🔍

SOA-C02 — questions

Page 8 of 24 · 477 total questions.

SOA-C02 Question 141

Single page →
Topic 1 · Question 141

A company uses AWS Organizations to manage multiple AWS accounts. The company’s SysOps team has been using a manual process to create and manage IAM roles. The team requires an automated solution to create and manage the necessary IAM roles for multiple AWS accounts. What is the MOST operationally efficient solution that meets these requirements?

  • ACreate AWS CloudFormation templates. Reuse the templates to create the necessary IAM roles in each of the AWS accounts.
  • BUse AWS Directory Service with AWS Organizations to automatically associate the necessary IAM roles with Microsoft Active Directory users.
  • CUse AWS Resource Access Manager with AWS Organizations to deploy and manage shared resources across the AWS accounts.
  • DUse AWS CloudFormation StackSets with AWS Organizations to deploy and manage IAM roles for the AWS accounts. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS CloudFormation StackSets with AWS Organizations to deploy and manage IAM roles for the AWS accounts.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Organizations centrally governs and secures multiple AWS accounts.

SOA-C02 Question 142

Single page →
Topic 1 · Question 142

A SysOps administrator needs to configure automatic rotation for Amazon RDS database credentials. The credentials must rotate every 30 days. The solution must integrate with Amazon RDS. Which solution will meet these requirements with the LEAST operational overhead?

  • AStore the credentials in AWS Systems Manager Parameter Store as a secure string. Configure automatic rotation with a rotation interval of 30 days.
  • BStore the credentials in AWS Secrets Manager. Configure automatic rotation with a rotation interval of 30 days. (correct answer)
  • CStore the credentials in a file in an Amazon S3 bucket. Deploy an AWS Lambda function to automatically rotate the credentials every 30 days.
  • DStore the credentials in AWS Secrets Manager. Deploy an AWS Lambda function to automatically rotate the credentials every 30 days.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Store the credentials in AWS Secrets Manager. Configure automatic rotation with a rotation interval of 30 days.

Explanation

AWS Secrets Manager stores and automatically rotates secrets such as database credentials. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 143

Single page →
Topic 1 · Question 143

A company’s SysOps administrator attempts to restore an Amazon Elastic Block Store (Amazon EBS) snapshot. However, the snapshot is missing because another system administrator accidentally deleted the snapshot. The company needs the ability to recover snapshots for a specified period of time after snapshots are deleted. Which solution will provide this functionality?

  • ATurn on deletion protection on individual EBS snapshots that need to be kept.
  • BCreate an IAM policy that denies the deletion of EBS snapshots by using a condition statement for the snapshot age. Apply the policy to all users.
  • CCreate a Recycle Bin retention rule for EBS snapshots for the desired retention period. (correct answer)
  • DUse Amazon EventBridge (Amazon CloudWatch Events) to schedule an AWS Lambda function to copy EBS snapshots to Amazon S3 Glacier.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a Recycle Bin retention rule for EBS snapshots for the desired retention period.

Explanation

Amazon EBS provides block storage attached to a single EC2 instance.

SOA-C02 Question 144

Single page →
Topic 1 · Question 144

A SysOps administrator recently configured Amazon S3 Cross-Region Replication on an S3 bucket. Which of the following does this feature replicate to the destination S3 bucket by default?

  • AObjects in the source S3 bucket for which the bucket owner does not have permissions
  • BObjects that are stored in S3 Glacier
  • CObjects that existed before replication was configured
  • DObject metadata (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Object metadata.

SOA-C02 Question 145

Single page →
Topic 1 · Question 145

A company has a workload that is sending log data to Amazon CloudWatch Logs. One of the fields includes a measure of application latency. A SysOps administrator needs to monitor the p90 statistic of this field over time. What should the SysOps administrator do to meet this requirement?

  • ACreate an Amazon CloudWatch Contributor Insights rule on the log data.
  • BCreate a metric filter on the log data. (correct answer)
  • CCreate a subscription filter on the log data.
  • DCreate an Amazon CloudWatch Application Insights rule for the workload.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a metric filter on the log data.

SOA-C02 Question 146

Single page →
Topic 1 · Question 146

A company wants to archive sensitive data on Amazon S3 Glacier. The company’s regulatory and compliance requirements do not allow any modifications to the data by any account. Which solution meets these requirements?

  • AAttach a vault lock policy to an S3 Glacier vault that contains the archived data. Use the lock ID to validate the vault lock policy after 24 hours.
  • BAttach a vault lock policy to an S3 Glacier vault that contains the archived data. Use the lock ID to validate the vault lock policy within 24 hours. (correct answer)
  • CConfigure S3 Object Lock in governance mode. Upload all files after 24 hours.
  • DConfigure S3 Object Lock in governance mode. Upload all files within 24 hours.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Attach a vault lock policy to an S3 Glacier vault that contains the archived data. Use the lock ID to validate the vault lock policy within 24 hours.

Explanation

Amazon S3 Glacier offers low-cost archival storage for infrequently accessed data. Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 147

Single page →
Topic 1 · Question 147

A company manages an application that uses Amazon ElastiCache for Redis with two extra-large nodes spread across two different Availability Zones. The company’s IT team discovers that the ElastiCache for Redis cluster has 75% freeable memory. The application must maintain high availability. What is the MOST cost-effective way to resize the cluster?

  • ADecrease the number of nodes in the ElastiCache for Redis cluster from 2 to 1.
  • BDeploy a new ElastiCache for Redis cluster that uses large node types. Migrate the data from the original cluster to the new cluster. After the process is complete, shut down the original cluster.
  • CDeploy a new ElastiCache for Redis cluster that uses large node types. Take a backup from the original cluster, and restore the backup in the new cluster. After the process is complete, shut down the original cluster.
  • DPerform an online resizing for the ElastiCache for Redis cluster. Change the node types from extra-large nodes to large nodes. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Perform an online resizing for the ElastiCache for Redis cluster. Change the node types from extra-large nodes to large nodes.

Explanation

Amazon ElastiCache provides in-memory caching (Redis/Memcached) to reduce latency and offload the database. This option delivers the requirement at the lowest cost.

SOA-C02 Question 148

Single page →
Topic 1 · Question 148

A company must migrate its applications to AWS. The company is using Chef recipes for configuration management. The company wants to continue to use the existing Chef recipes after the applications are migrated to AWS. What is the MOST operationally efficient solution that meets these requirements?

  • AUse AWS CloudFormation to create an Amazon EC2 instance, install a Chef server, and add Chef recipes.
  • BUse AWS CloudFormation to create a stack and add layers for Chef recipes.
  • CUse AWS Elastic Beanstalk with the Docker platform to upload Chef recipes.
  • DUse AWS OpsWorks to create a stack and add layers with Chef recipes. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS OpsWorks to create a stack and add layers with Chef recipes.

SOA-C02 Question 149

Single page →
Topic 1 · Question 149

A company uses AWS Organizations to manage its AWS accounts. A SysOps administrator must create a backup strategy for all Amazon EC2 instances across all the company’s AWS accounts. Which solution will meet these requirements in the MOST operationally efficient way?

  • ADeploy an AWS Lambda function to each account to run EC2 instance snapshots on a scheduled basis.
  • BCreate an AWS CloudFormation stack set in the management account to add an AutoBackup=True tag to every EC2 instance.
  • CUse AWS Backup in the management account to deploy policies for all accounts and resources. (correct answer)
  • DUse a service control policy (SCP) to run EC2 instance snapshots on a scheduled basis in each account.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use AWS Backup in the management account to deploy policies for all accounts and resources.

Explanation

AWS Backup centrally automates and manages backups across AWS services.

SOA-C02 Question 150

Single page →
Topic 1 · Question 150

A SysOps administrator is reviewing VPC Flow Logs to troubleshoot connectivity issues in a VPC. While reviewing the logs, the SysOps administrator notices that rejected traffic is not listed. What should the SysOps administrator do to ensure that all traffic is logged?

  • ACreate a new flow log that has a filter setting to capture all traffic. (correct answer)
  • BCreate a new flow log. Set the log record format to a custom format. Select the proper fields to include in the log.
  • CEdit the existing flow log. Change the filter setting to capture all traffic.
  • DEdit the existing flow log. Set the log record format to a custom format. Select the proper fields to include in the log.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a new flow log that has a filter setting to capture all traffic.

SOA-C02 Question 151

Single page →
Topic 1 · Question 151

A company is expanding its use of AWS services across its portfolios. The company wants to provision AWS accounts for each team to ensure a separation of business processes for security, compliance, and billing. Account creation and bootstrapping should be completed in a scalable and efficient way so new accounts are created with a defined baseline and governance guardrails in place. A SysOps administrator needs to design a provisioning process that saves time and resources. Which action should be taken to meet these requirements?

  • AAutomate using AWS Elastic Beanstalk to provision the AWS accounts, set up infrastructure, and integrate with AWS Organizations.
  • BCreate bootstrapping scripts in AWS OpsWorks and combine them with AWS CloudFormation templates to provision accounts and infrastructure.
  • CUse AWS Config to provision accounts and deploy instances using AWS Service Catalog.
  • DUse AWS Control Tower to create a template in Account Factory and use the template to provision new accounts. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Control Tower to create a template in Account Factory and use the template to provision new accounts.

Explanation

AWS Control Tower sets up and governs a secure multi-account landing zone.

SOA-C02 Question 152

Single page →
Topic 1 · Question 152 · Select all that apply

A SysOps administrator noticed that the cache hit ratio for an Amazon CloudFront distribution is less than 10%. Which collection of configuration changes will increase the cache hit ratio for the distribution? (Choose two.)

  • AEnsure that only required cookies, query strings, and headers are forwarded in the Cache Behavior Settings. (correct answer)
  • BChange the Viewer Protocol Policy to use HTTPS only.
  • CConfigure the distribution to use presigned cookies and URLs to restrict access to the distribution.
  • DEnable automatic compression of objects in the Cache Behavior Settings.
  • EIncrease the CloudFront time to live (TTL) settings in the Cache Behavior Settings. (correct answer)
Reveal answer & explanation
Correct answer: A, E

The correct answer is A, E. Option A: Ensure that only required cookies, query strings, and headers are forwarded in the Cache Behavior Settings. Option E: Increase the CloudFront time to live (TTL) settings in the Cache Behavior Settings.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SOA-C02 Question 153

Single page →
Topic 1 · Question 153

A SysOps administrator is attempting to download patches from the internet into an instance in a private subnet. An internet gateway exists for the VPC, and a NAT gateway has been deployed on the public subnet; however, the instance has no internet connectivity. The resources deployed into the private subnet must be inaccessible directly from the public internet. Public Subnet (10.0.1.0/24) Route Table Destination Target - 10.0.0.0/16 local 0.0.0.0/0 IGW Private Subnet (10.0.2.0/24) Route Table Destination Target - 10.0.0.0/16 local What should be added to the private subnet’s route table in order to address this issue, given the information provided?

  • A0.0.0.0/0 IGW
  • B0.0.0.0/0 NAT (correct answer)
  • C10.0.1.0/24 IGW
  • D10.0.1.0/24 NAT
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: 0.0.0.0/0 NAT.

SOA-C02 Question 154

Single page →
Topic 1 · Question 154

A company is undergoing an external audit of its systems, which run wholly on AWS. A SysOps administrator must supply documentation of Payment Card Industry Data Security Standard (PCI DSS) compliance for the infrastructure managed by AWS. Which set of actions should the SysOps administrator take to meet this requirement?

  • ADownload the applicable reports from the AWS Artifact portal and supply these to the auditors. (correct answer)
  • BDownload complete copies of the AWS CloudTrail log files and supply these to the auditors.
  • CDownload complete copies of the AWS CloudWatch logs and supply these to the auditors.
  • DProvide the auditors with administrative access to the production AWS account so that the auditors can determine compliance.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Download the applicable reports from the AWS Artifact portal and supply these to the auditors.

SOA-C02 Question 155

Single page →
Topic 1 · Question 155

A company has an initiative to reduce costs associated with Amazon EC2 and AWS Lambda. Which action should a SysOps administrator take to meet these requirements?

  • AAnalyze the AWS Cost and Usage Report by using Amazon Athena to identify cost savings.
  • BCreate an AWS Budgets alert to alarm when account spend reaches 80% of the budget.
  • CPurchase Reserved Instances through the Amazon EC2 console.
  • DUse AWS Compute Optimizer and take action on the provided recommendations. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Compute Optimizer and take action on the provided recommendations.

Explanation

AWS Compute Optimizer recommends right-sizing based on utilization. This option delivers the requirement at the lowest cost.

SOA-C02 Question 156

Single page →
Topic 1 · Question 156

A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6-only subnets. How should a SysOps administrator configure the VPC to meet these requirements?

  • ACreate and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
  • BCreate and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.
  • CCreate and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets. (correct answer)
  • DCreate and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets.

SOA-C02 Question 157

Single page →
Topic 1 · Question 157 · Select all that apply

A company has an existing web application that runs on two Amazon EC2 instances behind an Application Load Balancer (ALB) across two Availability Zones. The application uses an Amazon RDS Multi-AZ DB Instance. Amazon Route 53 record sets route requests for dynamic content to the load balancer and requests for static content to an Amazon S3 bucket. Site visitors are reporting extremely long loading times. Which actions should be taken to improve the performance of the website? (Choose two.)

  • AAdd Amazon CloudFront caching for static content. (correct answer)
  • BChange the load balancer listener from HTTPS to TCP.
  • CEnable Amazon Route 53 latency-based routing.
  • DImplement Amazon EC2 Auto Scaling for the web servers. (correct answer)
  • EMove the static content from Amazon S3 to the web servers.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Add Amazon CloudFront caching for static content. Option D: Implement Amazon EC2 Auto Scaling for the web servers.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 158

Single page →
Topic 1 · Question 158

A company is running an application on premises and wants to use AWS for data backup. All of the data must be available locally. The backup application can write only to block-based storage that is compatible with the Portable Operating System Interface (POSIX). Which backup solution will meet these requirements?

  • AConfigure the backup software to use Amazon S3 as the target for the data backups.
  • BConfigure the backup software to use Amazon S3 Glacier as the target for the data backups.
  • CUse AWS Storage Gateway, and configure it to use gateway-cached volumes.
  • DUse AWS Storage Gateway, and configure it to use gateway-stored volumes. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Storage Gateway, and configure it to use gateway-stored volumes.

Explanation

AWS Storage Gateway bridges on-premises apps to AWS storage with local caching. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 159

Single page →
Topic 1 · Question 159

A global company handles a large amount of personally identifiable information (PII) through an internal web portal. The company’s application runs in a corporate data center that is connected to AWS through an AWS Direct Connect connection. The application stores the PII in Amazon S3. According to a compliance requirement, traffic from the web portal to Amazon S3 must not travel across the internet. What should a SysOps administrator do to meet the compliance requirement?

  • AProvision an interface VPC endpoint for Amazon S3. Modify the application to use the interface endpoint. (correct answer)
  • BConfigure AWS Network Firewall to redirect traffic to the internal S3 address.
  • CModify the application to use the S3 path-style endpoint.
  • DSet up a range of VPC network ACLs to redirect traffic to the internal S3 address.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Provision an interface VPC endpoint for Amazon S3. Modify the application to use the interface endpoint.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

SOA-C02 Question 160

Single page →
Topic 1 · Question 160

A SysOps administrator notices a scale-up event for an Amazon EC2 Auto Scaling group. Amazon CloudWatch shows a spike in the RequestCount metric for the associated Application Load Balancer. The administrator would like to know the IP addresses for the source of the requests. Where can the administrator find this information?

  • AAuto Scaling logs
  • BAWS CloudTrail logs
  • CEC2 instance logs
  • DElastic Load Balancer access logs (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Elastic Load Balancer access logs

Explanation

Elastic Load Balancing spreads traffic across targets in multiple AZs for availability. A load balancer distributes traffic across targets in multiple AZs for availability and scale. This option decouples the components so they scale independently and absorb load spikes.

Showing questions 141–160 of 477 · Page 8 of 24