🔍

SOA-C02 — questions

Page 6 of 24 · 477 total questions.

SOA-C02 Question 101

Single page →
Topic 1 · Question 101 · Select all that apply

A SysOps administrator wants to manage a web server application with AWS Elastic Beanstalk. The Elastic Beanstalk service must maintain full capacity for new deployments at all times. Which deployment policies satisfy this requirement? (Choose two.)

  • AAll at once
  • BImmutable (correct answer)
  • CRebuild
  • DRolling
  • ERolling with additional batch (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Immutable Option E: Rolling with additional batch

Explanation

AWS Batch schedules and runs batch computing jobs at any scale without managing clusters.

SOA-C02 Question 102

Single page →
Topic 1 · Question 102 · Select all that apply

A company has an Auto Scaling group of Amazon EC2 instances that scale based on average CPU utilization. The Auto Scaling group events log indicates an InsufficientInstanceCapacity error. Which actions should a SysOps administrator take to remediate this issue? (Choose two.)

  • AChange the instance type that the company is using. (correct answer)
  • BConfigure the Auto Scaling group in different Availability Zones. (correct answer)
  • CConfigure the Auto Scaling group to use different Amazon Elastic Block Store (Amazon EBS) volume sizes.
  • DIncrease the maximum size of the Auto Scaling group.
  • ERequest an increase in the instance service quota.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Change the instance type that the company is using. Option B: Configure the Auto Scaling group in different Availability Zones.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 103

Single page →
Topic 1 · Question 103 · Select all that apply

A SysOps administrator needs to control access to groups of Amazon EC2 instances using AWS Systems Manager Session Manager. Specific tags on the EC2 instances have already been added. Which additional actions should the administrator take to control access? (Choose two.)

  • AAttach an IAM policy to the users or groups that require access to the EC2 instances. (correct answer)
  • BAttach an IAM role to control access to the EC2 instances.
  • CCreate a placement group for the EC2 instances and add a specific tag.
  • DCreate a service account and attach it to the EC2 instances that need to be controlled.
  • ECreate an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element. (correct answer)
Reveal answer & explanation
Correct answer: A, E

The correct answer is A, E. Option A: Attach an IAM policy to the users or groups that require access to the EC2 instances. Option E: Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SOA-C02 Question 104

Single page →
Topic 1 · Question 104

A company has an AWS Lambda function in Account A. The Lambda function needs to read the objects in an Amazon S3 bucket in Account B. A SysOps administrator must create corresponding IAM roles in both accounts. Which solution will meet these requirements?

  • AIn Account A, create a Lambda execution role to assume the role in Account B. In Account B. create a role that the function can assume to gain access to the S3 bucket. (correct answer)
  • BIn Account A, create a Lambda execution role that provides access to the S3 bucket. In Account B, create a role that the function can assume.
  • CIn Account A, create a role that the function can assume. In Account B, create a Lambda execution role that provides access to the S3 bucket.
  • DIn Account A. create a role that the function can assume to gain access to the S3 bucket. In Account B, create a Lambda execution role to assume the role in Account A.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: In Account A, create a Lambda execution role to assume the role in Account B. In Account B. create a role that the function can assume to gain access to the S3 bucket.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 105

Single page →
Topic 1 · Question 105

An AWS Lambda function is intermittently failing several times a day. A SysOps administrator must find out how often this error has occurred in the last 7 days. Which action will meet this requirement in the MOST operationally efficient manner?

  • AUse Amazon Athena to query the Amazon CloudWatch logs that are associated with the Lambda function.
  • BUse Amazon Athena to query the AWS CloudTrail logs that are associated with the Lambda function.
  • CUse Amazon CloudWatch Logs Insights to query the associated Lambda function logs. (correct answer)
  • DUse Amazon OpenSearch Service (Amazon Elasticsearch Service) to stream the Amazon CloudWatch logs for the Lambda function.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Amazon CloudWatch Logs Insights to query the associated Lambda function logs.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 106

Single page →
Topic 1 · Question 106

A company is using Amazon CloudFront to serve static content for its web application to its users. The CloudFront distribution uses an existing on-premises website as a custom origin. The company requires the use of TLS between CloudFront and the origin server. This configuration has worked as expected for several months. However, users are now experiencing HTTP 502 (Bad Gateway) errors when they view webpages that include content from the CloudFront distribution. What should a SysOps administrator do to resolve this problem?

  • AExamine the expiration date on the certificate on the origin site. Validate that the certificate has not expired. Replace the certificate if necessary. (correct answer)
  • BExamine the hostname on the certificate on the origin site. Validate that the hostname matches one of the hostnames on the CloudFront distribution. Replace the certificate if necessary.
  • CExamine the firewall rules that are associated with the origin server. Validate that port 443 is open for inbound traffic from the internet. Create an inbound rule if necessary.
  • DExamine the network ACL rules that are associated with the CloudFront distribution. Validate that port 443 is open for outbound traffic to the origin server. Create an outbound rule if necessary.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Examine the expiration date on the certificate on the origin site. Validate that the certificate has not expired. Replace the certificate if necessary.

SOA-C02 Question 107

Single page →
Topic 1 · Question 107

An Amazon CloudFront distribution has a single Amazon S3 bucket as its origin. A SysOps administrator must ensure that users can access the S3 bucket only through requests from the CloudFront endpoint. Which solution will meet these requirements?

  • AConfigure S3 Block Public Access on the S3 bucket. Update the S3 bucket policy to allow the GetObject action from only the CloudFront distribution.
  • BConfigure Origin Shield in the CloudFront distribution. Update the CloudFront origin to include a custom Origin_Shield header.
  • CCreate an origin access identity (OAI). Assign the OAI to the CloudFront distribution. Update the S3 bucket policy to restrict access to the OAI. (correct answer)
  • DCreate an origin access identity (OAI). Assign the OAI to the S3 bucket. Update the CloudFront origin to include a custom Origin header with the OAI value.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an origin access identity (OAI). Assign the OAI to the CloudFront distribution. Update the S3 bucket policy to restrict access to the OAI.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SOA-C02 Question 108

Single page →
Topic 1 · Question 108

A SysOps administrator is designing a solution for an Amazon RDS for PostgreSQL DB instance. Database credentials must be stored and rotated monthly. The applications that connect to the DB instance send write-intensive traffic with variable client connections that sometimes increase significantly in a short period of time. Which solution should a SysOps administrator choose to meet these requirements?

  • AConfigure AWS Key Management Service (AWS KMS) to automatically rotate the keys for the DB instance. Use RDS Proxy to handle the increases in database connections.
  • BConfigure AWS Key Management Service (AWS KMS) to automatically rotate the keys for the DB instance. Use RDS read replicas to handle the increases in database connections.
  • CConfigure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS Proxy to handle the increases in database connections. (correct answer)
  • DConfigure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS read replicas to handle the increases in database connections.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS Proxy to handle the increases in database connections.

Explanation

Amazon RDS Proxy pools and shares database connections to improve scalability and resilience. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

SOA-C02 Question 109

Single page →
Topic 1 · Question 109

A company wants to reduce costs for jobs that can be completed at any time. The jobs currently run by using multiple Amazon EC2 On-Demand Instances and the jobs take slightly less than 2 hours to complete. If a job falls for any reason it must be restarted from the beginning. Which solution will meet these requirements MOST cost-effectively?

  • APurchase Reserved Instances for the jobs.
  • BSubmit a request for a one-time Spot Instance for the jobs.
  • CSubmit a request for Spot Instances with a defined duration for the jobs. (correct answer)
  • DUse a mixture of On-Demand Instances and Spot Instances for the jobs.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Submit a request for Spot Instances with a defined duration for the jobs.

Explanation

Spot Instances use spare capacity at a large discount, ideal for fault-tolerant or interruptible workloads. This option delivers the requirement at the lowest cost.

SOA-C02 Question 110

Single page →
Topic 1 · Question 110

An environment consists of 100 Amazon EC2 Windows instances. The Amazon CloudWatch agent is deployed and running on all EC2 Instances with a baseline configuration file to capture log files. There is a new requirement to capture the DHCP log files that exist on 50 of the instances. What is the MOST operationally efficient way to meet this new requirement?

  • ACreate an additional CloudWatch agent configuration file to capture the DHCP logs. Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file. (correct answer)
  • BLog in to each EC2 Instance with administrator rights. Create a PowerShell script to push the needed baseline log files and DHCP log files to CloudWatch.
  • CRun the CloudWatch agent configuration file wizard on each EC2 instance. Verify that the baseline log files are included and add the DHCP log files during the wizard creation process.
  • DRun the CloudWatch agent configuration file wizard on each EC2 instance and select the advanced detail level. This will capture the operating system log files.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an additional CloudWatch agent configuration file to capture the DHCP logs. Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply th...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 111

Single page →
Topic 1 · Question 111

A company has 10 Amazon EC2 instances in its production account. A SysOps administrator must ensure that email notifications are sent to administrators each time there is an EC2 instance state change. Which solution will meet this requirements?

  • AConfigure an Amazon Route 53 simple routing policy that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic when an EC2 instance state changes. This SNS topic then sends notifications to its email subscribers.
  • BConfigure an Amazon Route 53 simple routing policy that publishes a message to an Amazon Simple Queue Service (Amazon SQS) queue when an EC2 instance state changes. This SQS queue then sends notifications to its email subscribers.
  • CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic when an EC2 instance state changes. This SNS topic then sends notifications to its email subscribers. (correct answer)
  • DCreate an Amazon EventBridge (Amazon CloudWatch Events) rule that publishes a message to an Amazon Simple Queue Service (Amazon SQS) queue when an EC2 instance state changes. This SQS queue then sends notifications to its email subscribers.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon EventBridge (Amazon CloudWatch Events) rule that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic when an EC2 instance state changes. This SNS topic then sends notificat...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SOA-C02 Question 112

Single page →
Topic 1 · Question 112

A company has an application that runs on a fleet of Amazon EC2 instances behind an Elastic Load Balancer. The instances run in an Auto Scaling group. The application's performance remains consistent throughout most of each day. However, an increase in user traffic slows the performance during the same 4-hour period of time each day. What is the MOST operationally efficient solution that will resolve this issue?

  • AConfigure a second Elastic Load Balancer in front of the Auto Scaling group with a weighted routing policy.
  • BConfigure the fleet of EC2 instances to run on larger instance types to support the increase in user traffic.
  • CCreate a scheduled scaling action to scale out the number of EC2 instances shortly before the increase in user traffic occurs. (correct answer)
  • DManually add a few more EC2 instances to the Auto Scaling group to support the increase in user traffic.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a scheduled scaling action to scale out the number of EC2 instances shortly before the increase in user traffic occurs.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 113

Single page →
Topic 1 · Question 113

A company hosts an application on an Amazon EC2 instance in a single AWS Region. The application requires support for non-HTTP TCP traffic and HTTP traffic. The company wants to deliver content with low latency by leveraging the AWS network. The company also wants to implement an Auto Scaling group with an Elastic Load Balancer. How should a SysOps administrator meet these requirements?

  • ACreate an Auto Scaling group with an Application Load Balancer (ALB). Add an Amazon CloudFront distribution with the ALB as the origin.
  • BCreate an Auto Scaling group with an Application Load Balancer (ALB). Add an accelerator with AWS Global Accelerator with the ALB as an endpoint.
  • CCreate an Auto Scaling group with a Network Load Balancer (NLB). Add an Amazon CloudFront distribution with the NLB as the origin.
  • DCreate an Auto Scaling group with a Network Load Balancer (NLB). Add an accelerator with AWS Global Accelerator with the NLB as an endpoint. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an Auto Scaling group with a Network Load Balancer (NLB). Add an accelerator with AWS Global Accelerator with the NLB as an endpoint.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. AWS Global Accelerator routes users over the AWS backbone to the optimal endpoint for lower latency and fast failover. A Network Load Balancer handles very high throughput TCP/UDP traffic with ultra-low latency and static IPs. This option meets the real-time / low-latency performance requirement.

SOA-C02 Question 114

Single page →
Topic 1 · Question 114

A SysOps administrator has an AWS CloudFormation template that is used to deploy an encrypted Amazon Machine Image (AMI). The CloudFormation template will be used in a second account so the SysOps administrator copies the encrypted AMI to the second account. When launching the new CloudFormation stack in the second account, it fails. Which action should the SysOps administrator take to correct the issue?

  • AChange the AMI permissions to mark the AMI as public.
  • BDeregister the AMI in the source account.
  • CRe-encrypt the destination AMI with an AWS Key Management Service (AWS KMS) key from the destination account.
  • DUpdate the CloudFormation template with the ID of the AMI in the destination account. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Update the CloudFormation template with the ID of the AMI in the destination account.

Explanation

AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 115

Single page →
Topic 1 · Question 115

A company’s SysOps administrator deploys four new Amazon EC2 instances by using the standard Amazon Linux 2 Amazon Machine Image (AMI). The company needs to be able to use AWS Systems Manager to manage the instances. The SysOps administrator notices that the instances do not appear in the Systems Manager console. What must the SysOps administrator do to resolve this issue?

  • AConnect to each instance by using SSH. Install Systems Manager Agent on each instance. Configure Systems Manager Agent to start automatically when the instances start up.
  • BUse AWS Certificate Manager (ACM) to create a TLS certificate. Import the certificate into each instance. Configure Systems Manager Agent to use the TLS certificate for secure communications.
  • CConnect to each instance by using SSH. Create an ssm-user account. Add the ssm-user account to the /etc/sudoers.d directory.
  • DAttach an IAM instance profile to the instances. Ensure that the instance profile contains the AmazonSSMManagedInstanceCore policy. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Attach an IAM instance profile to the instances. Ensure that the instance profile contains the AmazonSSMManagedInstanceCore policy.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SOA-C02 Question 116

Single page →
Topic 1 · Question 116 · Select all that apply

A SysOps administrator is maintaining a web application using an Amazon CloudFront web distribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All services have logging enabled. The administrator needs to investigate HTTP Layer 7 status codes from the web application. Which log sources contain the status codes? (Choose two.)

  • AVPC Flow Logs
  • BAWS CloudTrail logs
  • CALB access logs (correct answer)
  • DCloudFront access togs (correct answer)
  • ERDS logs
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: ALB access logs Option D: CloudFront access togs

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SOA-C02 Question 117

Single page →
Topic 1 · Question 117 · Select all that apply

A company wants to be alerted through email when IAM CreateUser API calls are made within its AWS account. Which combination of actions should a SysOps administrator take to meet this requirement? (Choose two.)

  • ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the event source and IAM CreateUser as the specific API call for the event pattern. (correct answer)
  • BCreate an Amazon EventBridge (Amazon CloudWatch Events) rule with Amazon CloudSearch as the event source and IAM CreateUser as the specific API call for the event pattern.
  • CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS IAM Access Analyzer as the event source and IAM CreateUser as the specific API call for the event pattern.
  • DUse an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email subscription. (correct answer)
  • EUse an Amazon Simple Email Service (Amazon SES) notification as an event target with an email subscription.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the event source and IAM CreateUser as the specific API call for the event pattern. Option D: Use an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email subscription.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SOA-C02 Question 118

Single page →
Topic 1 · Question 118

A database is running on an Amazon RDS Multi-AZ DB instance. A recent security audit found the database to be out of compliance because it was not encrypted. Which approach will resolve the encryption requirement?

  • ALog in to the RDS console and select the encryption box to encrypt the database.
  • BCreate a new encrypted Amazon EBS volume and attach it to the instance.
  • CEncrypt the standby replica in the secondary Availability Zone and promote it to the primary instance.
  • DTake a snapshot of the RDS instance, copy and encrypt the snapshot, and then restore to the new RDS instance. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Take a snapshot of the RDS instance, copy and encrypt the snapshot, and then restore to the new RDS instance.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 119

Single page →
Topic 1 · Question 119

A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted. What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?

  • ASet up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
  • BUse service control policies to deny the s3:DeleteBucket action on all buckets in production accounts. (correct answer)
  • CCreate an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
  • DUse AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 120

Single page →
Topic 1 · Question 120

A company has an application that is running on Amazon EC2 instances in a VPC. The application needs access to download software updates from the internet. The VPC has public subnets and private subnets. The company’s security policy requires all EC2 instances to be deployed in private subnets. What should a SysOps administrator do to meet these requirements?

  • AAdd an internet gateway to the VPC. In the route table for the private subnets, add a route to the internet gateway.
  • BAdd aNAT gateway to a private subnet. In the route table for the private subnets, add a route to the NAT gateway.
  • CAdd a NAT gateway to public subnet. In the route table for the private subnets, add a route to the NAT gateway. (correct answer)
  • DAdd two internet gateways to the VPC. In the route tables for the private subnets and public subnets, add a route to each internet gateway.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Add a NAT gateway to public subnet. In the route table for the private subnets, add a route to the NAT gateway.

Explanation

A NAT gateway lets private subnet resources reach the internet for outbound traffic only.

Showing questions 101–120 of 477 · Page 6 of 24