🔍

SOA-C02 — questions

Page 18 of 24 · 477 total questions.

SOA-C02 Question 341

Single page →
Topic 1 · Question 341

A company runs a high performance computing (HPC) application on an Amazon EC2 instance. The company needs to scale this architecture to two or more EC2 instances. The EC2 instances will need to communicate with each other at high speeds with low latency to support the application. The company wants to ensure that the network performance can support the required communication between the EC2 instances What should a SysOps administrator do to meet these requirements?

  • ACreate a cluster placement group. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Restore the EC2 instance from the AMI into the placement group. Launch the additional EC2 instances into the placement group. (correct answer)
  • BBack up the existing EC2 instance to an Amazon Machine Image (AMI). Create a launch template from the existing EC2 instance by specifying the AMI. Create an Auto Scaling group and configure the desired instance count.
  • CCreate a Network Load Balancer (NLB) and a target group. Launch the new EC2 instances and register them with the target group. Register the existing EC2 instance with the target group. Pass all application traffic through the NLB.
  • DBack up the existing EC2 instance to an Amazon Machine Image (AMI). Create additional clones of the EC2 instance from the AMI in the same Availability Zone where the existing EC2 instance is located.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a cluster placement group. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Restore the EC2 instance from the AMI into the placement group. Launch the additional EC2 instances into the placem...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. This option meets the real-time / low-latency performance requirement.

SOA-C02 Question 342

Single page →
Topic 1 · Question 342

A developer creates an AWS Lambda function that runs when an object is put into an Amazon S3 bucket. The function reformats the object and places the object back into the S3 bucket. During testing, the developer notices a recursive invocation loop. The developer asks a SysOps administrator to immediately stop the recursive invocations. What should the SysOps administrator do to stop the loop without errors?

  • ADelete all the objects from the S3 bucket.
  • BSet the function’s reserved concurrency to 0. (correct answer)
  • CUpdate the S3 bucket policy to deny access for the function.
  • DPublish a new version of the function.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Set the function’s reserved concurrency to 0.

SOA-C02 Question 343

Single page →
Topic 1 · Question 343

A company has an application that runs behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon Route 53 record set contains an alias record for app.anycompany.com that references the ALB in us-west-2 and uses a simple routing policy. The application is experiencing an increase in users from other locations in the world. These users are experiencing high latency. Most of the new users are close to the ap-southeast-2 Region. The company deploys a copy of the application to ap-southeast-2. A SysOps administrator must implement a solution that automatically routes requests to the lowest latency endpoint for users without changing the URL. Which solution will meet these requirements?

  • AAdd a new value to the existing alias record for app.anycompany.com with the DNS name of the new ALB in ap-southeast-2.
  • BChange the existing alias record to use a geolocation routing policy. Create two geolocation records, one record that references each ALSelect the location that is closest to each Region.
  • CChange the existing alias record to use a latency routing policy. Create two latency records, one record that references each ALB. (correct answer)
  • DChange the existing alias record to use a multivalue routing policy Add the DNS name of each ALB to the record.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Change the existing alias record to use a latency routing policy. Create two latency records, one record that references each ALB.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover.

SOA-C02 Question 344

Single page →
Topic 1 · Question 344

A company stores files on 50 Amazon S3 buckets in the same AWS Region. The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost. Which solution will meet these requirements?

  • ACreate a gateway VPC endpoint for each S3 bucket. Attach the gateway VPC endpoints to each subnet inside the VPC.
  • BCreate an interface VPC endpoint for each S3 bucket. Attach the interface VPC endpoints to each subnet inside the VPC.
  • CCreate one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table. (correct answer)
  • DCreate one interface VPC endpoint for all the S3 buckets. Add the interface VPC endpoint to the VPC route table.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A gateway VPC endpoint gives private, no-cost access to Amazon S3 and DynamoDB from within the VPC. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

SOA-C02 Question 345

Single page →
Topic 1 · Question 345

A company's security policy states that connecting to Amazon EC2 instances is not permitted through SSH and ROP. If access is required, authorized staff can connect to instances by using AWS Systems Manager Session Manager. Users report that they are unable to connect to one specific Amazon EC2 instance that is running Ubuntu and has AWS Systems Manager Agent (SSM Agent) pre-installed. These users are able to use Session Manager to connect to other instances in the same subnet, and they are in an IAM group that has Session Manager permission for all instances. What should a SysOps administrator do to resolve this issue?

  • AAdd an inbound rule for port 22 in the security group associated with the Ubuntu instance.
  • BAssign the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile for the Ubuntu instance. (correct answer)
  • CConfigure the SSM Agent to log in with a user name of “ubuntu”.
  • DGenerate a new key pair, configure Session Manager to use this new key pair, and provide the private key to the users.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Assign the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile for the Ubuntu instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 346

Single page →
Topic 1 · Question 346

A SysOps administrator is configuring Amazon CloudWatch alarms. A particular is constantly in the ALARM state. What could be the reason for this issue?

  • AAlarms continue to evaluate metrics against configured thresholds, even after they are triggered. (correct answer)
  • BAfter alarms are triggered, they remain in the ALARM state until they are manually disabled.
  • CAfter an alarm is triggered and an action is performed, the application logic must reset the alarm to its normal state.
  • DThe alarm is not receiving appropriate metrics.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Alarms continue to evaluate metrics against configured thresholds, even after they are triggered.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 347

Single page →
Topic 1 · Question 347

A company has set up an IPsec tunnel between its AWS environment and its on-premises data center. The tunnel is reporting as UP, but the Amazon EC2 instances are not able to ping any on-premises resources. What should a SysOps administrator do to resolve this issue?

  • ACreate a new inbound rule on the EC2 instances’ security groups to allow ICMP traffic from the on-premises CIDR.
  • BCreate a peering connection between the IPsec tunnel and the subnet of the EC2 instances.
  • CEnable route propagation for the virtual private gateway in the route table that is assigned to the subnet of the EC2 instances. (correct answer)
  • DModify the VPC’s DHCP options set. Add the IPsec tunnel to the VPN section.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable route propagation for the virtual private gateway in the route table that is assigned to the subnet of the EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 348

Single page →
Topic 1 · Question 348

A company hosts a production MySQL database on an Amazon Aurora single-node DB cluster. The database is queried heavily for reporting purposes. The DB cluster is experiencing periods of performance degradation because of high CPU utilization and maximum connections errors. A SysOps administrator needs to improve the stability of the database. Which solution will meet these requirements?

  • ACreate an Aurora Replica node. Create an Auto Scaling policy to scale replicas based on CPU utilization. Ensure that all reporting requests use the read-only connection string (correct answer)
  • BCreate a second Aurora MySQL single-node DB cluster in a second Availability Zone. Ensure that all reporting requests use the connection string for this additional node
  • CCreate an AWS Lambda function that caches reporting requests. Ensure that all reporting requests call the Lambda function
  • DCreate a multi-node Amazon ElastiCache cluster. Ensure that all reporting requests use the ElastiCache cluster. Use the database if the data is not in the cache.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an Aurora Replica node. Create an Auto Scaling policy to scale replicas based on CPU utilization. Ensure that all reporting requests use the read-only connection string

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon Aurora is a high-performance managed relational database with built-in replication and failover.

SOA-C02 Question 349

Single page →
Topic 1 · Question 349

A company runs a web application that users access using the name www example com. The company manages the domain name example.com using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application through CloudFront. What is the MOST cost-effective way to achieve this?

  • ACreate a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL.
  • BCreate an ALIAS record in Amazon Route 53 that points to the CioudFront distribution URL. (correct answer)
  • CCreate an A record in Amazon Route 53 that points to the public IP address of the web application,
  • DCreate a PTR record in Amazon Route 53 that points to the public IP address of the web application.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an ALIAS record in Amazon Route 53 that points to the CioudFront distribution URL.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. This option delivers the requirement at the lowest cost.

SOA-C02 Question 350

Single page →
Topic 1 · Question 350

A company is managing multiple AWS accounts in AWS Organizations. The company is reviewing internal security of its AWS environment. The company’s security administrator has their own AWS account and wants to review the VPC configuration of developer AWS accounts. Which solution will meet these requirements in the MOST secure manner?

  • ACreate an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to an IAM user. Share the user credentials with the security administrator.
  • BCreate an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions. Assign the policy to an IAM user. Share the user credentials with the security administrator.
  • CCreate an IAM policy in each developer account that has administrator access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.
  • DCreate an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SOA-C02 Question 351

Single page →
Topic 1 · Question 351 · Select all that apply

A company wants to monitor the security groups of its Amazon EC2 instances to ensure that SSH is not open to the public. If the port is opened, the company needs to close the port as soon as possible. Which combination of actions should a SysOps administrator take to meet these requirements? (Choose two.)

  • AAdd an Amazon CloudWatch alarm to detect the security groups that allow SSH.
  • BAdd an AWS Config rule to detect the security groups that allow SSH. (correct answer)
  • CAdd an assessment template to Amazon Inspector to detect the security groups that allow SSH.
  • DCall an AWS Systems Manager Automation runbook to close the port. (correct answer)
  • ECall AWS Systems Manager Run Command to close the port.
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Add an AWS Config rule to detect the security groups that allow SSH. Option D: Call an AWS Systems Manager Automation runbook to close the port.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS Systems Manager operates and automates management of fleets of resources.

SOA-C02 Question 352

Single page →
Topic 1 · Question 352

A company runs an application on Amazon EC2 instances that are in an Amazon EC2 Auto Scaling group. Scale-out actions take a long time to become complete because of long-running boot scripts. A SysOps administrator must implement a solution to reduce the required time for scale-out actions without overprovisioning the Auto Scaling group. Which solution will meet these requirements?

  • AChange the launch configuration to use a larger instance size.
  • BIncrease the minimum number of instances in the Auto Scaling group.
  • CAdd a predictive scaling policy to the Auto Scaling group.
  • DAdd a warm pool to the Auto Scaling group. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Add a warm pool to the Auto Scaling group.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency.

SOA-C02 Question 353

Single page →
Topic 1 · Question 353

A company asks a SysOps administrator to provision an additional environment for an application in four additional AWS Regions. The application is running on more than 100 Amazon C2 instances in the us-east-1 Region, using fully configured Amazon Machine Images (AMIs). The company has an AWS CloudFormation template to deploy resources in us-east-1. What should the SysOps administrator do to provision the application in the MOST operationally efficient manner?

  • ACopy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs. (correct answer)
  • BCreate a snapshot of the running instance. Copy the snapshot to the other Regions. Create an AMI from the snapshots. Update the CloudFormation template for each Region to use the new AMI.
  • CRun the existing CloudFormation template in each additional Region based on the success of the template that is used currently in us-east-1.
  • DUpdate the CloudF ormation template to include the additional Regions in the Auto Scaling group. Update the existing stack in us-east-1.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Copy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 354

Single page →
Topic 1 · Question 354

A company runs its applications on a large number of Amazon EC2 instances. A SysOps administrator must implement a solution to notify the operations team whenever an EC2 instance state changes. What is the MOST operationally efficient solution that meets these requirements?

  • ACreate a script that captures instance state changes and publishes a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Use AWS Systems Manager Run Command to run the script on all EC2 instances.
  • BCreate an Amazon EventBridge event rule that captures EC2 instance state changes. Set an Amazon Simple Notification Service (Amazon SNS) topic as the target (correct answer)
  • CCreate an Amazon EventBridge event rule that captures EC2 instance state changes. Set as the target an AWS Lambda function that publishes a notification to an Amazon Simple Notification Service (Amazon SNS) topic.
  • DCreate an AWS Config custom rule that evaluates instance state changes with automatic remediation. Use the rule to invoke an AWS Lambda function that publishes a notification to an Amazon Simple Notification Service (Amazon SNS) topic.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Amazon EventBridge event rule that captures EC2 instance state changes. Set an Amazon Simple Notification Service (Amazon SNS) topic as the target

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SOA-C02 Question 355

Single page →
Topic 1 · Question 355 · Select all that apply

A company has migrated its legacy on-premises web application to an Amazon EC2 instance. The web application requires a single static public IP address to accept traffic and process requests. End users must be able to reach the web application through the example.com domain. A SysOps administrator must implement a solution that maintains the web application with the least amount of effort. Which combination of actions will meet these requirements? (Choose two.)

  • AConfigure an Application Load Balancer (ALB). Add the EC2 instance to a target group that is associated with the ALB.
  • BCreate an Amazon Route 53 A record for the associated EC2 IP address. (correct answer)
  • CCreate an Amazon Route 53 CNAME record for the associated EC2 IP address.
  • DCreate an Elastic IP address, and associate it with the EC2 instance. (correct answer)
  • ECreate an Auto Scaling group with a minimum capacity of 1 and a maximum capacity of 2.
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Create an Amazon Route 53 A record for the associated EC2 IP address. Option D: Create an Elastic IP address, and associate it with the EC2 instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

SOA-C02 Question 356

Single page →
Topic 1 · Question 356

A company is using an Amazon DynamoDB table for data. A SysOps administrator must configure replication of the table to another AWS Region for disaster recovery. What should the SysOps administrator do to meet this requirement?

  • AEnable DynamoDB Accelerator (DAX).
  • BEnable DynamoDB Streams, and add a global secondary index (GSI).
  • CEnable DynamoDB Streams, and add a global table Region. (correct answer)
  • DEnable point-in-time recovery.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable DynamoDB Streams, and add a global table Region.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 357

Single page →
Topic 1 · Question 357

A company has an existing public web application for www.example.com. The Application Load Balancer (ALB) is configured with a single HTTP 80 listener. A SysOps administrator must ensure that all web requests to www.example.com are encrypted between the client and the ALB. The SysOps administrator already has requested and validated a public certificate for www.example.com in AWS Certificate Manager (ACM). Existing users of the application must not be required to change the endpoint to which they are connecting. Which additional set of steps should the SysOps administrator take to meet these requirements?

  • ACreate an additional ALB listener for HTTPS on port 443. Set the default action to forward all traffic to the target group. Specify the ACM certificate that was created for www.example.com as the default SSL certificate.
  • BCreate an additional ALB listener for HTTPS on port 443. Set the default action to forward all traffic to the target group. Specify the ACM certificate that was created for www.example.com as the default SSL certificate. Delete the original HTTP listener on port 80.
  • CModify the ALB default rule for the HTTP port 80 listener. Create a rule in the listener to forward all traffic for the host www example.com to the target group. Specify the ACM certificate that was created for www.example.com as the default SSL certificate.
  • DModify the ALB default rule for the HTTP port 80 listener to redirect to HTTPS on port 443. Create an additional HTTPS listener on port 443. Set the default action to forward all traffic to the target group. Specify the ACM certificate that was created for www example.com as the default SSL certificate. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Modify the ALB default rule for the HTTP port 80 listener to redirect to HTTPS on port 443. Create an additional HTTPS listener on port 443. Set the default action to forward all traffic to the target group. Specify t...

Explanation

AWS Certificate Manager provisions and renews TLS certificates automatically.

SOA-C02 Question 358

Single page →
Topic 1 · Question 358

A company runs its entire suite of applications on Amazon EC2 instances. The company plans to move the applications to containers and AWS Fargate. Within 6 months, the company plans to retire its EC2 instances and use only Fargate. The company has been able to estimate its future Fargate costs. A SysOps administrator needs to choose a purchasing option to help the company minimize costs. The SysOps administrator must maximize any discounts that are available and must ensure that there are no unused reservations. Which purchasing option will meet these requirements?

  • ACompute Savings Plans for 1 year with the No Upfront payment option
  • BCompute Savings Plans for 1 year with the Partial Upfront payment option (correct answer)
  • CEC2 Instance Savings Plans for 1 year with the All Upfront payment option
  • DEC2 Reserved Instances for 1 year with the Partial Upfront payment option
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Compute Savings Plans for 1 year with the Partial Upfront payment option

Explanation

Savings Plans reduce cost for consistent compute usage in exchange for a usage commitment. This option delivers the requirement at the lowest cost.

SOA-C02 Question 359

Single page →
Topic 1 · Question 359

A manufacturing company uses an Amazon RDS DB instance to store inventory of all stock items. The company maintains several AWS Lambda functions that interact with the database to add, update, and delete items. The Lambda functions use hardcoded credentials to connect to the database. A SysOps administrator must ensure that the database credentials are never stored in plaintext and that the password is rotated every 30 days. Which solution will meet these requirements in the MOST operationally efficient manner?

  • AStore the database password as an environment variable for each Lambda function. Create a new Lambda function that is named PasswordRotate. Use Amazon EventBridge to schedule the PasswordRotate function every 30 days to change the database password and update the environment variable for each Lambda function.
  • BUse AWS Key Management Service (AWS KMS) to encrypt the database password and to store the encrypted password as an environment variable for each Lambda function. Grant each Lambda function access to the KMS key so that the database password can be decrypted when required. Create a new Lambda function that is named PasswordRotate to change the password every 30 days.
  • CUse AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from Secrets Manager. (correct answer)
  • DUse AWS Systems Manager Parameter Store to create a secure string to store credentials for the database. Create a new Lambda function called PasswordRotate. Use Amazon EventBridge to schedule the PasswordRotate function every 30 days to change the database password and to update the secret within Parameter Store. Update each Lambda function to access the database password from Parameter Store.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically....

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

SOA-C02 Question 360

Single page →
Topic 1 · Question 360

A developer creates a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The developer reviews the deployment and notices some suspicious traffic to the application. The traffic is malicious and is coming from a single public IP address. A SysOps administrator must block the public IP address. Which solution will meet this requirement?

  • ACreate a security group rule to deny all inbound traffic from the suspicious IP address. Associate the security group with the ALB.
  • BImplement Amazon Detective to monitor traffic and to block malicious activity from the internet. Configure Detective to integrate with the ALB.
  • CImplement AWS Resource Access Manager (AWS RAM) to manage traffic rules and to block malicious activity from the internet. Associate AWS RAM with the ALB.
  • DAdd the malicious IP address to an IP set in AWS WAF. Create a web ACL. Include an IP set rule with the action set to BLOCK. Associate the web ACL with the ALB. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Add the malicious IP address to an IP set in AWS WAF. Create a web ACL. Include an IP set rule with the action set to BLOCK. Associate the web ACL with the ALB.

Explanation

AWS WAF protects web applications from common exploits and malicious requests.

Showing questions 341–360 of 477 · Page 18 of 24