🔍

SOA-C02 — questions

Page 4 of 24 · 477 total questions.

SOA-C02 Question 61

Single page →
Topic 1 · Question 61

A company has a stateful, long-running workload on a single xlarge general purpose Amazon EC2 On-Demand Instance Metrics show that the service is always using 80% of its available memory and 40% of its available CPU. A SysOps administrator must reduce the cost of the service without negatively affecting performance. Which change in instance type will meet these requirements?

  • AChange to one large compute optimized On-Demand Instance.
  • BChange to one large memory optimized On-Demand Instance. (correct answer)
  • CChange to one xlarge general purpose Spot Instance.
  • DChange to two large general purpose On-Demand Instances.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Change to one large memory optimized On-Demand Instance.

SOA-C02 Question 62

Single page →
Topic 1 · Question 62

A company asks a SysOps administrator to ensure that AWS CloudTrail files are not tampered with after they are created. Currently, the company uses AWS Identity and Access Management (IAM) to restrict access to specific trails. The company's security team needs the ability to trace the integrity of each file. What is the MOST operationally efficient solution that meets these requirements?

  • ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule that invokes an AWS Lambda function when a new file is delivered. Configure the Lambda function to compute an MD5 hash check on the file and store the result in an Amazon DynamoDB table. The security team can use the values that are stored in DynamoDB to verify the integrity of the delivered files.
  • BCreate an AWS Lambda function that is invoked each time a new file is delivered to the CloudTrail bucket. Configure the Lambda function to compute an MD5 hash check on the file and store the result as a tag in an Amazon 53 object. The security team can use the information in the tag to verify the integrity of the delivered files.
  • CEnable the CloudTrail file integrity feature on an Amazon S3 bucket. Create an IAM policy that grants the security team access to the file integrity logs that are stored in the S3 bucket.
  • DEnable the CloudTrail file integrity feature on the trail. The security team can use the digest file that is created by CloudTrail to verify the integrity of the delivered files. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable the CloudTrail file integrity feature on the trail. The security team can use the digest file that is created by CloudTrail to verify the integrity of the delivered files.

Explanation

AWS CloudTrail records API activity for auditing and governance.

SOA-C02 Question 63

Single page →
Topic 1 · Question 63

When the AWS Cloud infrastructure experiences an event that may impact an organization, which AWS service can be used to see which of the organization's resources are affected?

  • AAWS Service Health Dashboard
  • BAWS Trusted Advisor
  • CAWS Personal Health Dashboard (correct answer)
  • DAWS Systems Manager
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: AWS Personal Health Dashboard.

SOA-C02 Question 64

Single page →
Topic 1 · Question 64

A company is using an AWS KMS customer master key (CMK) with imported key material. The company references the CMK by its alias in the Java application to encrypt data. The CMK must be rotated every 6 months. What is the process to rotate the key?

  • AEnable automatic key rotation for the CMK, and specify a period of 6 months.
  • BCreate a new CMK with new imported material, and update the key alias to point to the new CMK. (correct answer)
  • CDelete the current key material, and import new material into the existing CMK.
  • DImport a copy of the existing key material into a new CMK as a backup, and set the rotation schedule for 6 months.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a new CMK with new imported material, and update the key alias to point to the new CMK.

SOA-C02 Question 65

Single page →
Topic 1 · Question 65

The security team is concerned because the number of AWS Identity and Access Management (IAM) policies being used in the environment is increasing. The team tasked a SysOps administrator to report on the current number of IAM policies in use and the total available IAM policies. Which AWS service should the administrator use to check how current IAM policy usage compares to current service limits?

  • AAWS Trusted Advisor (correct answer)
  • BAmazon Inspector
  • CAWS Config
  • DAWS Organizations
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: AWS Trusted Advisor

Explanation

AWS Trusted Advisor recommends cost, performance and security optimizations.

SOA-C02 Question 66

Single page →
Topic 1 · Question 66

A SysOps administrator is trying to set up an Amazon Route 53 domain name to route traffic to a website hosted on Amazon S3. The domain name of the website is www.example.com and the S3 bucket name DOC-EXAMPLE-BUCKET. After the record set is set up in Route 53, the domain name www.anycompany.com does not seem to work, and the static website is not displayed in the browser. Which of the following is a cause of this?

  • AThe S3 bucket must be configured with Amazon CloudFront first.
  • BThe Route 53 record set must have an IAM role that allows access to the S3 bucket.
  • CThe Route 53 record set must be in the same region as the S3 bucket.
  • DThe S3 bucket name must match the record set name in Route 53. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: The S3 bucket name must match the record set name in Route 53.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

SOA-C02 Question 67

Single page →
Topic 1 · Question 67

A SysOps administrator has used AWS CloudFormation to deploy a serverless application into a production VPC. The application consists of an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway API. The SysOps administrator must delete the AWS CloudFormation stack without deleting the DynamoDB table. Which action should the SysOps administrator take before deleting the AWS CloudFormation stack?

  • AAdd a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack. (correct answer)
  • BAdd a Snapshot deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
  • CEnable termination protection on the AWS CloudFormation stack.
  • DUpdate the application's IAM policy with a Deny statement for the dynamodb:DeleteTable action.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Add a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 68

Single page →
Topic 1 · Question 68

A SysOps administrator is notified that an Amazon EC2 instance has stopped responding. The AWS Management Console indicates that the system checks are failing. What should the administrator do first to resolve this issue?

  • AReboot the EC2 instance so it can be launched on a new host.
  • BStop and then start the EC2 instance so that it can be launched on a new host. (correct answer)
  • CTerminate the EC2 instance and relaunch it.
  • DView the AWS CloudTrail log to investigate what changed on the EC2 instance.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Stop and then start the EC2 instance so that it can be launched on a new host.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 69

Single page →
Topic 1 · Question 69

A software development company has multiple developers who work on the same product. Each developer must have their own development environments, and these development environments must be identical. Each development environment consists of Amazon EC2 instances and an Amazon RDS DB instance. The development environments should be created only when necessary, and they must be terminated each night to minimize costs. What is the MOST operationally efficient solution that meets these requirements?

  • AProvide developers with access to the same AWS CloudFormation template so that they can provision their development environment when necessary. Schedule a nightly cron job on each development instance to stop all running processes to reduce CPU utilization to nearly zero.
  • BProvide developers with access to the same AWS CloudFormation template so that they can provision their development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to delete the AWS CloudFormation stacks. (correct answer)
  • CProvide developers with CLI commands so that they can provision their own development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to terminate all EC2 instances and the DB instance.
  • DProvide developers with CLI commands so that they can provision their own development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to cause AWS CloudFormation to delete all of the development environment resources.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Provide developers with access to the same AWS CloudFormation template so that they can provision their development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. This option delivers the requirement at the lowest cost.

SOA-C02 Question 70

Single page →
Topic 1 · Question 70

A company is partnering with an external vendor to provide data processing services. For this integration, the vendor must host the company's data in an Amazon S3 bucket in the vendor's AWS account. The vendor is allowing the company to provide an AWS Key Management Service (AWS KMS) key to encrypt the company's data. The vendor has provided an IAM role Amazon Resources Name (ARN) to the company for this integration. What should a SysOps administrator do to configure this integration?

  • ACreate a new KMS key. Add the vendor's IAM role ARN to the KMS key policy. Provide the new KMS key ARN to the vendor. (correct answer)
  • BCreate a new KMS key. Create a new IAM key. Add the vendor's IAM role ARN to an inline policy that is attached to the IAM user. Provide the new IAM user ARN to the vendor.
  • CConfigure encryption using the KMS managed S3 key. Add the vendor's IAM role ARN to the KMS key policy. Provide the KMS managed S3 key ARN to the vendor.
  • DConfigure encryption using the KMS managed S3 key. Create an S3 bucket. Add the vendor's IAM role ARN to the S3 bucket policy. Provide the S3 bucket ARN to the vendor.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a new KMS key. Add the vendor's IAM role ARN to the KMS key policy. Provide the new KMS key ARN to the vendor.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SOA-C02 Question 71

Single page →
Topic 1 · Question 71

A SysOps administrator is using AWS Systems Manager Patch Manager to patch a fleet of Amazon EC2 instances. The SysOps administrator has configured a patch baseline and a maintenance window. The SysOps administrator also has used an instance tag to identify which instances to patch. The SysOps administrator must give Systems Manager the ability to access the EC2 instances. Which additional action must the SysOps administrator perform to meet this requirement?

  • AAdd an inbound rule to the instances' security group.
  • BAttach an IAM instance profile with access to Systems Manager to the instances. (correct answer)
  • CCreate a Systems Manager activation. Then activate the fleet of instances.
  • DManually specify the instances to patch instead of using tag-based selection.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Attach an IAM instance profile with access to Systems Manager to the instances.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Systems Manager operates and automates management of fleets of resources.

SOA-C02 Question 72

Single page →
Topic 1 · Question 72

A company hosts its website on Amazon EC2 instances in the us-east-1 Region. The company is preparing to extend its website into the eu-central-1 Region, but the database must remain only in us-east-1. After deployment, the EC2 instances in eu-central-1 are unable to connect to the database in us-east-1. What is the MOST operationally efficient solution that will resolve this connectivity issue?

  • ACreate a VPC peering connection between the two Regions. Add the private IP address range of the instances to the inbound rule of the database security group. (correct answer)
  • BCreate a VPC peering connection between the two Regions. Add the security group of the instances in eu-central-1 to the outbound rule of the database security group.
  • CCreate a VPN connection between the two Regions. Add the private IP address range of the instances to the outbound rule of the database security group.
  • DCreate a VPN connection between the two Regions. Add the security group of the instances in eu-central-1 to the inbound rule of the database security group.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a VPC peering connection between the two Regions. Add the private IP address range of the instances to the inbound rule of the database security group.

Explanation

VPC peering privately connects two VPCs without a gateway.

SOA-C02 Question 73

Single page →
Topic 1 · Question 73

A company wants to create an automated solution for all accounts managed by AWS Organizations to detect any security groups that use 0.0.0.0/0 as the source address for inbound traffic. The company also wants to automatically remediate any noncompliant security groups by restricting access to a specific CIDR block that corresponds with the company's intranet. Which set of actions should the SysOps administrator take to create a solution?

  • ACreate an AWS Config rule to detect noncompliant security groups. Set up automatic remediation to change the 0.0.0.0/0 source address to the approved CIDR block. (correct answer)
  • BCreate an IAM policy to deny the creation of security groups that have 0.0.0.0/0 as the source address. Attach this IAM policy to every user in the company.
  • CCreate an AWS Lambda function to inspect new and existing security groups. Check for a noncompliant 0.0.0.0/0 source address and change the source address to the approved CIDR block.
  • DCreate a service control policy (SCP) for the organizational unit (OU) to deny the creation of security groups that have the 0.0.0.0/0 source address. Set up automatic remediation to change the 0.0.0.0/0 source address to the approved CIDR block.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an AWS Config rule to detect noncompliant security groups. Set up automatic remediation to change the 0.0.0.0/0 source address to the approved CIDR block.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 74

Single page →
Topic 1 · Question 74

A company requires that all activity in its AWS account be logged using AWS CloudTrail. Additionally, a SysOps administrator must know when CloudTrail log files are modified or deleted. How should the SysOps administrator meet these requirements?

  • AEnable log file integrity validation. Use the AWS CLI to validate the log files. (correct answer)
  • BEnable log file integrity validation. Use the AWS CloudTrail Processing Library to validate the log files.
  • CUse CloudTrail Insights to monitor the log files for modifications.
  • DUse Amazon CloudWatch Logs to monitor the log files for modifications.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable log file integrity validation. Use the AWS CLI to validate the log files.

SOA-C02 Question 75

Single page →
Topic 1 · Question 75

A company is planning to host its stateful web-based applications on AWS. A SysOps administrator is using an Auto Scaling group of Amazon EC2 instances. The web applications will run 24 hours a day, 7 days a week throughout the year. The company must be able to change the instance type within the same instance family later in the year based on the traffic and usage patterns. Which EC2 instance purchasing option will meet these requirements MOST cost-effectively?

  • AConvertible Reserved Instances (correct answer)
  • BOn-Demand Instances
  • CSpot Instances
  • DStandard Reserved Instances
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Convertible Reserved Instances

Explanation

Reserved Instances lower cost for steady-state, predictable long-running workloads. This option delivers the requirement at the lowest cost.

SOA-C02 Question 76

Single page →
Topic 1 · Question 76

An application runs on Amazon EC2 instances in an Auto Scaling group. Following the deployment of a new feature on the EC2 instances, some instances were marked as unhealthy and then replaced by the Auto Scaling group. The EC2 instances terminated before a SysOps administrator could determine the cause of the health status changes. To troubleshoot this issue, the SysOps administrator wants to ensure that an AWS Lambda function is invoked in this situation. How should the SysOps administrator meet these requirements?

  • AActivate the instance scale-in protection setting for the Auto Scaling group. Invoke the Lambda function through Amazon EventBridge (Amazon CloudWatch Events).
  • BActivate the instance scale-in protection setting for the Auto Scaling group. Invoke the Lambda function through Amazon Route 53.
  • CAdd a lifecycle hook to the Auto Scaling group to invoke the Lambda function through Amazon EventBridge (Amazon CloudWatch Events). (correct answer)
  • DAdd a lifecycle hook to the Auto Scaling group to invoke the Lambda function through Amazon Route 53.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Add a lifecycle hook to the Auto Scaling group to invoke the Lambda function through Amazon EventBridge (Amazon CloudWatch Events).

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SOA-C02 Question 77

Single page →
Topic 1 · Question 77

A company runs an application that hosts critical data for several clients. The company uses AWS CloudTrail to track user activities on various AWS resources. To meet new security requirements, the company needs to protect the CloudTrail log files from being modified, deleted, or forged. Which solution will meet these requirement?

  • AEnable CloudTrail log file integrity validation. (correct answer)
  • BUse Amazon S3 MFA Delete on the S3 bucket where the CloudTrail log files are stored.
  • CUse Amazon S3 Versioning to keep all versions of the CloudTrail log files.
  • DUse AWS Key Management Service (AWS KMS) security keys to secure the CloudTrail log files.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable CloudTrail log file integrity validation.

Explanation

AWS CloudTrail records API activity for auditing and governance.

SOA-C02 Question 78

Single page →
Topic 1 · Question 78

A global company operates out of five AWS Regions. A SysOps administrator wants to identify all the company's tagged and untagged Amazon EC2 instances. The company requires the output to display the instance ID and tags. What is the MOST operationally efficient way for the SysOps administrator to meet these requirements?

  • ACreate a tag-based resource group in AWS Resource Groups.
  • BUse AWS Trusted Advisor. Export the EC2 On-Demand Instances check results from Trusted Advisor.
  • CUse Cost Explorer. Choose a service type of EC2-Instances, and group by Resource.
  • DUse Tag Editor in AWS Resource Groups. Select all Regions, and choose a resource type of AWS::EC2::Instance. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use Tag Editor in AWS Resource Groups. Select all Regions, and choose a resource type of AWS::EC2::Instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 79

Single page →
Topic 1 · Question 79

A company needs to upload gigabytes of files every day. The company need to achieve higher throughput and upload speeds to Amazon S3. Which action should a SysOps administrator take to meet this requirement?

  • ACreate an Amazon CloudFront distribution with the GET HTTP method allowed and the S3 bucket as an origin.
  • BCreate an Amazon ElastiCache cluster and enable caching for the S3 bucket.
  • CSet up AWS Global Accelerator and configure it with the S3 bucket.
  • DEnable S3 Transfer Acceleration and use the acceleration endpoint when uploading files. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable S3 Transfer Acceleration and use the acceleration endpoint when uploading files.

Explanation

S3 Transfer Acceleration speeds up long-distance uploads to S3 over the AWS edge network. Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 80

Single page →
Topic 1 · Question 80

A SysOps administrator maintains the security and compliance of a company's AWS account. To ensure the company's Amazon EC2 instances are following company policy, a SysOps administrator wants to terminate any EC2 instance that do not contain a department tag. Noncompliant resources must be terminated in near-real time. Which solution will meet these requirements?

  • ACreate an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS- TerminateEC2Instance automation document to terminate noncompliant resources. (correct answer)
  • BCreate a new Amazon EventBridge (Amazon CloudWatch Events) rule to monitor when new EC2 instances are created. Send the event to a Simple Notification Service (Amazon SNS) topic for automatic remediation.
  • CEnsure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance's shutdown behavior to terminate.
  • DEnsure AWS Systems Manager Compliance is configured to manage the EC2 instances. Call the AWS-StopEC2Instances automation document to stop noncompliant resources.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS- TerminateEC2Instance automation document to terminate noncompliant reso...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance. This option meets the real-time / low-latency performance requirement.

Showing questions 61–80 of 477 · Page 4 of 24