🔍

SOA-C02 — questions

Page 20 of 24 · 477 total questions.

SOA-C02 Question 381

Single page →
Topic 1 · Question 381

A SysOps administrator wants to securely share an object from a private Amazon S3 bucket with a group of users who do not have an AWS account. What is the MOST operationally efficient solution that will meet this requirement?

  • AAttach an S3 bucket policy that only allows object downloads from the users' IP addresses.
  • BCreate an IAM role that has access to the object. Instruct the users to assume the role.
  • CCreate an IAM user that has access to the object. Share the credentials with the users.
  • DGenerate a presigned URL for the object. Share the URL with the users. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Generate a presigned URL for the object. Share the URL with the users.

SOA-C02 Question 382

Single page →
Topic 1 · Question 382

A company is running an ecommerce application on AWS. The application maintains many open but idle connections to an Amazon Aurora DB cluster. During times of peak usage, the database produces the following error message: "Too many connections." The database clients are also experiencing errors. Which solution will resolve these errors?

  • AIncrease the read capacity units (RCUs) and the write capacity units (WCUs) on the database.
  • BConfigure RDS Proxy. Update the application with the RDS Proxy endpoint. (correct answer)
  • CTurn on enhanced networking for the DB instances.
  • DModify the DB cluster to use a burstable instance type.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure RDS Proxy. Update the application with the RDS Proxy endpoint.

Explanation

Amazon RDS Proxy pools and shares database connections to improve scalability and resilience. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 383

Single page →
Topic 1 · Question 383

A SysOps administrator is troubleshooting a VPC with public and private subnets that leverage custom network ACLs. Instances in the private subnet are unable to access the internet. There is an internet gateway attached to the public subnet. The private subnet has a route to a NAT gateway that is also attached to the public subnet. The Amazon EC2 instances are associated with the default security group for the VPC. What is causing the issue in this scenario?

  • AThere is a network ACL on the private subnet set to deny all outbound traffic. (correct answer)
  • BThere is no NAT gateway deployed in the private subnet of the VPC.
  • CThe default security group for the VPC blocks all inbound traffic to the EC2 instances.
  • DThe default security group for the VPC blocks all outbound traffic from the EC2 instances.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: There is a network ACL on the private subnet set to deny all outbound traffic.

SOA-C02 Question 384

Single page →
Topic 1 · Question 384

A company stores its internal data within an Amazon S3 bucket. All existing data within the S3 bucket is protected by using server-side encryption with Amazon S3 managed encryption keys (SSE-S3). S3 Versioning is enabled. A SysOps administrator must replicate the internal data to another S3 bucket in a different AWS account for disaster recovery. All the existing data is copied from the source S3 bucket to the destination S3 bucket. Which replication solution is MOST operationally efficient?

  • AAdd a replication rule to the source bucket and specify the destination bucket. Create a bucket policy for the destination bucket to allow the owner of the source bucket to replicate objects. (correct answer)
  • BSchedule an AWS Batch job with Amazon EventBridge to copy new objects from the source bucket to the destination bucket. Create a Batch Operations IAM role in the destination account.
  • CConfigure an Amazon S3 event notification for the source bucket to invoke an AWS Lambda function to copy new objects to the destination bucket. Ensure that the Lambda function has cross-account access permissions.
  • DRun a scheduled script on an Amazon EC2 instance to copy new objects from the source bucket to the destination bucket. Assign cross-account access permissions to the EC2 instance's role.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Add a replication rule to the source bucket and specify the destination bucket. Create a bucket policy for the destination bucket to allow the owner of the source bucket to replicate objects. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 385

Single page →
Topic 1 · Question 385

A company has a high performance computing (HPC) application that runs on Amazon EC2 instances. The application requires minimum latency and maximum network throughput between nodes. How should a SysOps administrator deploy the EC2 instances to meet these requirements?

  • AUse a cluster placement group in a single Availability Zone. (correct answer)
  • BUse a cluster placement group across multiple Availability Zones.
  • CUse a partition placement group in a single Availability Zone.
  • DUse a partition placement group across multiple Availability Zones.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use a cluster placement group in a single Availability Zone.

SOA-C02 Question 386

Single page →
Topic 1 · Question 386

A company has a stateless application that is hosted on a fleet of 10 Amazon EC2 On-Demand Instances in an Auto Scaling group. A minimum of 6 instances are needed to meet service requirements. Which action will maintain uptime for the application MOST cost-effectively?

  • AUse a Spot Fleet with an On-Demand capacity of 6 instances. (correct answer)
  • BUpdate the Auto Scaling group with a minimum of 6 On-Demand Instances and a maximum of 10 On-Demand Instances.
  • CUpdate the Auto Scaling group with a minimum of 1 On-Demand Instance and a maximum of 6 On-Demand Instances.
  • DUse a Spot Fleet with a target capacity of 6 instances.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use a Spot Fleet with an On-Demand capacity of 6 instances. This option delivers the requirement at the lowest cost.

SOA-C02 Question 387

Single page →
Topic 1 · Question 387 · Select all that apply

A company has developed a service that is deployed on a fleet of Linux-based Amazon EC2 instances that are in an Auto Scaling group. The service occasionally fails unexpectedly because of an error in the application code. The company's engineering team determines that resolving the underlying cause of the service failure could take several weeks. A SysOps administrator needs to create a solution to automate recovery if the service crashes on any of the EC2 instances. Which solutions will meet this requirement? (Choose two.)

  • AInstall the Amazon CloudWatch agent on the EC2 instances. Configure the CloudWatch agent to monitor the service. Set the CloudWatch action to restart if the service health check fails. (correct answer)
  • BTag the EC2 instances. Create an AWS Lambda function that uses AWS Systems Manager Session Manager to log in to the tagged EC2 instances and restart the service. Schedule the Lambda function to run every 5 minutes.
  • CTag the EC2 instances. Use AWS Systems Manager State Manager to create an association that uses the AWS-RunShellScript document. Configure the association command with a script that checks if the service is running and that starts the service if the service is not running. For targets, specify the EC2 instance tag. Schedule the association to run every 5 minutes. (correct answer)
  • DUpdate the EC2 user data that is specified in the Auto Scaling group's launch template to include a script that runs on a cron schedule every 5 minutes. Configure the script to check if the service is running and to start the service if the service is not running. Redeploy all the EC2 instances in the Auto Scaling group with the updated launch template.
  • EUpdate the EC2 user data that is specified in the Auto Scaling group's launch template to ensure that the service runs during startup. Redeploy all the EC2 instances in the Auto Scaling group with the updated launch template.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Install the Amazon CloudWatch agent on the EC2 instances. Configure the CloudWatch agent to monitor the service. Set the CloudWatch action to restart if the service health check fails. Option C: Tag the EC2 instances. Use AWS Systems Manager State Manager to create an association that uses the AWS-RunShellScript document. Configure the association command with a script that checks if the service is running an...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 388

Single page →
Topic 1 · Question 388

A company's web application runs on Amazon EC2 instances in a single AWS Region. The infrastructure must be designed so the application remains available with no performance degradation in the event of an Availability Zone (AZ) failure. To ensure optimal performance, the application must maintain a minimum of 12 instances at all times. Which solution will meet the requirements with the fewest running instances possible?

  • A2 AZs with 6 instances in each AZ
  • B2 AZs with 12 instances in each AZ
  • C3 AZs with 4 instances in each AZ
  • D3 AZs with 6 instances in each AZ (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: 3 AZs with 6 instances in each AZ.

SOA-C02 Question 389

Single page →
Topic 1 · Question 389 · Select all that apply

A company needs to monitor the disk utilization of Amazon Elastic Block Store (Amazon EBS) volumes. The EBS volumes are attached to Amazon EC2 Linux instances. A SysOps administrator must set up an Amazon CloudWatch alarm that provides an alert when disk utilization increases to more than 80%. Which combination of steps must the SysOps administrator take to meet these requirements? (Choose three.)

  • ACreate an IAM role that includes the CloudWatchAgentServerPolicy AWS managed policy. Attach the role to the instances. (correct answer)
  • BCreate an IAM role that includes the CloudWatchApplicationInsightsReadOnlyAccess AWS managed policy. Attach the role to the instances.
  • CInstall and start the CloudWatch agent by using AWS Systems Manager or the command line. (correct answer)
  • DInstall and start the CloudWatch agent by using an IAM role. Attach the CloudWatchAgentServerPolicy AWS managed policy to the role.
  • EConfigure a CloudWatch alarm to enter ALARM state when the disk_used_percent CloudWatch metric is greater than 80%. (correct answer)
  • FConfigure a CloudWatch alarm to enter ALARM state when the disk_used CloudWatch metric is greater than 80% or when the disk_free CloudWatch metric is less than 20%.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Create an IAM role that includes the CloudWatchAgentServerPolicy AWS managed policy. Attach the role to the instances. Option C: Install and start the CloudWatch agent by using AWS Systems Manager or the command line. Option E: Configure a CloudWatch alarm to enter ALARM state when the disk_used_percent CloudWatch metric is greater than 80%.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 390

Single page →
Topic 1 · Question 390

An ecommerce company uses an Amazon ElastiCache for Redis cluster for in-memory caching of popular product queries on a shopping website. The cache eviction policy is randomly evicting keys whether or not a TTL is set. A SysOps administrator must improve the cache hit ratio without increasing costs. Which solution will meet these requirements?

  • AAdd another node to the ElastiCache cluster.
  • BIncrease the ElastiCache TTL value.
  • CChange the eviction policy to randomly evict keys that have a TTL set.
  • DChange the eviction policy to evict the least frequently used keys. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Change the eviction policy to evict the least frequently used keys.

SOA-C02 Question 391

Single page →
Topic 1 · Question 391

A company deployed a new web application on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances run in an Auto Scaling group. Users report that they are frequently being prompted to log in. What should a SysOps administrator do to resolve this issue?

  • AConfigure an Amazon CloudFront distribution with the ALB as the origin.
  • BEnable sticky sessions (session affinity) for the target group of EC2 instances. (correct answer)
  • CRedeploy the EC2 instances in a spread placement group.
  • DReplace the ALB with a Network Load Balancer.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable sticky sessions (session affinity) for the target group of EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 392

Single page →
Topic 1 · Question 392

A company has scientists who upload large data objects to an Amazon S3 bucket. The scientists upload the objects as multipart uploads. The multipart uploads often fail because of poor end-client connectivity. The company wants to optimize storage costs that are associated with the data. A SysOps administrator must implement a solution that presents metrics for incomplete uploads. The solution also must automatically delete any incomplete uploads after 7 days. Which solution will meet these requirements?

  • AReview the Incomplete Multipart Upload Bytes metric in the S3 Storage Lens dashboard. Create an S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days. (correct answer)
  • BImplement S3 Intelligent-Tiering to move data into lower-cost storage classes after 7 days. Create an S3 Storage Lens policy to automatically delete any incomplete multipart uploads after 7 days.
  • CAccess the S3 console. Review the Metrics tab to check the storage that incomplete multipart uploads are consuming. Create an AWS Lambda function to delete any incomplete multipart uploads after 7 days.
  • DUse the S3 analytics storage class analysis tool to identify and measure incomplete multipart uploads. Configure an S3 bucket policy to enforce restrictions on multipart uploads to delete incomplete multipart uploads after 7 days.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Review the Incomplete Multipart Upload Bytes metric in the S3 Storage Lens dashboard. Create an S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days.

Explanation

S3 Lifecycle policies automatically transition or expire objects to control storage cost. Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 393

Single page →
Topic 1 · Question 393

A company stores data in Amazon S3 buckets that are provisioned in three separate AWS Regions. The data is copied from the S3 buckets to the data center over the public internet using a VPN. The SysOps administrator notices that, occasionally, the transfers take longer than usual, and determines the issue is congestion within the company's ISP network. What is the MOST cost-effective approach the administrator can take to ensure consistent transfer times from S3 to the data center?

  • AEstablish an AWS Direct Connect link to each Region. Create a private virtual interface over each link.
  • BEstablish an AWS Direct Connect link to each Region. Create a public virtual interface over each link.
  • CEstablish an AWS Direct Connect link to one of the Regions. Create a private virtual interface over that link.
  • DEstablish an AWS Direct Connect link to one of the Regions. Create a public virtual interface over that link. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Establish an AWS Direct Connect link to one of the Regions. Create a public virtual interface over that link.

Explanation

AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS. This option delivers the requirement at the lowest cost.

SOA-C02 Question 394

Single page →
Topic 1 · Question 394

A company has an Amazon EC2 instance that supports a production system. The EC2 instance is backed by an Amazon Elastic Block Store (Amazon EBS) volume. The EBS volume's drive has filled to 100% capacity, which is causing the application on the EC2 instance to experience errors. Which solution will remediate these errors in the LEAST amount of time?

  • AModify the EBS volume by adding additional drive space. Log on to the EC2 instance. Use the file system-specific commands to extend the file system. (correct answer)
  • BCreate a snapshot of the existing EBS volume. When the snapshot is complete, create an EBS volume of a larger size from the snapshot in the same Availability Zone as the EC2 instance. Attach the new EBS volume to the EC2 instance. Mount the file system.
  • CCreate a new EBS volume of a larger size in the same Availability Zone as the EC2 instance. Attach the EBS volume to the EC2 instance. Copy the data from the existing EBS volume to the new EBS volume.
  • DStop the EC2 instance. Change the EC2 instance to a larger instance size that includes additional drive space. Start the EC2 instance.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Modify the EBS volume by adding additional drive space. Log on to the EC2 instance. Use the file system-specific commands to extend the file system.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon EBS provides block storage attached to a single EC2 instance.

SOA-C02 Question 395

Single page →
Topic 1 · Question 395

A company has several member accounts that are in an organization in AWS Organizations. The company recently discovered that administrators have been using account root user credentials. The company must prevent the administrators from using root user credentials to perform any actions on Amazon EC2 instances. What should a SysOps administrator do to meet this requirement?

  • ACreate an identity-based IAM policy in each member account to deny actions on EC2 instances by the root user.
  • BIn the organization's management account, create a service control policy (SCP) to deny actions on EC2 instances by the root user in all member accounts. (correct answer)
  • CUse AWS Config to prevent any actions on EC2 instances by the root user.
  • DUse Amazon Inspector in each member account to scan for root user logins and to prevent any actions on EC2 instances by the root user.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: In the organization's management account, create a service control policy (SCP) to deny actions on EC2 instances by the root user in all member accounts.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Service Control Policies set guardrails on what accounts in an organization can do.

SOA-C02 Question 396

Single page →
Topic 1 · Question 396

A company is transitioning away from applications that are hosted on Amazon EC2 instances. The company wants to implement a serverless architecture that uses Amazon S3, Amazon API Gateway, AWS Lambda, and Amazon CloudFront. As part of this transition, the company has Elastic IP addresses that are unassociated with any EC2 instances after the EC2 instances are terminated. A SysOps administrator needs to automate the process of releasing all unassociated Elastic IP addresses that remain after the EC2 instances are terminated. Which solution will meet this requirement in the MOST operationally efficient way?

  • AActivate the eip-attached AWS Config managed rule to run automatically when resource changes occur in the AWS account. Configure automatic remediation for the rule. Specify the AWS-ReleaseElasticIP AWS Systems Manager Automation runbook for remediation. Specify an appropriate role that has permission for the remediation. (correct answer)
  • BCreate a custom Lambda function that calls the EC2 ReleaseAddress API operation and specifies the Elastic IP address AllocationId. Invoke the Lambda function by using an Amazon EventBridge rule. Specify AWS services as the event source, All Events as the event type, and AWS Trusted Advisor as the target.
  • CCreate an Amazon EventBridge rule. Specify AWS services as the event source, Instance State-change Notification as the event type, and Amazon EC2 as the service. Invoke a Lambda function that extracts the Elastic IP address from the notification. Use AWS CloudFormation to release the address by specifying the AllocationId as an input parameter.
  • DCreate a custom Lambda function that calls the EC2 ReleaseAddress API operation and specifies the Elastic IP address AllocationId. Invoke the Lambda function by using an Amazon EventBridge rule. Specify AWS services as the event source, Instance State-change Notification as the event type, and Amazon EC2 as the service.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Activate the eip-attached AWS Config managed rule to run automatically when resource changes occur in the AWS account. Configure automatic remediation for the rule. Specify the AWS-ReleaseElasticIP AWS Systems Manager...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS Systems Manager operates and automates management of fleets of resources.

SOA-C02 Question 397

Single page →
Topic 1 · Question 397

A company uses Amazon CloudFront to serve static content to end users. The company's marketing team recently deployed updates to 150 images on the company's website. However, the website is not displaying some of the new images. A SysOps administrator reviews the CloudFront distribution's cache settings. The default TTL for the distribution is set to 1 week (604,800 seconds). What should the SysOps administrator do to refresh the cache with the new images in the MOST operationally efficient way?

  • ACreate a new CloudFront distribution that has the same origin. Set the default TTL to 1 minute (60 seconds). Switch Amazon Route 53 DNS records to use the new distribution.
  • BInstruct the marketing team to upload the new images to a different location. When the new images are uploaded, update the website to locate the new images.
  • CIssue a CloudFront invalidation request to immediately expire the new images from the marketing team's update. (correct answer)
  • DUpdate the existing CloudFront distribution to reconfigure the default TTL to 1 minute (60 seconds). During submission of the new configuration, include the flag to invalidate objects in the specified path.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Issue a CloudFront invalidation request to immediately expire the new images from the marketing team's update.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SOA-C02 Question 398

Single page →
Topic 1 · Question 398

A SysOps administrator is responsible for a company's disaster recovery procedures. The company has a source Amazon S3 bucket in a production account, and it wants to replicate objects from the source to a destination S3 bucket in a nonproduction account. The SysOps administrator configures S3 cross-Region, cross-account replication to copy the source S3 bucket to the destination S3 bucket. When the SysOps administrator attempts to access objects in the destination S3 bucket, they receive an Access Denied error. Which solution will resolve this problem?

  • AModify the replication configuration to change object ownership to the destination S3 bucket owner. (correct answer)
  • BEnsure that the replication rule applies to all objects in the source S3 bucket and is not scoped to a single prefix.
  • CRetry the request when the S3 Replication Time Control (S3 RTC) has elapsed.
  • DVerify that the storage class for the replicated objects did not change between the source S3 bucket and the destination S3 bucket.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Modify the replication configuration to change object ownership to the destination S3 bucket owner.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 399

Single page →
Topic 1 · Question 399

A company is running Amazon RDS for PostgreSQL Multi-AZ DB clusters. The company uses an AWS CloudFormation template to create the databases individually with a default size of 100 GB. The company creates the databases every Monday and deletes the databases every Friday. Occasionally, the databases run low on disk space and initiate an Amazon CloudWatch alarm. A SysOps administrator must prevent the databases from running low on disk space in the future. Which solution will meet these requirements with the FEWEST changes to the application?

  • AModify the CloudFormation template to use Amazon Aurora PostgreSQL as the DB engine.
  • BModify the CloudFormation template to use Amazon DynamoDB as the database. Activate storage auto scaling during creation of the tables.
  • CModify the Cloud Formation template to activate storage auto scaling on the existing DB instances. (correct answer)
  • DCreate a CloudWatch alarm to monitor DB instance storage space. Configure the alarm to invoke the VACUUM command.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Modify the Cloud Formation template to activate storage auto scaling on the existing DB instances.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 400

Single page →
Topic 1 · Question 400

A SysOps administrator wants to share a copy of a production database with a migration account. The production database is hosted on an Amazon RDS DB instance and is encrypted at rest with an AWS Key Management Service (AWS KMS) key that has an alias of production-rds-key. What must the SysOps administrator do to meet these requirements with the LEAST administrative overhead?

  • ATake a snapshot of the RDS DB instance in the production account. Amend the KMS key policy of the production-rds-key KMS key to give access to the migration account's root user. Share the snapshot with the migration account. (correct answer)
  • BCreate an RDS read replica in the migration account. Configure the KMS key policy to replicate the production-rds-key KMS key to the migration account.
  • CTake a snapshot of the RDS DB instance in the production account. Share the snapshot with the migration account. In the migration account, create a new KMS key that has an identical alias.
  • DUse native database toolsets to export the RDS DB instance to Amazon S3. Create an S3 bucket and an S3 bucket policy for cross account access between the production account and the migration account. Use native database toolsets to import the database from Amazon S3 to a new RDS DB instance.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Take a snapshot of the RDS DB instance in the production account. Amend the KMS key policy of the production-rds-key KMS key to give access to the migration account's root user. Share the snapshot with the migration a...

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

Showing questions 381–400 of 477 · Page 20 of 24