🔍

SOA-C02 — questions

Page 7 of 24 · 477 total questions.

SOA-C02 Question 121

Single page →
Topic 1 · Question 121

A development team recently deployed a new version of a web application to production. After the release, penetration testing revealed a cross-site scripting vulnerability that could expose user data. Which AWS service will mitigate this issue?

  • AAWS Shield Standard
  • BAWS WAF (correct answer)
  • CElastic Load Balancing
  • DAmazon Cognito
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: AWS WAF

Explanation

AWS WAF protects web applications from common exploits and malicious requests.

SOA-C02 Question 122

Single page →
Topic 1 · Question 122 · Select all that apply

A SysOps administrator must configure a resilient tier of Amazon EC2 instances for a high performance computing (HPC) application. The HPC application requires minimum latency between nodes. Which actions should the SysOps administrator take to meet these requirements? (Choose two.)

  • ACreate an Amazon Elastic File System (Amazon EFS) file system. Mount the file system to the EC2 instances by using user data.
  • BCreate a Multi-AZ Network Load Balancer in front of the EC2 instances.
  • CPlace the EC2 instances in an Auto Scaling group within a single subnet. (correct answer)
  • DLaunch the EC2 instances into a cluster placement group. (correct answer)
  • ELaunch the EC2 instances into a partition placement group.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Place the EC2 instances in an Auto Scaling group within a single subnet. Option D: Launch the EC2 instances into a cluster placement group.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 123

Single page →
Topic 1 · Question 123

A company’s customers are reporting increased latency while accessing static web content from Amazon S3. A SysOps administrator observed a very high rate of read operations on a particular S3 bucket. What will minimize latency by reducing load on the S3 bucket?

  • AMigrate the S3 bucket to a region that is closer to end users’ geographic locations.
  • BUse cross-region replication to replicate all of the data to another region.
  • CCreate an Amazon CloudFront distribution with the S3 bucket as the origin. (correct answer)
  • DUse Amazon ElastiCache to cache data being served from Amazon S3.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon CloudFront distribution with the S3 bucket as the origin.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SOA-C02 Question 124

Single page →
Topic 1 · Question 124

A SysOps administrator needs to develop a solution that provides email notification and inserts a record into a database every time a file is put into an Amazon S3 bucket. What is the MOST operationally efficient solution that meets these requirements?

  • ASet up an S3 event notification that targets an Amazon Simple Notification Service (Amazon SNS) topic. Create two subscriptions for the SNS topic. Use one subscription to send the email notification. Use the other subscription to invoke an AWS Lambda function that inserts the record into the database. (correct answer)
  • BSet up an Amazon CloudWatch alarm that enters ALARM state whenever an object is created in the S3 bucket. Configure the alarm to invoke an AWS Lambda function that sends the email notification and inserts the record into the database.
  • CCreate an AWS Lambda function to send the email notification and insert the record into the database whenever a new object is detected in the S3 bucket. Invoke the function every minute with an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule.
  • DSet up two S3 event notifications. Target a separate AWS Lambda function with each notification. Configure one function to send the email notification. Configure the other function to insert the record into the database.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set up an S3 event notification that targets an Amazon Simple Notification Service (Amazon SNS) topic. Create two subscriptions for the SNS topic. Use one subscription to send the email notification. Use the other sub...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers.

SOA-C02 Question 125

Single page →
Topic 1 · Question 125

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The instances are in an Amazon EC2 Auto Scaling group. The application is accessed with a public URL. A SysOps administrator needs to implement a monitoring solution that checks the availability of the application and follows the same routes and actions as a customer. The SysOps administrator must receive a notification if less than 95% of the monitoring runs find no errors. Which solution will meet these requirements?

  • ACreate an Amazon CloudWatch Synthetics canary with a script that follows customer routes. Schedule the canary to run on a recurring schedule. Create a CloudWatch alarm that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic when the SuccessPercent metric is less than 95%. (correct answer)
  • BCreate Amazon Route 53 health checks that monitor the availability of the endpoint. Create Amazon CloudWatch alarms that publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when the HealthCheckPercentageHealthy metric is less than 95%.
  • CCreate a single AWS Lambda function to check whether the endpoints are available for each customer path. Schedule the Lambda function by using Amazon EventBridge (Amazon CloudWatch Events). Configure the Lambda function to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when an endpoint returns an error.
  • DCreate an AWS Lambda function for each customer path to check whether that specific endpoint is available. Schedule the Lambda functions by using Amazon EventBridge (Amazon CloudWatch Events). Configure each Lambda function to publish a custom metric to Amazon CloudWatch for the endpoint status. Create CloudWatch alarms based on each custom metric to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when an alarm is in the ALARM state.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an Amazon CloudWatch Synthetics canary with a script that follows customer routes. Schedule the canary to run on a recurring schedule. Create a CloudWatch alarm that publishes a message to an Amazon Simple Noti...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 126

Single page →
Topic 1 · Question 126

A SysOps administrator uses AWS Systems Manager Session Manager to connect to instances. After the SysOps administrator launches a new Amazon EC2 instance, the EC2 instance does not appear in the Session Manager list of systems that are available for connection. The SysOps administrator verifies that Systems Manager Agent is installed, updated, and running on the EC2 instance. What is the reason for this issue?

  • AThe SysOps administrator does not have access to the key pair that is required for connection.
  • BThe SysOps administrator has not attached a security group to the EC2 instance to allow SSH on port 22.
  • CThe EC2 instance does not have an attached IAM role that allows Session Manager to connect to the EC2 instance. (correct answer)
  • DThe EC2 instance ID has not been entered into the Session Manager configuration.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: The EC2 instance does not have an attached IAM role that allows Session Manager to connect to the EC2 instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SOA-C02 Question 127

Single page →
Topic 1 · Question 127 · Select all that apply

A SysOps administrator is unable to launch Amazon EC2 instances into a VPC because there are no available private IPv4 addresses in the VPC. Which combination of actions must the SysOps administrator take to launch the instances? (Choose two.)

  • AAssociate a secondary IPv4 CIDR block with the VPC. (correct answer)
  • BAssociate a primary IPv6 CIDR block with the VPC.
  • CCreate a new subnet for the VPC. (correct answer)
  • DModify the CIDR block of the VPC.
  • EModify the CIDR block of the subnet that is associated with the instances.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Associate a secondary IPv4 CIDR block with the VPC. Option C: Create a new subnet for the VPC.

SOA-C02 Question 128

Single page →
Topic 1 · Question 128

A SysOps administrator is creating an Amazon EC2 Auto Scaling group in a new AWS account. After adding some instances, the SysOps administrator notices that the group has not reached the minimum number of instances. The SysOps administrator receives the following error message: Launching a new EC2 instance. Status Reason: Your quota allows for 0 more running instance(s). You requested at least 1. Launching EC2 instance failed. Which action will resolve this issue?

  • AAdjust the account spending limits for Amazon EC2 on the AWS Billing and Cost Management console.
  • BModify the EC2 quota for that AWS Region in the EC2 Settings section of the EC2 console.
  • CRequest a quota increase for the instance type family by using Service Quotas on the AWS Management Console. (correct answer)
  • DUse the Rebalance action in the Auto Scaling group on the AWS Management Console.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Request a quota increase for the instance type family by using Service Quotas on the AWS Management Console.

SOA-C02 Question 129

Single page →
Topic 1 · Question 129

A SysOps administrator is creating two AWS CloudFormation templates. The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway. The second template will deploy application resources within the VPC that was created by the first template. The second template should refer to the resources created by the first template. How can this be accomplished with the LEAST amount of administrative effort?

  • AAdd an export field to the outputs of the first template and import the values in the second template. (correct answer)
  • BCreate a custom resource that queries the stack created by the first template and retrieves the required values.
  • CCreate a mapping in the first template that is referenced by the second template.
  • DInput the names of resources in the first template and refer to those names in the second template as a parameter.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Add an export field to the outputs of the first template and import the values in the second template.

SOA-C02 Question 130

Single page →
Topic 1 · Question 130

A company runs a web application on three Amazon EC2 instances behind an Application Load Balancer (ALB). The company notices that random periods of increased traffic cause a degradation in the application’s performance. A SysOps administrator must scale the application to meet the increased traffic. Which solution meets these requirements?

  • ACreate an Amazon CloudWatch alarm to monitor application latency and increase the size of each EC2 instance if the desired threshold is reached.
  • BCreate an Amazon EventBridge (Amazon CloudWatch Events) rule to monitor application latency and add an EC2 instance to the ALB if the desired threshold is reached.
  • CDeploy the application to an Auto Scaling group of EC2 instances with a target tracking scaling policy. Attach the ALB to the Auto Scaling group. (correct answer)
  • DDeploy the application to an Auto Scaling group of EC2 instances with a scheduled scaling policy. Attach the ALB to the Auto Scaling group.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Deploy the application to an Auto Scaling group of EC2 instances with a target tracking scaling policy. Attach the ALB to the Auto Scaling group.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 131

Single page →
Topic 1 · Question 131

A company has a high-performance Windows workload. The workload requires a storage volume that provides consistent performance of 10,000 IOPS. The company does not want to pay for additional unneeded capacity to achieve this performance. Which solution will meet these requirements with the LEAST cost?

  • AUse a Provisioned IOPS SSD (io1) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10,000 provisioned IOPS.
  • BUse a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10,000 provisioned IOPS. (correct answer)
  • CUse an Amazon Elastic File System (Amazon EFS) file system in Max I/O mode.
  • DUse an Amazon FSx for Windows File Server file system that is configured with 10,000 IOPS.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10,000 provisioned IOPS.

Explanation

Amazon EBS provides block storage attached to a single EC2 instance. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SOA-C02 Question 132

Single page →
Topic 1 · Question 132

A SysOps administrator must create a solution that automatically shuts down any Amazon EC2 instances that have less than 10% average CPU utilization for 60 minutes or more. Which solution will meet this requirement in the MOST operationally efficient manner?

  • AImplement a cron job on each EC2 instance to run once every 60 minutes and calculate the current CPU utilization. Initiate an instance shutdown if CPU utilization is less than 10%.
  • BImplement an Amazon CloudWatch alarm for each EC2 instance to monitor average CPU utilization. Set the period at 1 hour, and set the threshold at 10%. Configure an EC2 action on the alarm to stop the instance. (correct answer)
  • CInstall the unified Amazon CloudWatch agent on each EC2 instance, and enable the Basic level predefined metric set. Log CPU utilization every 60 minutes, and initiate an instance shutdown if CPU utilization is less than 10%.
  • DUse AWS Systems Manager Run Command to get CPU utilization from each EC2 instance every 60 minutes. Initiate an instance shutdown if CPU utilization is less than 10%.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Implement an Amazon CloudWatch alarm for each EC2 instance to monitor average CPU utilization. Set the period at 1 hour, and set the threshold at 10%. Configure an EC2 action on the alarm to stop the instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 133

Single page →
Topic 1 · Question 133

A SysOps administrator is unable to authenticate an AWS CLI call to an AWS service. Which of the following is the cause of this issue?

  • AThe IAM password is incorrect.
  • BThe server certificate is missing.
  • CThe SSH key pair is incorrect.
  • DThere is no access key. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: There is no access key.

SOA-C02 Question 134

Single page →
Topic 1 · Question 134

A company requires that all IAM user accounts that have not been used for 90 days or more must have their access keys and passwords immediately disabled. A SysOps administrator must automate the process of disabling unused keys using the MOST operationally efficient method. How should the SysOps administrator implement this solution?

  • ACreate an AWS Step Functions workflow to identify IAM users that have not been active for 90 days. Run an AWS Lambda function when a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule is invoked to automatically remove the AWS access keys and passwords for these IAM users.
  • BConfigure an AWS Config rule to identify IAM users that have not been active for 90 days. Set up an automatic weekly batch process on an Amazon EC2 instance to disable the AWS access keys and passwords for these IAM users.
  • CDevelop and run a Python script on an Amazon EC2 instance to programmatically identify IAM users that have not been active for 90 days. Automatically delete these IAM users.
  • DSet up an AWS Config managed rule to identify IAM users that have not been active for 90 days. Set up an AWS Systems Manager automation runbook to disable the AWS access keys for these IAM users. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Set up an AWS Config managed rule to identify IAM users that have not been active for 90 days. Set up an AWS Systems Manager automation runbook to disable the AWS access keys for these IAM users.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Config tracks resource configuration changes and evaluates compliance. AWS Systems Manager operates and automates management of fleets of resources.

SOA-C02 Question 135

Single page →
Topic 1 · Question 135

A company creates custom AMI images by launching new Amazon EC2 instances from an AWS CloudFormation template. It installs and configures necessary software through AWS OpsWorks, and takes images of each EC2 instance. The process of installing and configuring software can take between 2 to 3 hours, but at times, the process stalls due to installation errors. The SysOps administrator must modify the CloudFormation template so if the process stalls, the entire stack will fail and roll back. Based on these requirements, what should be added to the template?

  • AConditions with a timeout set to 4 hours.
  • BCreationPolicy with a timeout set to 4 hours. (correct answer)
  • CDependsOn with a timeout set to 4 hours.
  • DMetadata with a timeout set to 4 hours.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: CreationPolicy with a timeout set to 4 hours.

SOA-C02 Question 136

Single page →
Topic 1 · Question 136

A company runs workloads on 90 Amazon EC2 instances in the eu-west-1 Region in an AWS account. In 2 months, the company will migrate the workloads from eu-west-1 to the eu-west-3 Region. The company needs to reduce the cost of the EC2 instances. The company is willing to make a 1-year commitment that will begin next week. The company must choose an EC2 instance purchasing option that will provide discounts for the 90 EC2 instances regardless of Region during the 1-year period. Which solution will meet these requirements?

  • APurchase EC2 Standard Reserved Instances.
  • BPurchase an EC2 Instance Savings Plan.
  • CPurchase EC2 Convertible Reserved Instances.
  • DPurchase a Compute Savings Plan. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Purchase a Compute Savings Plan.

SOA-C02 Question 137

Single page →
Topic 1 · Question 137

A SysOps administrator has created a VPC that contains a public subnet and a private subnet. Amazon EC2 instances that were launched in the private subnet cannot access the internet. The default network ACL is active on all subnets in the VPC, and all security groups allow all outbound traffic. Which solution will provide the EC2 instances in the private subnet with access to the internet?

  • ACreate a NAT gateway in the public subnet. Create a route from the private subnet to the NAT gateway. (correct answer)
  • BCreate a NAT gateway in the public subnet. Create a route from the public subnet to the NAT gateway.
  • CCreate a NAT gateway in the private subnet. Create a route from the public subnet to the NAT gateway.
  • DCreate a NAT gateway in the private subnet. Create a route from the private subnet to the NAT gateway.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a NAT gateway in the public subnet. Create a route from the private subnet to the NAT gateway.

Explanation

A NAT gateway lets private subnet resources reach the internet for outbound traffic only.

SOA-C02 Question 138

Single page →
Topic 1 · Question 138

A company plans to run a public web application on Amazon EC2 instances behind an Elastic Load Balancer (ELB). The company’s security team wants to protect the website by using AWS Certificate Manager (ACM) certificates. The ELB must automatically redirect any HTTP requests to HTTPS. Which solution will meet these requirements?

  • ACreate an Application Load Balancer that has one HTTPS listener on port 80. Attach an SSL/TLS certificate to listener port 80. Create a rule to redirect requests from HTTP to HTTPS.
  • BCreate an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443. (correct answer)
  • CCreate an Application Load Balancer that has two TCP listeners on port 80 and port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
  • DCreate a Network Load Balancer that has two TCP listeners on port 80 and port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 8...

Explanation

An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale.

SOA-C02 Question 139

Single page →
Topic 1 · Question 139

A company wants to track its AWS costs in all member accounts that are part of an organization in AWS Organizations. Managers of the member accounts want to receive a notification when the estimated costs exceed a predetermined amount each month. The managers are unable to configure a billing alarm. The IAM permissions for all users are correct. What could be the cause of this issue?

  • AThe management/payer account does not have billing alerts turned on. (correct answer)
  • BThe company has not configured AWS Resource Access Manager (AWS RAM) to share billing information between the member accounts and the management/payer account.
  • CAmazon GuardDuty is turned on for all the accounts.
  • DThe company has not configured an AWS Config rule to monitor billing.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: The management/payer account does not have billing alerts turned on.

SOA-C02 Question 140

Single page →
Topic 1 · Question 140 · Select all that apply

A company is using Amazon Elastic Container Service (Amazon ECS) to run a containerized application on Amazon EC2 instances. A SysOps administrator needs to monitor only traffic flows between the ECS tasks. Which combination of steps should the SysOps administrator take to meet this requirement? (Choose two.)

  • AConfigure Amazon CloudWatch Logs on the elastic network interface of each task.
  • BConfigure VPC Flow Logs on the elastic network interface of each task. (correct answer)
  • CSpecify the awsvpc network mode in the task definition. (correct answer)
  • DSpecify the bridge network mode in the task definition.
  • ESpecify the host network mode in the task definition.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Configure VPC Flow Logs on the elastic network interface of each task. Option C: Specify the awsvpc network mode in the task definition.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

Showing questions 121–140 of 477 · Page 7 of 24