🔍

SOA-C02 — questions

Page 11 of 24 · 477 total questions.

Topic 1 · Question 201

A company’s web application is available through an Amazon CloudFront distribution and directly through an internet-facing Application Load Balancer (ALB). A SysOps administrator must make the application accessible only through the CloudFront distribution and not directly through the ALB. The SysOps administrator must make this change without changing the application code. Which solution will meet these requirements?

  • AModify the ALB type to internal. Set the distribution’s origin to the internal ALB domain name.
  • BCreate a Lambda@Edge function. Configure the function to compare a custom header value in the request with a stored password and to forward the request to the origin in case of a match. Associate the function with the distribution.
  • CReplace the ALB with a new internal ALB. Set the distribution’s origin to the internal ALB domain name. Add a custom HTTP header to the origin settings for the distribution. In the ALB listener, add a rule to forward requests that contain the matching custom header and the header’s value. Add a default rule to return a fixed response code of 403.
  • DAdd a custom HTTP header to the origin settings for the distribution. In the ALB listener, add a rule to forward requests that contain the matching custom header and the header’s value. Add a default rule to return a fixed response code of 403. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Add a custom HTTP header to the origin settings for the distribution. In the ALB listener, add a rule to forward requests that contain the matching custom header and the header’s value. Add a default rule to return a... This option needs the least custom development effort.

Topic 1 · Question 202

A company runs several workloads on AWS. The company identifies five AWS Trusted Advisor service quota metrics to monitor in a specific AWS Region. The company wants to receive email notification each time resource usage exceeds 60% of one of the service quotas. Which solution will meet these requirements?

  • ACreate five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of one of the service quotas. (correct answer)
  • BCreate five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification each time that usage exceeds 60% of one of the service quotas.
  • CUse the AWS Service Health Dashboard to monitor each Trusted Advisor service quota metric. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification each time that usage exceeds 60% of one of the service quotas.
  • DUse the AWS Service Health Dashboard to monitor each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of one of the service quotas.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of on...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 · Question 203

A company needs to implement a managed file system to host Windows file shares for users on premises. Resources in the AWS Cloud also need access to the data on these file shares. A SysOps administrator needs to present the user file shares on premises and make the user file shares available on AWS with minimum latency. What should the SysOps administrator do to meet these requirements?

  • ASet up an Amazon S3 File Gateway.
  • BSet up an AWS Direct Connect connection.
  • CUse AWS DataSync to automate data transfers between the existing file servers and AWS.
  • DSet up an Amazon FSx File Gateway. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Set up an Amazon FSx File Gateway.

Explanation

Amazon FSx provides fully managed third-party file systems.

Topic 1 · Question 204

A company is hosting applications on Amazon EC2 instances. The company is hosting a database on an Amazon RDS for PostgreSQL DB instance. The company requires all connections to the DB instance to be encrypted. What should a SysOps administrator do to meet this requirement?

  • AAllow SSL connections to the database by using an inbound security group rule.
  • BEncrypt the database by using an AWS Key Management Service (AWS KMS) encryption key.
  • CEnforce SSL connections to the database by using a custom parameter group. (correct answer)
  • DPatch the database with SSL/TLS by using a custom PostgreSQL extension.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enforce SSL connections to the database by using a custom parameter group.

Topic 1 · Question 205

A company recently purchased Savings Plans. The company wants to receive email notification when the company’s utilization drops below 90% for a given day. Which solution will meet this requirement?

  • ACreate an Amazon CloudWatch alarm to monitor the Savings Plan check in AWS Trusted Advisor. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification when the utilization drops below 90% for a given day.
  • BCreate an Amazon CloudWatch alarm to monitor the SavingsPlansUtilization metric under the AWS/SavingsPlans namespace in CloudWatch. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification when the utilization drops below 90% for a given day.
  • CCreate a Savings Plans alert to monitor the daily utilization of the Savings Plans. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification when the utilization drops below 90% for a given day.
  • DUse AWS Budgets to create a Savings Plans budget to track the daily utilization of the Savings Plans. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification when the utilization drops below 90% for a given day. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Budgets to create a Savings Plans budget to track the daily utilization of the Savings Plans. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification when the utilization drop...

Explanation

Savings Plans reduce cost for consistent compute usage in exchange for a usage commitment. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 · Question 206

A company uses an Amazon Simple Queue Service (Amazon SQS) standard queue with its application. The application sends messages to the queue with unique message bodies. The company decides to switch to an SQS FIFO queue. What must the company do to migrate to an SQS FIFO queue?

  • ACreate a new SQS FIFO queue. Turn on content-based deduplication on the new FIFO queue. Update the application to include a message group ID in the messages. (correct answer)
  • BCreate a new SQS FIFO queue. Update the application to include the DelaySeconds parameter in the messages.
  • CModify the queue type from SQS standard to SQS FIFO. Turn off content-based deduplication on the queue. Update the application to include a message group ID in the messages.
  • DModify the queue type from SQS standard to SQS FIFO. Update the application to send messages with identical message bodies and to include the DelaySeconds parameter in the messages.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a new SQS FIFO queue. Turn on content-based deduplication on the new FIFO queue. Update the application to include a message group ID in the messages.

Explanation

Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes.

Topic 1 · Question 207 · Select all that apply

A company’s SysOps administrator must ensure that all Amazon EC2 Windows instances that are launched in an AWS account have a third-party agent installed. The third-party agent has an .msi package. The company uses AWS Systems Manager for patching, and the Windows instances are tagged appropriately. The third-party agent requires periodic updates as new versions are released. The SysOps administrator must deploy these updates automatically. Which combination of steps will meet these requirements with the LEAST operational effort? (Choose two.)

  • ACreate a Systems Manager Distributor package for the third-party agent. (correct answer)
  • BMake sure that Systems Manager Inventory is configured. If Systems Manager Inventory is not configured, set up a new inventory for instances that is based on the appropriate tag value for Windows.
  • CCreate a Systems Manager State Manager association to run the AWS-RunRemoteScript document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windows with a schedule of 1 day.
  • DCreate a Systems Manager State Manager association to run the AWS-ConfigureAWSPackage document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windows with a schedule of 1 day. (correct answer)
  • ECreate a Systems Manager OpsItem with the tag value for Windows. Attach the Systems Manager Distributor package to the OpsItem. Create a maintenance window that is specific to the package deployment. Configure the maintenance window to cover 24 hours a day.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Create a Systems Manager Distributor package for the third-party agent. Option D: Create a Systems Manager State Manager association to run the AWS-ConfigureAWSPackage document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windo...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS Systems Manager operates and automates management of fleets of resources.

Topic 1 · Question 208

A company runs hundreds of Amazon EC2 instances in a single AWS Region. Each EC2 instance has two attached 1 GiB General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volumes. A critical workload is using all the available IOPS capacity on the EBS volumes. According to company policy, the company cannot change instance types or EBS volume types without completing lengthy acceptance tests to validate that the company’s applications will function properly. A SysOps administrator needs to increase the I/O performance of the EBS volumes as quickly as possible. Which action should the SysOps administrator take to meet these requirements?

  • AIncrease the size of the 1 GiB EBS volumes. (correct answer)
  • BAdd two additional elastic network interfaces on each EC2 instance.
  • CTurn on Transfer Acceleration on the EBS volumes in the Region.
  • DAdd all the EC2 instances to a cluster placement group.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Increase the size of the 1 GiB EBS volumes.

Explanation

Amazon EBS provides block storage attached to a single EC2 instance.

Topic 1 · Question 209

A company needs to deploy a new workload on AWS. The company must encrypt all data at rest and must rotate the encryption keys once each year. The workload uses an Amazon RDS for MySQL Multi-AZ database for data storage. Which configuration approach will meet these requirements?

  • AEnable Transparent Data Encryption (TDE) in the MySQL configuration file. Manually rotate the key every 12 months.
  • BEnable RDS encryption on the database at creation time by using the AWS managed key for Amazon RDS.
  • CCreate a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable RDS encryption on the database at creation time by using the KMS key. (correct answer)
  • DCreate a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the RDS DB instance.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable RDS encryption on the database at creation time by using the KMS key.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Topic 1 · Question 210

A company has an application that is deployed to two AWS Regions in an active-passive configuration. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in each Region. The instances are in an Amazon EC2 Auto Scaling group in each Region. The application uses an Amazon Route 53 hosted zone for DNS. A SysOps administrator needs to configure automatic failover to the secondary Region. What should the SysOps administrator do to meet these requirements?

  • AConfigure Route 53 alias records that point to each ALB. Choose a failover routing policy. Set Evaluate Target Health to Yes. (correct answer)
  • BConfigure CNAME records that point to each ALChoose a failover routing policy. Set Evaluate Target Health to Yes.
  • CConfigure Elastic Load Balancing (ELB) health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.
  • DConfigure EC2 health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure Route 53 alias records that point to each ALB. Choose a failover routing policy. Set Evaluate Target Health to Yes.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 · Question 211

A company is implementing a monitoring solution that is based on machine learning. The monitoring solution consumes Amazon EventBridge (Amazon CloudWatch Events) events that are generated by Amazon EC2 Auto Scaling. The monitoring solution provides detection of anomalous behavior such as unanticipated scaling events and is configured as an EventBridge (CloudWatch Events) API destination. During initial testing, the company discovers that the monitoring solution is not receiving events. However, Amazon CloudWatch is showing that the EventBridge (CloudWatch Events) rule is being invoked. A SysOps administrator must implement a solution to retrieve client error details to help resolve this issue. Which solution will meet these requirements with the LEAST operational effort?

  • ACreate an EventBridge (CloudWatch Events) archive for the event pattern to replay the events. Increase the logging on the monitoring solution. Use replay to invoke the monitoring solution. Examine the error details. (correct answer)
  • BAdd an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue for the target. Process the messages in the dead-letter queue to retrieve error details.
  • CCreate a second EventBridge (CloudWatch Events) rule for the same event pattern to target an AWS Lambda function. Configure the Lambda function to invoke the monitoring solution and to record the results to Amazon CloudWatch Logs. Examine the errors in the logs.
  • DConfigure the EventBridge (CloudWatch Events) rule to send error messages to an Amazon Simple Notification Service (Amazon SNS) topic.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an EventBridge (CloudWatch Events) archive for the event pattern to replay the events. Increase the logging on the monitoring solution. Use replay to invoke the monitoring solution. Examine the error details.

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

Topic 1 · Question 212

A company is storing backups in an Amazon S3 bucket. The backups must not be deleted for at least 3 months after the backups are created. What should a SysOps administrator do to meet this requirement?

  • AConfigure an IAM policy that denies the s3:DeleteObject action for all users. Three months after an object is written, remove the policy.
  • BEnable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months. (correct answer)
  • CEnable S3 Versioning on the existing S3 bucket. Configure S3 Lifecycle rules to protect the backups.
  • DEnable S3 Object Lock on a new S3 bucket in governance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Backup centrally automates and manages backups across AWS services.

Topic 1 · Question 213

A SysOps administrator needs to track the costs of data transfer between AWS Regions. The SysOps administrator must implement a solution to send alerts to an email distribution list when transfer costs reach 75% of a specific threshold. What should the SysOps administrator do to meet these requirements?

  • ACreate an AWS Cost and Usage Report. Analyze the results in Amazon Athena. Configure an alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when costs reach 75% of the threshold. Subscribe the email distribution list to the topic.
  • BCreate an Amazon CloudWatch billing alarm to detect when costs reach 75% of the threshold. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email distribution list to the topic.
  • CUse AWS Budgets to create a cost budget for data transfer costs. Set an alert at 75% of the budgeted amount. Configure the budget to send a notification to the email distribution list when costs reach 75% of the threshold. (correct answer)
  • DSet up a VPC flow log. Set up a subscription filter to an AWS Lambda function to analyze data transfer. Configure the Lambda function to send a notification to the email distribution list when costs reach 75% of the threshold.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use AWS Budgets to create a cost budget for data transfer costs. Set an alert at 75% of the budgeted amount. Configure the budget to send a notification to the email distribution list when costs reach 75% of the thres...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS Budgets alerts on cost and usage thresholds.

Topic 1 · Question 214

A company needs to archive all audit logs for 10 years. The company must protect the logs from any future edits. Which solution will meet these requirements?

  • AStore the data in an Amazon Elastic Block Store (Amazon EBS) volume. Configure AWS Key Management Service (AWS KMS) encryption.
  • BStore the data in an Amazon S3 Glacier vault. Configure a vault lock policy for write-once, read-many (WORM) access. (correct answer)
  • CStore the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Configure server-side encryption.
  • DStore the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Configure multi-factor authentication (MFA).
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Store the data in an Amazon S3 Glacier vault. Configure a vault lock policy for write-once, read-many (WORM) access.

Explanation

Amazon S3 Glacier offers low-cost archival storage for infrequently accessed data. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 · Question 215

A company’s AWS Lambda function is experiencing performance issues. The Lambda function performs many CPU-intensive operations. The Lambda function is not running fast enough and is creating bottlenecks in the system. What should a SysOps administrator do to resolve this issue?

  • AIn the CPU launch options for the Lambda function, activate hyperthreading.
  • BTurn off the AWS managed encryption.
  • CIncrease the amount of memory for the Lambda function. (correct answer)
  • DLoad the required code into a custom layer.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Increase the amount of memory for the Lambda function.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead.

Topic 1 · Question 216

A company hosts a web application on an Amazon EC2 instance. The web server logs are published to Amazon CloudWatch Logs. The log events have the same structure and include the HTTP response codes that are associated with the user requests. The company needs to monitor the number of times that the web server returns an HTTP 404 response. What is the MOST operationally efficient solution that meets these requirements?

  • ACreate a CloudWatch Logs metric filter that counts the number of times that the web server returns an HTTP 404 response. (correct answer)
  • BCreate a CloudWatch Logs subscription filter that counts the number of times that the web server returns an HTTP 404 response.
  • CCreate an AWS Lambda function that runs a CloudWatch Logs Insights query that counts the number of 404 codes in the log events during the past hour.
  • DCreate a script that runs a CloudWatch Logs Insights query that counts the number of 404 codes in the log events during the past hour.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a CloudWatch Logs metric filter that counts the number of times that the web server returns an HTTP 404 response.

Explanation

Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

Topic 1 · Question 217

A company is attempting to manage its costs in the AWS Cloud. A SysOps administrator needs specific company-defined tags that are assigned to resources to appear on the billing report. What should the SysOps administrator do to meet this requirement?

  • AActivate the tags as AWS generated cost allocation tags.
  • BActivate the tags as user-defined cost allocation tags. (correct answer)
  • CCreate a new cost category. Select the account billing dimension.
  • DCreate a new AWS Cost and Usage Report. Include the resource IDs.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Activate the tags as user-defined cost allocation tags.

Topic 1 · Question 218

A company is expanding globally and needs to back up data on Amazon Elastic Block Store (Amazon EBS) volumes to a different AWS Region. Most of the EBS volumes that store the data are encrypted, but some of the EBS volumes are unencrypted. The company needs the backup data from all the EBS volumes to be encrypted. Which solution will meet these requirements with the LEAST management overhead?

  • AConfigure a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM) to create the EBS volume snapshots with cross-Region backups enabled. Encrypt the snapshot copies by using AWS Key Management Service (AWS KMS). (correct answer)
  • BCreate a point-in-time snapshot of the EBS volumes. When the snapshot status is COMPLETED, copy the snapshots to another Region and set the Encrypted parameter to False.
  • CCreate a point-in-time snapshot of the EBS volumes. Copy the snapshots to an Amazon S3 bucket that uses server-side encryption. Turn on S3 Cross-Region Replication on the S3 bucket.
  • DSchedule an AWS Lambda function with the Python runtime. Configure the Lambda function to create the EBS volume snapshots, encrypt the unencrypted snapshots, and copy the snapshots to another Region.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM) to create the EBS volume snapshots with cross-Region backups enabled. Encrypt the snapshot copies by using AWS Key Management Service (AWS KMS).

Explanation

Amazon EBS provides block storage attached to a single EC2 instance. AWS Backup centrally automates and manages backups across AWS services. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

Topic 1 · Question 219

A SysOps administrator creates an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that uses AWS Fargate. The cluster is deployed successfully. The SysOps administrator needs to manage the cluster by using the kubectl command line tool. Which of the following must be configured on the SysOps administrator’s machine so that kubectl can communicate with the cluster API server?

  • AThe kubeconfig file (correct answer)
  • BThe kube-proxy Amazon EKS add-on
  • CThe Fargate profile
  • DThe eks-connector.yaml file
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: The kubeconfig file

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 · Question 220

A company wants to collect data from an application to use for analytics. For the first 90 days, the data will be infrequently accessed but must remain highly available. During this time, the company’s analytics team requires access to the data in milliseconds. However, after 90 days, the company must retain the data for the long term at a lower cost. The retrieval time after 90 days must be less than 5 hours. Which solution will meet these requirements MOST cost-effectively?

  • AStore the data in S3 Standard-Infrequent Access (S3 Standard-IA) for the first 90 days. Set up an S3 Lifecycle rule to move the data to S3 Glacier Flexible Retrieval after 90 days. (correct answer)
  • BStore the data in S3 One Zone-Infrequent Access (S3 One Zone-IA) for the first 90 days. Set up an S3 Lifecycle rule to move the data to S3 Glacier Deep Archive after 90 days.
  • CStore the data in S3 Standard for the first 90 days. Set up an S3 Lifecycle rule to move the data to S3 Glacier Flexible Retrieval after 90 days.
  • DStore the data in S3 Standard for the first 90 days. Set up an S3 Lifecycle rule to move the data to S3 Glacier Deep Archive after 90 days.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Store the data in S3 Standard-Infrequent Access (S3 Standard-IA) for the first 90 days. Set up an S3 Lifecycle rule to move the data to S3 Glacier Flexible Retrieval after 90 days.

Explanation

Amazon S3 Glacier offers low-cost archival storage for infrequently accessed data. S3 Standard-IA reduces cost for infrequently accessed data that still needs high availability. S3 Lifecycle policies automatically transition or expire objects to control storage cost. This option delivers the requirement at the lowest cost.

Showing questions 201220 of 477 · Page 11 of 24