SOA-C02 — questions

Page 3 of 24 · 477 total questions.

SOA-C02 Question 41

Topic 1 · Question 41

A SysOps administrator has created an AWS Service Catalog portfolio and has shared the portfolio with a second AWS account in the company. The second account is controlled by a different administrator. Which action will the administrator of the second account be able to perform?

AAdd a product from the imported portfolio to a local portfolio. (correct answer)
BAdd new products to the imported portfolio.
CChange the launch role for the products contained in the imported portfolio.
DCustomize the products in the imported portfolio.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Add a product from the imported portfolio to a local portfolio.

SOA-C02 Question 42

Single page →

Topic 1 · Question 42

A company has migrated its application to AWS. The company will host the application on Amazon EC2 instances of multiple instance families. During initial testing, a SysOps administrator identifies performance issues on selected EC2 instances. The company has a strict budget allocation policy, so the SysOps administrator must use the right resource types with the performance characteristics to match the workload. What should the SysOps administrator do to meet this requirement?

APurchase regional Reserved Instances (RIs) for immediate cost savings. Review and take action on the EC2 rightsizing recommendations in Cost Explorer. Exchange the RIs for the optimal instance family after rightsizing.
BPurchase zonal Reserved Instances (RIs) for the existing instances. Monitor the RI utilization in the AWS Billing and Cost Management console. Make adjustments to instance sizes to optimize utilization.
CReview and take action on AWS Compute Optimizer recommendations. Purchase Compute Savings Plans to reduce the cost that is required to run the compute resources. (correct answer)
DReview resource utilization metrics in the AWS Cost and Usage Report. Rightsize the EC2 instances. Create On-Demand Capacity Reservations for the rightsized resources.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Review and take action on AWS Compute Optimizer recommendations. Purchase Compute Savings Plans to reduce the cost that is required to run the compute resources.

Explanation

Savings Plans reduce cost for consistent compute usage in exchange for a usage commitment. AWS Compute Optimizer recommends right-sizing based on utilization.

SOA-C02 Question 43

Single page →

Topic 1 · Question 43

A SysOps administrator is tasked with deploying a company's infrastructure as code. The SysOps administrator want to write a single template that can be reused for multiple environments. How should the SysOps administrator use AWS CloudFormation to create a solution?

AUse Amazon EC2 user data in a CloudFormation template.
BUse nested stacks to provision resources.
CUse parameters in a CloudFormation template. (correct answer)
DUse stack policies to provision resources.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Use parameters in a CloudFormation template.

Explanation

AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 44

Single page →

Topic 1 · Question 44

A SysOps administrator is responsible for a large fleet of Amazon EC2 instances and must know whether any instances will be affected by upcoming hardware maintenance. Which option would provide this information with the LEAST administrative overhead?

ADeploy a third-party monitoring solution to provide real-time EC2 instance monitoring.
BList any instances with failed system status checks using the AWS Management Console.
CMonitor AWS CloudTrail for StopInstances API calls.
DReview the AWS Personal Health Dashboard. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Review the AWS Personal Health Dashboard.

SOA-C02 Question 45

Single page →

Topic 1 · Question 45 · Select all that apply

A SysOps administrator is attempting to deploy resources by using an AWS CloudFormation template. An Amazon EC2 instance that is defined in the template fails to launch and produces an InsufficientInstanceCapacity error. Which actions should the SysOps administrator take to resolve this error? (Choose two.)

ACreate a separate AWS CloudFormation template for the EC2 instance.
BModify the AWS CloudFormation template to not specify an Availability Zone for the EC2 instance. (correct answer)
CModify the AWS CloudFormation template to use a different EC2 instance type. (correct answer)
DUse a different Amazon Machine Image (AMI) for the EC2 instance.
EUse the AWS CLI's validate-template command before creating a stack from the template.

Reveal answer & explanation

Correct answer: B, C

The correct answer is B, C. Option B: Modify the AWS CloudFormation template to not specify an Availability Zone for the EC2 instance. Option C: Modify the AWS CloudFormation template to use a different EC2 instance type.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 46

Single page →

Topic 1 · Question 46 · Select all that apply

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 to route traffic. The company also has a static website that is configured in an Amazon S3 bucket. A SysOps administrator must use the static website as a backup to the web application. The failover to the static website must be fully automated. Which combination of actions will meet these requirements? (Choose two.)

ACreate a primary failover routing policy record. Configure the value to be the ALB.
BCreate an AWS Lambda function to switch from the primary website to the secondary website when the health check fails.
CCreate a primary failover routing policy record. Configure the value to be the ALB. Associate the record with a Route 53 health check. (correct answer)
DCreate a secondary failover routing policy record. Configure the value to be the static website. Associate the record with a Route 53 health check.
ECreate a secondary failover routing policy record. Configure the value to be the static website. (correct answer)

Reveal answer & explanation

Correct answer: C, E

The correct answer is C, E. Option C: Create a primary failover routing policy record. Configure the value to be the ALB. Associate the record with a Route 53 health check. Option E: Create a secondary failover routing policy record. Configure the value to be the static website.

Explanation

Amazon EBS provides block storage attached to a single EC2 instance. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 47

Single page →

Topic 1 · Question 47

A data analytics application is running on an Amazon EC2 instance. A SysOps administrator must add custom dimensions to the metrics collected by the Amazon CloudWatch agent. How can the SysOps administrator meet this requirement?

ACreate a custom shell script to extract the dimensions and collect the metrics using the Amazon CloudWatch agent.
BCreate an Amazon EventBridge (Amazon CloudWatch Events) rule to evaluate the required custom dimensions and send the metrics to Amazon Simple Notification Service (Amazon SNS).
CCreate an AWS Lambda function to collect the metrics from AWS CloudTrail and send the metrics to an Amazon CloudWatch Logs group.
DCreate an append_dimensions field in the Amazon CloudWatch agent configuration file to collect the metrics. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create an append_dimensions field in the Amazon CloudWatch agent configuration file to collect the metrics.

Explanation

Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 48

Single page →

Topic 1 · Question 48

A company stores its data in an Amazon S3 bucket. The company is required to classify the data and find any sensitive personal information in its S3 files. Which solution will meet these requirements?

ACreate an AWS Config rule to discover sensitive personal information in the S3 files and mark them as noncompliant.
BCreate an S3 event-driven artificial intelligence/machine learning (AI/ML) pipeline to classify sensitive personal information by using Amazon Rekognition.
CEnable Amazon GuardDuty. Configure S3 protection to monitor all data inside Amazon S3.
DEnable Amazon Macie. Create a discovery job that uses the managed data identifier. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Enable Amazon Macie. Create a discovery job that uses the managed data identifier.

Explanation

Amazon Macie discovers and protects sensitive data such as PII in S3.

SOA-C02 Question 49

Single page →

Topic 1 · Question 49

A company hosts a web portal on Amazon EC2 instances. The web portal uses an Elastic Load Balancer (ELB) and Amazon Route 53 for its public DNS service. The ELB and the EC2 instances are deployed by way of a single AWS CloudFormation stack in the us-east-1 Region. The web portal must be highly available across multiple Regions. Which configuration will meet these requirements?

ADeploy a copy of the stack in the us-west-2 Region. Create a single start of authority (SOA) record in Route 53 that includes the IP address from each ELB. Configure the SOA record with health checks. Use the ELB in us-east-1 as the primary record and the ELB in us-west-2 as the secondary record.
BDeploy a copy of the stack in the us-west-2 Region. Create an additional A record in Route 53 that includes the ELB in us-west-2 as an alias target. Configure the A records with a failover routing policy and health checks. Use the ELB in us-east-1 as the primary record and the ELB in us-west-2 as the secondary record. (correct answer)
CDeploy a new group of EC2 instances in the us-west-2 Region. Associate the new EC2 instances with the existing ELB, and configure load balancer health checks on all EC2 instances. Configure the ELB to update Route 53 when EC2 instances in us-west-2 fail health checks.
DDeploy a new group of EC2 instances in the us-west-2 Region. Configure EC2 health checks on all EC2 instances in each Region. Configure a peering connection between the VPCs. Use the VPC in us-east-1 as the primary record and the VPC in us-west-2 as the secondary record.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Deploy a copy of the stack in the us-west-2 Region. Create an additional A record in Route 53 that includes the ELB in us-west-2 as an alias target. Configure the A records with a failover routing policy and health ch...

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 50

Single page →

Topic 1 · Question 50 · Select all that apply

A SysOps administrator is investigating why a user has been unable to use RDP to connect over the internet from their home computer to a bastion server running on an Amazon EC2 Windows instance. Which of the following are possible causes of this issue? (Choose two.)

AA network ACL associated with the bastion's subnet is blocking the network traffic. (correct answer)
BThe instance does not have a private IP address.
CThe route table associated with the bastion's subnet does not have a route to the internet gateway. (correct answer)
DThe security group for the instance does not have an inbound rule on port 22.
EThe security group for the instance does not have an outbound rule on port 3389.

Reveal answer & explanation

Correct answer: A, C

The correct answer is A, C. Option A: A network ACL associated with the bastion's subnet is blocking the network traffic. Option C: The route table associated with the bastion's subnet does not have a route to the internet gateway.

SOA-C02 Question 51

Single page →

Topic 1 · Question 51

A SysOps administrator is examining the following AWS CloudFormation template: Why will the stack creation fail?

AThe Outputs section of the CloudFormation template was omitted.
BThe Parameters section of the CloudFormation template was omitted.
CThe PrivateDnsName cannot be set from a CloudFormation template. (correct answer)
DThe VPC was not specified in the CloudFormation template.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: The PrivateDnsName cannot be set from a CloudFormation template.

Explanation

AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 52

Single page →

Topic 1 · Question 52 · Select all that apply

A new application runs on Amazon EC2 instances and accesses data in an Amazon RDS database instance. When fully deployed in production, the application fails. The database can be queried from a console on a bastion host. When looking at the web server logs, the following error is repeated multiple times: *** Error Establishing a Database Connection Which of the following may be causes of the connectivity problems? (Choose two.)

AThe security group for the database does not have the appropriate egress rule from the database to the web server.
BThe certificate used by the web server is not trusted by the RDS instance.
CThe security group for the database does not have the appropriate ingress rule from the web server to the database. (correct answer)
DThe port used by the application developer does not match the port specified in the RDS configuration. (correct answer)
EThe database is still being created and is not available for connectivity.

Reveal answer & explanation

Correct answer: C, D

The correct answer is C, D. Option C: The security group for the database does not have the appropriate ingress rule from the web server to the database. Option D: The port used by the application developer does not match the port specified in the RDS configuration.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 53

Single page →

Topic 1 · Question 53

A compliance team requires all administrator passwords for Amazon RDS DB instances to be changed at least annually. Which solution meets this requirement in the MOST operationally efficient manner?

AStore the database credentials in AWS Secrets Manager. Configure automatic rotation for the secret every 365 days. (correct answer)
BStore the database credentials as a parameter in the RDS parameter group. Create a database trigger to rotate the password every 365 days.
CStore the database credentials in a private Amazon S3 bucket. Schedule an AWS Lambda function to generate a new set of credentials every 365 days.
DStore the database credentials in AWS Systems Manager Parameter Store as a secure string parameter. Configure automatic rotation for the parameter every 365 days.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Store the database credentials in AWS Secrets Manager. Configure automatic rotation for the secret every 365 days.

Explanation

AWS Secrets Manager stores and automatically rotates secrets such as database credentials. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 54

Single page →

Topic 1 · Question 54

A SysOps administrator is responsible for managing a fleet of Amazon EC2 instances. These EC2 instances upload build artifacts to a third-party service. The third-party service recently implemented a strict IP allow list that requires all build uploads to come from a single IP address. What change should the systems administrator make to the existing build fleet to comply with this new requirement?

AMove all of the EC2 instances behind a NAT gateway and provide the gateway IP address to the service. (correct answer)
BMove all of the EC2 instances behind an internet gateway and provide the gateway IP address to the service.
CMove all of the EC2 instances into a single Availability Zone and provide the Availability Zone IP address to the service.
DMove all of the EC2 instances to a peered VPC and provide the VPC IP address to the service.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Move all of the EC2 instances behind a NAT gateway and provide the gateway IP address to the service.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. A NAT gateway lets private subnet resources reach the internet for outbound traffic only.

SOA-C02 Question 55

Single page →

Topic 1 · Question 55

A company uses an Amazon CloudFront distribution to deliver its website. Traffic logs for the website must be centrally stored, and all data must be encrypted at rest. Which solution will meet these requirements?

ACreate an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with internet access and server-side encryption that uses the default AWS managed customer master key (CMK). Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination.
BCreate an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with VPC access and server-side encryption that uses AES-256. Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination.
CCreate an Amazon S3 bucket that is configured with default server-side encryption that uses AES-256. Configure CloudFront to use the S3 bucket as a log destination. (correct answer)
DCreate an Amazon S3 bucket that is configured with no default encryption. Enable encryption in the CloudFront distribution, and use the S3 bucket as a log destination.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create an Amazon S3 bucket that is configured with default server-side encryption that uses AES-256. Configure CloudFront to use the S3 bucket as a log destination.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 56

Single page →

Topic 1 · Question 56

An organization created an Amazon Elastic File System (Amazon EFS) volume with a file system ID of fs-85ba41fc, and it is actively used by 10 Amazon EC2 hosts. The organization has become concerned that the file system is not encrypted. How can this be resolved?

AEnable encryption on each host's connection to the Amazon EFS volume. Each connection must be recreated for encryption to take effect.
BEnable encryption on the existing EFS volume by using the AWS Command Line Interface.
CEnable encryption on each host's local drive. Restart each host to encrypt the drive.
DEnable encryption on a newly created volume and copy all data from the original volume. Reconnect each host to the new volume. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Enable encryption on a newly created volume and copy all data from the original volume. Reconnect each host to the new volume.

SOA-C02 Question 57

Single page →

Topic 1 · Question 57

A company uses an AWS Service Catalog portfolio to create and manage resources. A SysOps administrator must create a replica of the company's existing AWS infrastructure in a new AWS account. What is the MOST operationally efficient way to meet this requirement?

ACreate an AWS CloudFormation template to use the AWS Service Catalog portfolio in the new AWS account.
BIn the new AWS account, manually create an AWS Service Catalog portfolio that duplicates the original portfolio.
CRun an AWS Lambda function to create a new AWS Service Catalog portfolio based on the output of the DescribePortfolio API operation.
DShare the AWS Service Catalog portfolio with the new AWS account. Import the portfolio into the new AWS account. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Share the AWS Service Catalog portfolio with the new AWS account. Import the portfolio into the new AWS account.

SOA-C02 Question 58

Single page →

Topic 1 · Question 58

A SysOps administrator must manage the security of an AWS account. Recently, an IAM user's access key was mistakenly uploaded to a public code repository. The SysOps administrator must identify anything that was changed by using this access key. How should the SysOps administrator meet these requirements?

ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule to send all IAM events to an AWS Lambda function for analysis.
BQuery Amazon EC2 logs by using Amazon CloudWatch Logs Insights for all events initiated with the compromised access key within the suspected timeframe.
CSearch AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe. (correct answer)
DSearch VPC Flow Logs for all events initiated with the compromised access key within the suspected timeframe.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Search AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe.

Explanation

AWS CloudTrail records API activity for auditing and governance.

SOA-C02 Question 59

Single page →

Topic 1 · Question 59 · Select all that apply

A company runs a retail website on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The company must secure traffic to the website over an HTTPS connection. Which combination of actions should a SysOps administrator take to meet these requirements? (Choose two.)

AAttach the certificate to each EC2 instance.
BAttach the certificate to the ALB. (correct answer)
CCreate a private certificate in AWS Certificate Manager (ACM).
DCreate a public certificate in AWS Certificate Manager (ACM). (correct answer)
EExport the certificate, and attach it to the website.

Reveal answer & explanation

Correct answer: B, D

The correct answer is B, D. Option B: Attach the certificate to the ALB. Option D: Create a public certificate in AWS Certificate Manager (ACM).

Explanation

AWS Certificate Manager provisions and renews TLS certificates automatically.

SOA-C02 Question 60

Single page →

Topic 1 · Question 60

SIMULATION - Instructions - If the copy-paste functionality is not working in your environment, refer to the instructions file on the VM desktop and use Ctrl+C, Ctrl+V or Command-C, Command-V. Configure Amazon EventBridge to meet the following requirements. 1. Use the us-east-2 Region for all resources. 2. Unless specified below, use the default configuration settings. 3. Use your own resource naming unless a resource name is specified below. 4. Ensure all Amazon EC2 events in the default event bus are replayable for the past 45 days. 5. Create a rule named RunFunction to send the exact message {"name":"example") every 15 minutes to an existing AWS Lambda function named LogEventFunction 6. Create a rule named SpotWarning to send a notification to a new standard Amazon SNS topic named TopicEvents whenever an Amazon EC2 Spot Instance is interrupted. Do NOT create any topic subscriptions. The notification must match the following structure: Input path: {`instance`:`detail.instance-id} Input template: `The EC2 Spot Instance <instance> has been interrupted.` Important: Click the Next button to complete this lab and continue to the next lab. Once you click the Next button, you will NOT be able to return to this lab.See explanation below.

ASee explanation above (correct answer)

Reveal answer & explanation

Correct answer: A

Refer to the exhibit image(s). The correct answer is A.

Showing questions 41–60 of 477 · Page 3 of 24