SOA-C02 — questions

Page 13 of 24 · 477 total questions.

SOA-C02 Question 241

Topic 1 · Question 241

A company plans to migrate several of its high performance computing (HPC) virtual machines (VMs) to Amazon EC2 instances on AWS. A SysOps administrator must identify a placement group for this deployment. The strategy must minimize network latency and must maximize network throughput between the HPC VMs. Which strategy should the SysOps administrator choose to meet these requirements?

ADeploy the instances in a cluster placement group in one Availability Zone. (correct answer)
BDeploy the instances in a partition placement group in two Availability Zones.
CDeploy the instances in a partition placement group in one Availability Zone.
DDeploy the instances in a spread placement group in two Availability Zones.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Deploy the instances in a cluster placement group in one Availability Zone.

SOA-C02 Question 242

Single page →

Topic 1 · Question 242

An errant process is known to use an entire processor and run at 100%. A SysOps administrator wants to automate restarting an Amazon EC2 instance when the problem occurs for more than 2 minutes. How can this be accomplished?

ACreate an Amazon CloudWatch alarm for the EC2 instance with basic monitoring. Add an action to restart the instance.
BCreate an Amazon CloudWatch alarm for the EC2 instance with detailed monitoring. Add an action to restart the instance. (correct answer)
CCreate an AWS Lambda function to restart the EC2 instance, invoked on a scheduled basis every 2 minutes.
DCreate an AWS Lambda function to restart the EC2 instance, invoked by EC2 health checks.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create an Amazon CloudWatch alarm for the EC2 instance with detailed monitoring. Add an action to restart the instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 243

Single page →

Topic 1 · Question 243

A company maintains a large set of sensitive data in an Amazon S3 bucket. The company's security team asks a SysOps administrator to help verify that all current objects in the S3 bucket are encrypted. What is the MOST operationally efficient solution that meets these requirements?

ACreate a script that runs against the S3 bucket and outputs the status of each object.
BCreate an S3 Inventory configuration on the S3 bucket. Include the appropriate status fields. (correct answer)
CProvide the security team with an IAM user that has read access to the S3 bucket.
DUse the AWS CLI to output a list of all objects in the S3 bucket.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create an S3 Inventory configuration on the S3 bucket. Include the appropriate status fields.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 244

Single page →

Topic 1 · Question 244

Users are periodically experiencing slow response times from a relational database. The database runs on a burstable Amazon EC2 instance with a 350 GB General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volume. A SysOps administrator monitors the EC2 instance in Amazon CloudWatch and observes that the VolumeReadOps metric drops to less than 10% of its peak value during the periods of slow response. What should the SysOps administrator do to ensure consistently high performance?

AConvert the gp2 volume to a General Purpose SSD (gp3) EBS volume. (correct answer)
BConvert the gp2 volume to a Cold HDD (sc1) EBS volume.
CConvert the EC2 instance to a memory optimized instance type.
DActivate unlimited mode on the EC2 instance.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Convert the gp2 volume to a General Purpose SSD (gp3) EBS volume.

Explanation

Amazon EBS provides block storage attached to a single EC2 instance.

SOA-C02 Question 245

Single page →

Topic 1 · Question 245

A SysOps administrator is optimizing the cost of a workload. The workload is running in multiple AWS Regions and is using AWS Lambda with Amazon EC2 On-Demand Instances for the computer. The overall usage is predictable. The amount of computer that is consumed in each Region varies, depending on the users' locations. Which approach should the SysOps administrator use to optimize this workload?

APurchase Computer Savings Plans based on the usage during the past 30 days. (correct answer)
BPurchase Convertible Reserved Instances by calculating the usage baseline.
CPurchase EC2 Instance Savings Plans based on the usage during the past 30 days.
DPurchase Standard Reserved Instances by calculating the usage baseline.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Purchase Computer Savings Plans based on the usage during the past 30 days.

Explanation

Savings Plans reduce cost for consistent compute usage in exchange for a usage commitment.

SOA-C02 Question 246

Single page →

Topic 1 · Question 246

A software company runs a workload on Amazon EC2 instances behind an Application Load Balancer (ALB). A SysOps administrator needs to define a custom health check for the EC2 instances. What is the MOST operationally efficient solution?

ASet up each EC2 instance so that it writes its healthy/unhealthy status into a shared Amazon S3 bucket for the ALB to read.
BConfigure the health check on the ALB and ensure that the Health Check Path setting is correct. (correct answer)
CSet up Amazon ElastiCache to track the EC2 instances as they scale in and out.
DConfigure an Amazon API Gateway health check to ensure custom checks on all of the EC2 instances.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Configure the health check on the ALB and ensure that the Health Check Path setting is correct.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 247

Single page →

Topic 1 · Question 247

A SysOps administrator is required to monitor free space on Amazon EBS volumes attached to Microsoft Windows-based Amazon EC2 instances within a company's account. The administrator must be alerted to potential issues. What should the administrator do to receive email alerts before low storage space affects EC2 instance performance?

AUse built-in Amazon CloudWatch metrics, and configure CloudWatch alarms and an Amazon SNS topic for email notifications.
BUse AWS CloudTrail logs and configure the trail to send notifications to an Amazon SNS topic.
CUse the Amazon CloudWatch agent to send disk space metrics, then set up CloudWatch alarms using an Amazon SNS topic. (correct answer)
DUse AWS Trusted Advisor and enable email notification alerts for EC2 disk space.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Use the Amazon CloudWatch agent to send disk space metrics, then set up CloudWatch alarms using an Amazon SNS topic.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 248

Single page →

Topic 1 · Question 248

A company applies user-defined tags to resources that are associated with the company's AWS workloads. Twenty days after applying the tags, the company notices that it cannot use the tags to filter views in the AWS Cost Explorer console. What is the reason for this issue?

AIt takes at least 30 days to be able to use tags to filter views in Cost Explorer.
BThe company has not activated the user-defined tags for cost allocation. (correct answer)
CThe company has not created an AWS Cost and Usage Report.
DThe company has not created a usage budget in AWS Budgets.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: The company has not activated the user-defined tags for cost allocation.

SOA-C02 Question 249

Single page →

Topic 1 · Question 249

A company has a critical serverless application that uses multiple AWS Lambda functions. Each Lambda function generates 1 GB of log data daily in its own Amazon CloudWatch Logs log group. The company's security team asks for a count of application errors, grouped by type, across all of the log groups. What should a SysOps administrator do to meet this requirement?

APerform a CloudWatch Logs Insights query that uses the stats command and count function. (correct answer)
BPerform a CloudWatch Logs search that uses the groupby keyword and count function.
CPerform an Amazon Athena query that uses the SELECT and GROUP BY keywords.
DPerform an Amazon RDS query that uses the SELECT and GROUP BY keywords.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Perform a CloudWatch Logs Insights query that uses the stats command and count function.

Explanation

Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 250

Single page →

Topic 1 · Question 250

A company with multiple AWS accounts needs to obtain recommendations for AWS Lambda functions and identify optimal resource configurations for each Lambda function. How should a SysOps administrator provide these recommendations?

ACreate an AWS Serverless Application Repository and export the Lambda function recommendations.
BEnable AWS Compute Optimizer and export the Lambda function recommendations. (correct answer)
CEnable all features of AWS Organizations and export the recommendations from AWS CloudTrail Insights.
DRun AWS Trusted Advisor and export the Lambda function recommendations.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Enable AWS Compute Optimizer and export the Lambda function recommendations.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Compute Optimizer recommends right-sizing based on utilization.

SOA-C02 Question 251

Single page →

Topic 1 · Question 251

A company uses AWS CloudFormation templates to deploy cloud infrastructure. An analysis of all the company's templates shows that the company has declared the same components in multiple templates. A SysOps administrator needs to create dedicated templates that have their own parameters and conditions for these common components. Which solution will meet this requirement?

ADevelop a CloudFormation change set.
BDevelop CloudFormation macros.
CDevelop CloudFormation nested stacks. (correct answer)
DDevelop CloudFormation stack sets.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Develop CloudFormation nested stacks.

Explanation

AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 252

Single page →

Topic 1 · Question 252

A SysOps administrator is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units within the same company. All data must be encrypted at rest. How should the administrator implement this process?

AWrite a script to download the encrypted snapshot, decrypt it using the AWS KMS encryption key used to encrypt the snapshot, then create a new volume in each account.
BUpdate the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts. (correct answer)
CCreate an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other accounts. Require each account owner to create a new volume from that snapshot and encrypt it.
DCreate a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RDP, export the database contents into a file, then share this file with the other accounts.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Update the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SOA-C02 Question 253

Single page →

Topic 1 · Question 253

A SysOps administrator configures an Amazon S3 gateway endpoint in a VPC. The private subnets inside the VPC do not have outbound internet access. User logs in to an Amazon EC2 instance in one of the private subnets and cannot upload a file to an Amazon S3 bucket in the same AWS Region. Which solution will solve this problem?

AUpdate the EC2 instance role policy to include s3:PutObject access to the target S3 bucket.
BUpdate the EC2 security group to allow outbound traffic to 0.0.0.0/0 for port 80.
CUpdate the EC2 subnet route table to include the S3 prefix list destination routes to the S3 gateway endpoint. (correct answer)
DUpdate the S3 bucket policy to allow s3:PutObject access from the private subnet CIDR block.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Update the EC2 subnet route table to include the S3 prefix list destination routes to the S3 gateway endpoint.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 254

Single page →

Topic 1 · Question 254 · Select all that apply

A company uses Amazon S3 to aggregate raw video footage from various media teams across the US. The company recently expanded into new geographies in Europe and Australia. The technical teams located in Europe and Australia reported delays when uploading large video files into the destination S3 bucket in the United States. What are the MOST cost effective ways to increase upload speeds into the S3 bucket? (Choose two.)

ACreate multiple AWS Direct Connect connections between AWS and branch offices in Europe and Australia for file uploads into the destination S3 bucket.
BCreate multiple AWS Site-to-Site VPN connections between AWS and branch offices in Europe and Australia for file uploads into the destination S3 bucket.
CUse Amazon S3 Transfer Acceleration for file uploads into the destination S3 bucket. (correct answer)
DUse AWS Global Accelerator for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.
EUse multipart uploads for file uploads into the destination S3 bucket from the branch offices in Europe and Australia. (correct answer)

Reveal answer & explanation

Correct answer: C, E

The correct answer is C, E. Option C: Use Amazon S3 Transfer Acceleration for file uploads into the destination S3 bucket. Option E: Use multipart uploads for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.

Explanation

S3 Transfer Acceleration speeds up long-distance uploads to S3 over the AWS edge network. Amazon S3 provides durable, scalable object storage that is fully managed. This option delivers the requirement at the lowest cost.

SOA-C02 Question 255

Single page →

Topic 1 · Question 255

A SysOps administrator is helping a development team deploy an application to AWS. The AWS CloudFormation template includes an Amazon Linux EC2 instance, an Amazon Aurora DB cluster, and a hardcoded database password that must be rotated every 90 days. What is the MOST secure way to manage the database password?

AUse the AWS::SecretsManager::Secret resource with the GenerateSecretString property to automatically generate a password. Use the AWS::SecretsManager::RotationSchedule resource to define a rotation schedule for the password. Configure the application to retrieve the secret from AWS Secrets Manager to access the database. (correct answer)
BUse the AWS::SecretsManager::Secret resource with the SecretString property Accept a password as a CloudFormation parameter Use the AllowedPattern property of the CloudFormation parameter to require a minimum length, uppercase and lowercase letters, and special characters. Configure the application to retrieve the secret from AWS Secrets Manager to access the database.
CUse the AWS::SSM::Parameter resource. Accept input as a CloudFormation parameter to store the parameter as a secure string. Configure the application to retrieve the parameter from AWS Systems Manager Parameter Store to access the database.
DUse the AWS::SSM::Parameter resource. Accept input as a CloudFormation parameter to store the parameter as a string. Configure the application to retrieve the parameter from AWS Systems Manager Parameter Store to access the database.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Use the AWS::SecretsManager::Secret resource with the GenerateSecretString property to automatically generate a password. Use the AWS::SecretsManager::RotationSchedule resource to define a rotation schedule for the pa...

Explanation

AWS Secrets Manager stores and automatically rotates secrets such as database credentials. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 256

Single page →

Topic 1 · Question 256

Application A runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are in an Auto Scaling group and are in the same subnet that is associated with the NLB. Other applications from an on-premises environment cannot communicate with Application A on port 8080. To troubleshoot the issue, a SysOps administrator analyzes the flow logs. The flow logs include the following records: What is the reason for the rejected traffic?

AThe security group of the EC2 instances has no Allow rule for the traffic from the NLB.
BThe security group of the NLB has no Allow rule for the traffic from the on-premises environment.
CThe ACL of the on-premises environment does not allow traffic to the AWS environment.
DThe network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: The network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range.

SOA-C02 Question 257

Single page →

Topic 1 · Question 257

A company's SysOps administrator maintains a highly available environment. The environment includes Amazon EC2 instances and an Amazon RDS Multi-AZ database. The EC2 instances are in an Auto Scaling group behind an Application Load Balancer. Recently, the company conducted a failover test. The SysOps administrator needs to decrease the failover time of the RDS database by at least 10%. Which solution will meet this requirement?

AIncrease the RDS instance size.
BModify the RDS cluster to run in a single Availability Zone.
CCreate a read replica in another AWS Region. Promote the read replica in case of failure.
DCreate an RDS proxy. Point the application to the proxy endpoint. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create an RDS proxy. Point the application to the proxy endpoint.

Explanation

Amazon RDS Proxy pools and shares database connections to improve scalability and resilience. Amazon RDS is a managed relational database that handles patching, backups and failover. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 258

Single page →

Topic 1 · Question 258

A company's VPC has connectivity to an on-premises data center through an AWS Site-to-Site VPN. The company needs Amazon EC2 instances in the VPC to send DNS queries for example.com to the DNS servers in the data center. Which solution will meet these requirements?

ACreate an Amazon Route 53 Resolver inbound endpoint. Create a conditional forwarding rule on the on-premises DNS servers to forward DNS requests for example.com to the inbound endpoints.
BCreate an Amazon Route 53 Resolver inbound endpoint. Create a forwarding rule on the resolver that sends all queries for example.com to the on-premises DNS servers. Associate this rule with the VPC.
CCreate an Amazon Route 53 Resolver outbound endpoint. Create a conditional forwarding rule on the on-premises DNS servers to forward DNS requests for example.com to the outbound endpoints.
DCreate an Amazon Route 53 Resolver outbound endpoint. Create a forwarding rule on the resolver that sends all queries for example.com to the on-premises DNS servers. Associate this rule with the VPC. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create an Amazon Route 53 Resolver outbound endpoint. Create a forwarding rule on the resolver that sends all queries for example.com to the on-premises DNS servers. Associate this rule with the VPC.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

SOA-C02 Question 259

Single page →

Topic 1 · Question 259 · Select all that apply

A SysOps administrator is tasked with analyzing database performance. The database runs on a single Amazon RDS DB instance. The SysOps administrator finds that, during times of peak traffic, resources on the database are overutilized due to the amount of read traffic. Which actions should the SysOps administrator take to improve RDS performance? (Choose two.)

AAdd a read replica (correct answer)
BModify the application to use Amazon ElastiCache for Memcached. (correct answer)
CMigrate the database from RDS to Amazon DynamoDB.
DMigrate the database to Amazon EC2 with enhanced networking enabled.
EUpgrade the database to a Multi-AZ deployment.

Reveal answer & explanation

Correct answer: A, B

The correct answer is A, B. Option A: Add a read replica Option B: Modify the application to use Amazon ElastiCache for Memcached.

Explanation

Amazon ElastiCache provides in-memory caching (Redis/Memcached) to reduce latency and offload the database.

SOA-C02 Question 260

Single page →

Topic 1 · Question 260

A company's SysOps administrator has created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instance are encrypted with AWS managed keys. The SysOps administrator creates an Amazon Machine Image (AMI) of the custom EC2 instance and plans to share the AMI with the company's other AWS accounts. The company requires that all AMIs are encrypted with AWS Key Management Service (AWS KMS) keys and that only authorized AWS accounts can access the shared AMIs. Which solution will securely share the AMI with the other AWS accounts?

AIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.
BIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the KMS key. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with. (correct answer)
CIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the KMS key Modify the permissions on the copied AMI to make it public.
DIn the account where the AMI was created, modify the key policy of the AWS managed key to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: In the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the...

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

Showing questions 241–260 of 477 · Page 13 of 24