer and restricting inbound rules to the balancer's addresses hides the instance from direct internet exposure. Opening all inbound traffic or maximizing bandwidth increases exposure.

Question 40ECS and compute operations

An operator wants to attach an existing elastic network interface with a preconfigured private IP to a different instance during a failover. Which statement is correct?

  1. The ENI must be detached from the original instance before it can be attached to another. Correct answer.
  2. The ENI cannot be moved between instances once created.
  3. The ENI retains its private IP only if the instance is in the same security group.
  4. The ENI can be attached to two instances simultaneously for redundancy.

Explanation

An ENI is attached to one instance at a time; it must be detached before being attached elsewhere, and it retains its private IP when moved. Simultaneous attachment to two instances is not supported.

Question 41Networking (VPC, SLB, DNS, connectivity)

In an Alibaba Cloud VPC, which component provides the virtual firewall that controls inbound and outbound traffic for one or more ECS instances?

  1. Elastic IP address
  2. Route table
  3. Security group Correct answer.
  4. Virtual switch (vSwitch)

Explanation

A security group is a stateful virtual firewall bound to ECS instances that filters inbound and outbound traffic by rules. It operates at the instance level, independent of routing or public addressing.

Question 42Networking (VPC, SLB, DNS, connectivity)

Which Alibaba Cloud DNS record type is used to map a domain name to an IPv4 address?

  1. TXT
  2. MX
  3. A Correct answer.
  4. CNAME

Explanation

An A record maps a hostname directly to an IPv4 address. CNAME aliases one name to another, MX directs mail, and TXT carries arbitrary text such as verification strings.

Question 43Networking (VPC, SLB, DNS, connectivity)

What is the primary purpose of an Alibaba Cloud Server Load Balancer (SLB) instance?

  1. To distribute incoming traffic across multiple backend servers Correct answer.
  2. To cache static content at edge locations
  3. To assign public IP addresses to ECS instances
  4. To encrypt traffic between two VPCs

Explanation

SLB distributes client requests across a set of backend servers to improve availability and scalability. It health-checks backends and forwards traffic only to healthy ones.

Question 44Networking (VPC, SLB, DNS, connectivity)

Which Alibaba Cloud service lets ECS instances in a VPC without public IP addresses initiate outbound internet connections through a shared public address?

  1. VPN Gateway
  2. Smart Access Gateway
  3. Express Connect
  4. NAT Gateway Correct answer.

Explanation

NAT Gateway provides SNAT so private instances can reach the internet using the gateway's EIP while remaining unreachable from inbound internet traffic. It is the standard egress solution for private subnets.

Question 45Networking (VPC, SLB, DNS, connectivity)

What does a CIDR block of 192.168.0.0/24 provide when assigned to a VPC or vSwitch?

  1. 254 usable host addresses Correct answer.
  2. 128 usable host addresses
  3. 512 usable host addresses
  4. 256 usable host addresses

Explanation

A /24 leaves 8 host bits, giving 256 total addresses; reserving the network and broadcast addresses yields 254 usable addresses. Alibaba Cloud may also reserve a few addresses per vSwitch, so practical availability can be slightly lower.

Question 46Networking (VPC, SLB, DNS, connectivity)

Which SLB listener protocol operates at Layer 4 and forwards TCP connections without inspecting HTTP headers?

  1. HTTPS
  2. HTTP
  3. TCP Correct answer.
  4. HTTP/2

Explanation

A TCP listener balances at Layer 4, forwarding connections based on IP and port without parsing application payloads. HTTP and HTTPS listeners are Layer 7 and can inspect headers and paths.

Question 47Networking (VPC, SLB, DNS, connectivity)

Two ECS instances are placed in different vSwitches of the same VPC. By default, how is their private traffic handled?

  1. It must traverse a NAT Gateway
  2. It requires an EIP on each instance
  3. It is routed within the VPC without additional configuration Correct answer.
  4. It is blocked until a VPN is configured

Explanation

vSwitches within one VPC are connected by the VPC's internal routing, so instances can communicate over private IPs by default. Security groups still govern whether the traffic is permitted.

Question 48Networking (VPC, SLB, DNS, connectivity)

Which Alibaba Cloud feature resolves a domain name to different IP addresses for users in different geographic regions?

  1. Reverse DNS lookup
  2. GeoDNS (location-based resolution) Correct answer.
  3. Weighted round-robin
  4. CNAME flattening

Explanation

GeoDNS returns answers based on the resolver's geographic location, directing users to nearby endpoints. Weighted round-robin splits traffic by configured weights rather than by geography.

Question 49Networking (VPC, SLB, DNS, connectivity)

An administrator wants only instances in a specific security group to reach a backend ECS web server on port 80. Which security group rule achieves this most precisely?

  1. Allow the VPC CIDR on port 80
  2. Allow the source security group on port 80 Correct answer.
  3. Allow 0.0.0.0/0 on port 80
  4. Allow the vSwitch CIDR on port 80

Explanation

Authorizing a source security group as the rule source restricts access to instances that are members of that group, regardless of their IP addresses. This is more precise than allowing an entire CIDR range.

Question 50Networking (VPC, SLB, DNS, connectivity)

A company needs a single SLB to route requests for /api to one backend group and /images to another. Which listener type and feature should be used?

  1. TCP listener with connection draining
  2. UDP listener with health checks
  3. Layer 4 listener with session persistence
  4. HTTP or HTTPS listener with URL-based forwarding rules Correct answer.

Explanation

URL-based forwarding is a Layer 7 capability available on HTTP and HTTPS listeners, letting the SLB route by path or host. Layer 4 listeners cannot inspect the request path.