SOA-C02 — questions

Page 22 of 24 · 477 total questions.

SOA-C02 Question 421

Topic 1 · Question 421

A company has attached the following policy to an IAM user: Which of the following actions are allowed for the IAM user?

AAmazon RDS DescribeDBInstances action in the us-east-1 Region
BAmazon S3 PutObject operation in a bucket named testbucket
CAmazon EC2 DescribeInstances action in the us-east-1 Region (correct answer)
DAmazon EC2 AttachNetworkInterface action in the eu-west-1 Region

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Amazon EC2 DescribeInstances action in the us-east-1 Region

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

A company has an on-premises DNS solution and wants to resolve DNS records in an Amazon Route 53 private hosted zone for example.com. The company has set up an AWS Direct Connect connection for network connectivity between the on-premises network and the VPC. A SysOps administrator must ensure that an on-premises server can query records in the example.com domain. What should the SysOps administrator do to meet these requirements?

ACreate a Route 53 Resolver inbound endpoint. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers. (correct answer)
BCreate a Route 53 Resolver inbound endpoint. Attach a security group to the endpoint to allow outbound traffic on TCP/UDP port 53 to the on-premises DNS servers.
CCreate a Route 53 Resolver outbound endpoint. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.
DCreate a Route 53 Resolver outbound endpoint. Attach a security group to the endpoint to allow outbound traffic on TCP/UDP port 53 to the on-premises DNS servers.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Create a Route 53 Resolver inbound endpoint. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

SOA-C02 Question 423

Single page →

Topic 1 · Question 423

A company uses AWS CloudFormation to deploy its application infrastructure. Recently, a user accidentally changed a property of a database in a CloudFormation template and performed a stack update that caused an interruption to the application. A SysOps administrator must determine how to modify the deployment process to allow the DevOps team to continue to deploy the infrastructure, but prevent against accidental modifications to specific resources. Which solution will meet these requirements?

ASet up an AWS Config rule to alert based on changes to any CloudFormation stack. An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation.
BSet up an Amazon EventBridge event with a rule to initiate based on any CloudFormation API call. An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation.
CLaunch the CloudFormation templates using a stack policy with an explicit allow for all resources and an explicit deny of the protected resources with an action of Update:*. (correct answer)
DAttach an IAM policy to the DevOps team role that prevents a CloudFormation stack from updating, with a condition based on the specific Amazon Resource Names (ARNs) of the protected resources.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Launch the CloudFormation templates using a stack policy with an explicit allow for all resources and an explicit deny of the protected resources with an action of Update:*.

Explanation

AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 424

Single page →

Topic 1 · Question 424 · Select all that apply

A SysOps administrator has an AWS CloudFormation template of the company's existing infrastructure in us-west-2. The administrator attempts to use the template to launch a new stack in eu-west-1, but the stack only partially deploys, receives an error message, and then rolls back. Why would this template fail to deploy? (Choose two.)

AThe template referenced an IAM user that is not available in eu-west-1.
BThe template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1. (correct answer)
CThe template did not have the proper level of permissions to deploy the resources.
DThe template requested services that do not exist in eu-west-1. (correct answer)
ECloudFormation templates can be used only to update existing services.

Reveal answer & explanation

Correct answer: B, D

The correct answer is B, D. Option B: The template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1. Option D: The template requested services that do not exist in eu-west-1.

SOA-C02 Question 425

Single page →

Topic 1 · Question 425

An application accesses data through a file system interface. The application runs on Amazon EC2 instances in multiple Availability Zones, all of which must share the same data. While the amount of data is currently small, the company anticipates that it will grow to tens of terabytes over the lifetime of the application. What is the MOST scalable storage solution to fulfill this requirement?

AConnect a large Amazon EBS volume to multiple instances and schedule snapshots.
BDeploy Amazon EFS in the VPC and create mount targets in multiple subnets. (correct answer)
CLaunch an EC2 instance and share data using SMB/CIFS or NFS.
DDeploy an AWS Storage Gateway cached volume on Amazon EC2.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Deploy Amazon EFS in the VPC and create mount targets in multiple subnets.

Explanation

Amazon EFS is a shared, elastic NFS file system that multiple instances can mount concurrently across AZs. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 426

Single page →

Topic 1 · Question 426

A company is deploying an ecommerce application to an AWS Region that is located in France. The company wants users from only France to be able to access the first version of the application. The company plans to add more countries for the next version of the application. A SysOps administrator needs to configure the routing policy in Amazon Route 53. Which solution will meet these requirements?

AUse a geoproximity routing policy. Select France as the location in the record.
BUse a geolocation routing policy. Select France as the location in the record. (correct answer)
CUse an IP-based routing policy. Select all IP addresses that are allocated to France in the record.
DUse a geoproximity routing policy. Select all IP addresses that are allocated to France in the record.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Use a geolocation routing policy. Select France as the location in the record.

SOA-C02 Question 427

Single page →

Topic 1 · Question 427 · Select all that apply

A SysOps administrator is using IAM credentials to try to upload a file to a customer's Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The SysOps administrator is receiving an AccessDenied message. Which combination of configuration changes will correct this problem? (Choose two.)

AAdd this IAM policy to the SysOps administrator user: (correct answer)
BAdd this IAM policy to the customer S3 bucket: (correct answer)
CAdd this IAM policy to the SysOps administrator user:
DAdd this IAM policy to the customer account root user:
EAdd this IAM policy to the SysOps administrator account root user:

Reveal answer & explanation

Correct answer: A, B

The correct answer is A, B. Option A: Add this IAM policy to the SysOps administrator user: Option B: Add this IAM policy to the customer S3 bucket:

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SOA-C02 Question 428

Single page →

Topic 1 · Question 428

A company uses AWS Organizations to host several applications across multiple AWS accounts. Several teams are responsible for building and maintaining the infrastructure of the applications across the AWS accounts. A SysOps administrator must implement a solution to ensure that user accounts and permissions are centrally managed. The solution must be integrated with the company's existing on-premises Active Directory environment. The SysOps administrator already has enabled AWS IAM Identity Center (AWS Single Sign-On) and has set up an AWS Direct Connect connection. What is the MOST operationally efficient solution that meets these requirements?

ACreate a Simple AD domain, and establish a forest trust relationship with the on-premises Active Directory domain. Set the Simple AD domain as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
BCreate an Active Directory domain controller on an Amazon EC2 instance that is joined to the on-premises Active Directory domain. Set the Active Directory domain controller as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
CCreate an AD Connector that is associated with the on-premises Active Directory domain. Set the AD Connector as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage. (correct answer)
DUse the built-in SSO directory as the identity source for IAM Identity Center. Copy the users and groups from the on-premises Active Directory domain. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create an AD Connector that is associated with the on-premises Active Directory domain. Set the AD Connector as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each...

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

SOA-C02 Question 429

Single page →

Topic 1 · Question 429

A company wants to apply an existing Amazon Route 53 private hosted zone to a new VPC to allow for customized resource name resolution within the VPC. The SysOps administrator created the VPC and added the appropriate resource record sets to the private hosted zone. Which step should the SysOps administrator take to complete the setup?

AAssociate the Route 53 private hosted zone with the VPC. (correct answer)
BCreate a rule in the default security group for the VPC that allows traffic to the Route 53 Resolver.
CEnsure the VPC network ACLs allow traffic to the Route 53 Resolver.
DEnsure there is a route to the Route 53 Resolver in each of the VPC route tables.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Associate the Route 53 private hosted zone with the VPC.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

SOA-C02 Question 430

Single page →

Topic 1 · Question 430

A company has an AWS Site-to-Site VPN connection between on-premises resources and resources that are hosted in a VPC. A SysOps administrator launches an Amazon EC2 instance that has only a private IP address into a private subnet in the VPC. The EC2 instance runs Microsoft Windows Server. A security group for the EC2 instance has rules that allow inbound traffic from the on-premises network over the VPN connection. The on-premises environment contains a third-party network firewall. Rules in the third-party network firewall allow Remote Desktop Protocol (RDP) traffic to flow between the on-premises users over the VPN connection. The on-premises users are unable to connect to the EC2 instance and receive a timeout error. What should the SysOps administrator do to troubleshoot this issue?

ACreate Amazon CloudWatch logs for the EC2 instance to check for blocked traffic.
BCreate Amazon CloudWatch logs for the Site-to-Site VPN connection to check for blocked traffic.
CCreate VPC flow logs for the EC2 instance's elastic network interface to check for rejected traffic. (correct answer)
DInstruct users to use EC2 Instance Connect as a connection method.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create VPC flow logs for the EC2 instance's elastic network interface to check for rejected traffic.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 431

Single page →

Topic 1 · Question 431 · Select all that apply

A SysOps administrator has set up a new Amazon EC2 instance as a web server in a public subnet. The instance uses HTTP port 80 and HTTPS port 443. The SysOps administrator has confirmed internet connectivity by downloading operating system updates and software from public repositories. However, the SysOps administrator cannot access the instance from a web browser on the internet. Which combination of steps should the SysOps administrator take to troubleshoot this issue? (Choose three.)

AEnsure that the inbound rules of the instance’s security group allow traffic on ports 80 and 443. (correct answer)
BEnsure that the outbound rules of the instance’s security group allow traffic on ports 80 and 443.
CEnsure that ephemeral ports 1024-65535 are allowed in the inbound rules of the network ACL that is associated with the instance's subnet.
DEnsure that ephemeral ports 1024-65535 are allowed in the outbound rules of the network ACL that is associated with the instance’s subnet. (correct answer)
EEnsure that the filtering rules for any firewalls that are running on the instance allow inbound traffic on ports 80 and 443. (correct answer)
FEnsure that AWS WAF is turned on for the instance and is blocking web traffic.

Reveal answer & explanation

Correct answer: A, D, E

The correct answer is A, D, E. Option A: Ensure that the inbound rules of the instance’s security group allow traffic on ports 80 and 443. Option D: Ensure that ephemeral ports 1024-65535 are allowed in the outbound rules of the network ACL that is associated with the instance’s subnet. Option E: Ensure that the filtering rules for any firewalls that are running on the instance allow inbound traffic on ports 80 and 443.

SOA-C02 Question 432

Single page →

Topic 1 · Question 432

A SysOps administrator needs to monitor a process that runs on Linux Amazon EC2 instances. If the process stops, the process must restart automatically. The Amazon CloudWatch agent is already installed on all the EC2 instances. Which solution will meet these requirements?

AAdd a procstat monitoring configuration to the CloudWatch agent for the process. Create an Amazon EventBridge event rule that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops. (correct answer)
BAdd a StatsD monitoring configuration to the CloudWatch agent for the process. Create a CloudWatch alarm that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.
CAdd a StatsD monitoring configuration to the CloudWatch agent for the process. Create an Amazon EventBridge event rule that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.
DAdd a procstat monitoring configuration to the CloudWatch agent for the process. Create a CloudWatch alarm that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Add a procstat monitoring configuration to the CloudWatch agent for the process. Create an Amazon EventBridge event rule that initiates an AWS Systems Manager Automation runbook to restart the process after the proces...

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 433

Single page →

Topic 1 · Question 433

A company has an application that uses an Amazon RDS for MariaDB Multi-AZ database. The application becomes unavailable for several minutes every time the database experiences a failover during a planned maintenance event. What should a SysOps administrator do to reduce the downtime of the application during failover?

ACreate an RDS for MariaDB DB cluster that has multiple writer instances. Configure the application to retry failed queries on another primary node during maintenance events.
BConfigure the RDS maintenance window settings to pool connections while a failover is in process.
CConfigure an Amazon ElastiCache write-through cache for the database. Configure the application to connect to the cache instead of directly to the database.
DCreate an RDS proxy that is associated with the database. Configure the application to connect to the proxy instead of directly to the database. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create an RDS proxy that is associated with the database. Configure the application to connect to the proxy instead of directly to the database.

Explanation

Amazon RDS Proxy pools and shares database connections to improve scalability and resilience. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 434

Single page →

Topic 1 · Question 434 · Select all that apply

A SysOps administrator has noticed millions of LIST requests on an Amazon S3 bucket. Which services or features can the administrator use to investigate where the requests are coming from? (Choose two.)

AAWS CloudTrail data events (correct answer)
BAmazon EventBridge
CAWS Health Dashboard
DAmazon S3 server access logging (correct answer)
EAWS Trusted Advisor

Reveal answer & explanation

Correct answer: A, D

The correct answer is A, D. Option A: AWS CloudTrail data events Option D: Amazon S3 server access logging

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance.

SOA-C02 Question 435

Single page →

Topic 1 · Question 435

A SysOps administrator configures VPC flow logs to publish to Amazon CloudWatch Logs. The SysOps administrator reviews the logs in CloudWatch Logs and notices less traffic than expected. After the SysOps administrator compares the VPC flow logs to logs that were captured on premises, the SysOps administrator believes that the VPC flow logs are incomplete. Which of the following is a possible reason for the difference in traffic?

ACloudWatch Logs throttling has been applied.
BThe CloudWatch IAM role does not have a trust relationship with the VPC flow logs service.
CThe VPC flow log is still in the process of being created.
DVPC flow logs cannot capture traffic from on-premises servers to a VPC. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: VPC flow logs cannot capture traffic from on-premises servers to a VPC.

SOA-C02 Question 436

Single page →

Topic 1 · Question 436

A company's SysOps administrator uses AWS IAM Identity Center (AWS Single Sign-On) to connect to an Active Directory. The SysOps administrator creates a new account that all the company's users need to access. The SysOps administrator uses the Active Directory Domain Users group for permissions to the new account because all users are already members of the group. When users try to log in, their access is denied. Which action will resolve this access issue?

ACreate a new group. Add users to the new group to provide access.
BCorrect the time on the Active Directory domain controllers.
CRemove the account. Re-add the account to the organization that is integrated with IAM Identity Center.
DCorrect the permissions on the Active Directory group so that IAM Identity Center has read access. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Correct the permissions on the Active Directory group so that IAM Identity Center has read access.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

SOA-C02 Question 437

Single page →

Topic 1 · Question 437

A SysOps administrator has an Amazon S3 website and wants to restrict access to a single Amazon CloudFront distribution. Visitors to the website should not be able to circumvent CloudFront or view the S3 website directly from the bucket. Which AWS service or feature will meet these requirements?

AS3 bucket ACL
BAWS Firewall Manager
CAmazon Route 53 private hosted zone
DOrigin access identity (OAI) (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Origin access identity (OAI).

SOA-C02 Question 438

Single page →

Topic 1 · Question 438

AS3 bucket ACL
BAWS Firewall Manager
CAmazon Route 53 private hosted zone
DOrigin access identity (OAI) (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D.

SOA-C02 Question 439

Single page →

Topic 1 · Question 439

A global company wants to allow anyone in the world to upload videos from a mobile phone. The company's mobile app uploads the videos across the public internet to an Amazon S3 bucket in the us-east-1 Region for further processing. Videos that users upload from locations that are distant from us-east-1 have slower upload speeds than videos that users upload from close to us-east-1. In many cases, the slow uploads cause users from the distant locations to cancel their uploads. Which solution will improve the upload speeds for the users from distant locations?

AEnable S3 Transfer Acceleration on the S3 bucket. Change the mobile app to use the S3 Transfer Acceleration endpoint for uploads. (correct answer)
BCreate an S3 access point for the S3 bucket in several AWS Regions across the world. Change the mobile app to use the S3 access point endpoint for uploads.
CUse S3 Select on the S3 bucket. Change the mobile app to use the S3 Select global endpoint for uploads. D. Create new public Network Load Balancers (NLBs) in several AWS Regions across the world. Specify the S3 bucket as the target of the NLBs. Change the mobile app to use the closest NLB for uploads.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Enable S3 Transfer Acceleration on the S3 bucket. Change the mobile app to use the S3 Transfer Acceleration endpoint for uploads.

Explanation

S3 Transfer Acceleration speeds up long-distance uploads to S3 over the AWS edge network. Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 440

Single page →

Topic 1 · Question 440

A company is using AWS Certificate Manager (ACM) to manage public SSL/TLS certificates. A SysOps administrator needs to send an email notification when a certificate has less than 14 days until expiration. Which solution will meet this requirement with the LEAST operational overhead?

ACreate an Amazon CloudWatch custom metric to monitor certificate expiration for all ACM certificates. Create an Amazon EventBridge rule that has an event source of aws.cloudwatch. Configure the rule to send an event to a target Amazon Simple Notification Service (Amazon SNS) topic if the DaysToExpiry metric is less than 14. Subscribe the appropriate email addresses to the SNS topic.
BCreate an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry metric for all ACM certificates. Configure the rule to send an event to a target Amazon Simple Notification Service (Amazon SNS) topic if DaysToExpiry is less than 14. Subscribe the appropriate email addresses to the SNS topic. (correct answer)
CCreate an Amazon CloudWatch dashboard that displays the DaysToExpiry metric for all ACM certificates. If DaysToExpiry is less than 14, send an email message to the appropriate email addresses. Send the email message by running a predefined CLI command to publish to an Amazon Simple Notification Service (Amazon SNS) topic.
DCreate an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry metric for all ACM certificates. Configure a target SMS identity that uses a predefined email template. Configure the rule to send an event to the target SMS identity if DaysToExpiry is less than 14.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry metric for all ACM certificates. Configure the rule to send an event to a target Amazon Simple Not...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Certificate Manager provisions and renews TLS certificates automatically.

Showing questions 421–440 of 477 · Page 22 of 24