🔍

SOA-C02 — questions

Page 9 of 24 · 477 total questions.

SOA-C02 Question 161

Single page →
Topic 1 · Question 161

A company’s SysOps administrator deploys a public Network Load Balancer (NLB) in front of the company’s web application. The web application does not use any Elastic IP addresses. Users must access the web application by using the company’s domain name. The SysOps administrator needs to configure Amazon Route 53 to route traffic to the NLB. Which solution will meet these requirements MOST cost-effectively?

  • ACreate a Route 53 AAAA record for the NLB.
  • BCreate a Route 53 alias record for the NLB. (correct answer)
  • CCreate a Route 53 CAA record for the NLB.
  • DCreate a Route 53 CNAME record for the NLB.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a Route 53 alias record for the NLB.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. This option delivers the requirement at the lowest cost.

SOA-C02 Question 162

Single page →
Topic 1 · Question 162

A company runs an encrypted Amazon RDS for Oracle DB instance. The company wants to make regular backups available in another AWS Region. What is the MOST operationally efficient solution that meets these requirements?

  • AModify the DB instance. Enable cross-Region automated backups. (correct answer)
  • BCreate an RDS read replica in another Region. Create a snapshot of the read replica.
  • CUse AWS Database Migration Service (AWS DMS) to copy the data to a DB instance in another Region.
  • DTemporarily turn off encryption on the DB instance. Take a snapshot. Copy the snapshot to another Region.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Modify the DB instance. Enable cross-Region automated backups.

Explanation

AWS Backup centrally automates and manages backups across AWS services.

SOA-C02 Question 163

Single page →
Topic 1 · Question 163

A company is rolling out a new version of its website. Management wants to deploy the new website in a limited rollout to 20% of the company’s customers. The company uses Amazon Route 53 for its website’s DNS solution. Which configuration will meet these requirements?

  • ACreate a failover routing policy. Within the policy, configure 80% of the website traffic to be sent to the original resource. Configure the remaining 20% of traffic as the failover record that points to the new resource.
  • BCreate a multivalue answer routing policy. Within the policy, create 4 records with the name and IP address of the original resource. Configure 1 record with the name and IP address of the new resource.
  • CCreate a latency-based routing policy. Within the policy, configure a record pointing to the original resource with a weight of 80. Configure a record pointing to the new resource with a weight of 20.
  • DCreate a weighted routing policy. Within the policy, configure a weight of 80 for the record pointing to the original resource. Configure a weight of 20 for the record pointing to the new resource. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a weighted routing policy. Within the policy, configure a weight of 80 for the record pointing to the original resource. Configure a weight of 20 for the record pointing to the new resource.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 164

Single page →
Topic 1 · Question 164

A SysOps administrator created an AWS CloudFormation template that provisions Amazon EC2 instances, an Elastic Load Balancer (ELB), and an Amazon RDS DB instance. During stack creation, the creation of the EC2 instances and the creation of the ELB are successful. However, the creation of the DB instance fails. What is the default behavior of CloudFormation in this scenario?

  • ACloudFormation will roll back the stack and delete the stack.
  • BCloudFormation will roll back the stack but will not delete the stack. (correct answer)
  • CCloudFormation will prompt the user to roll back the stack or continue.
  • DCloudFormation will successfully complete the stack but will report a failed status for the DB instance.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: CloudFormation will roll back the stack but will not delete the stack.

Explanation

AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 165

Single page →
Topic 1 · Question 165

A SysOps administrator needs to automate the invocation of an AWS Lambda function. The Lambda function must run at the end of each day to generate a report on data that is stored in an Amazon S3 bucket. What is the MOST operationally efficient solution that meets these requirements?

  • ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule that has an event pattern for Amazon S3 and the Lambda function as a target.
  • BCreate an Amazon EventBridge (Amazon CloudWatch Events) rule that has a schedule and the Lambda function as a target. (correct answer)
  • CCreate an S3 event notification to invoke the Lambda function whenever objects change in the S3 bucket.
  • DDeploy an Amazon EC2 instance with a cron job to invoke the Lambda function.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Amazon EventBridge (Amazon CloudWatch Events) rule that has a schedule and the Lambda function as a target.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 166

Single page →
Topic 1 · Question 166

A company is releasing a new static website hosted on Amazon S3. The static website hosting feature was enabled on the bucket and content was uploaded; however, upon navigating to the site, the following error message is received: 403 Forbidden - Access Denied What change should be made to fix this error?

  • AAdd a bucket policy that grants everyone read access to the bucket.
  • BAdd a bucket policy that grants everyone read access to the bucket objects. (correct answer)
  • CRemove the default bucket policy that denies read access to the bucket.
  • DConfigure cross-origin resource sharing (CORS) on the bucket.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Add a bucket policy that grants everyone read access to the bucket objects.

SOA-C02 Question 167

Single page →
Topic 1 · Question 167

A company uses AWS Organizations. A SysOps administrator wants to use AWS Compute Optimizer and AWS tag policies in the management account to govern all member accounts in the billing family. The SysOps administrator navigates to the AWS Organizations console but cannot activate tag policies through the management account. What could be the reason for this issue?

  • AAll features have not been enabled in the organization. (correct answer)
  • BConsolidated billing has not been enabled.
  • CThe member accounts do not have tags enabled for cost allocation.
  • DThe member accounts have not manually enabled trusted access for Compute Optimizer.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: All features have not been enabled in the organization.

SOA-C02 Question 168

Single page →
Topic 1 · Question 168

A company is storing media content in an Amazon S3 bucket and uses Amazon CloudFront to distribute the content to its users. Due to licensing terms, the company is not authorized to distribute the content in some countries. A SysOps administrator must restrict access to certain countries. What is the MOST operationally efficient solution that meets these requirements?

  • AConfigure the S3 bucket policy to deny the GetObject operation based on the S3:LocationConstraint condition.
  • BCreate a secondary origin access identity (OAI). Configure the S3 bucket policy to prevent access from unauthorized countries.
  • CEnable the geo restriction feature in the CloudFront distribution to prevent access from unauthorized countries. (correct answer)
  • DUpdate the application to generate signed CloudFront URLs only for IP addresses in authorized counties.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable the geo restriction feature in the CloudFront distribution to prevent access from unauthorized countries.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SOA-C02 Question 169

Single page →
Topic 1 · Question 169

A SysOps administrator created an Amazon VPC with an IPv6 CIDR block, which requires access to the internet. However, access from the internet towards the VPC is prohibited. After adding and configuring the required components to the VPC, the administrator is unable to connect to any of the domains that reside on the internet. What additional route destination rule should the administrator add to the route tables?

  • ARoute ::/0 traffic to a NAT gateway
  • BRoute ::/0 traffic to an internet gateway
  • CRoute 0.0.0.0/0 traffic to an egress-only internet gateway
  • DRoute ::/0 traffic to an egress-only internet gateway (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Route::/0 traffic to an egress-only internet gateway.

SOA-C02 Question 170

Single page →
Topic 1 · Question 170

A company hosts several write-intensive applications. These applications use a MySQL database that runs on a single Amazon EC2 instance. The company asks a SysOps administrator to implement a highly available database solution that is ideal for multi-tenant workloads. Which solution should the SysOps administrator implement to meet these requirements?

  • ACreate a second EC2 instance for MySQL. Configure the second instance to be a read replica.
  • BMigrate the database to an Amazon Aurora DB cluster. Add an Aurora Replica.
  • CMigrate the database to an Amazon Aurora multi-master DB cluster. (correct answer)
  • DMigrate the database to an Amazon RDS for MySQL DB instance.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Migrate the database to an Amazon Aurora multi-master DB cluster.

Explanation

Amazon Aurora is a high-performance managed relational database with built-in replication and failover. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 171

Single page →
Topic 1 · Question 171

A company has a memory-intensive application that runs on a fleet of Amazon EC2 instances behind an Elastic Load Balancer (ELB). The instances run in an Auto Scaling group. A SysOps administrator must ensure that the application can scale based on the number of users that connect to the application. Which solution will meet these requirements?

  • ACreate a scaling policy that will scale the application based on the ActiveConnectionCount Amazon CloudWatch metric that is generated from the ELB. (correct answer)
  • BCreate a scaling policy that will scale the application based on the mem_used Amazon CloudWatch metric that is generated from the ELB.
  • CCreate a scheduled scaling policy to increase the number of EC2 instances in the Auto Scaling group to support additional connections.
  • DCreate and deploy a script on the ELB to expose the number of connected users as a custom Amazon CloudWatch metric. Create a scaling policy that uses the metric.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a scaling policy that will scale the application based on the ActiveConnectionCount Amazon CloudWatch metric that is generated from the ELB.

Explanation

Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 172

Single page →
Topic 1 · Question 172

A SysOps administrator creates a new VPC that includes a public subnet and a private subnet. The SysOps administrator successfully launches 11 Amazon EC2 instances in the private subnet. The SysOps administrator attempts to launch one more EC2 instance in the same subnet. However, the SysOps administrator receives an error message that states that not enough free IP addresses are available. What must the SysOps administrator do to deploy more EC2 instances?

  • AEdit the private subnet to change the CIDR block to /27.
  • BEdit the private subnet to extend across a second Availability Zone.
  • CAssign additional Elastic IP addresses to the private subnet.
  • DCreate a new private subnet to hold the required EC2 instances. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a new private subnet to hold the required EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 173

Single page →
Topic 1 · Question 173

A company needs to automatically monitor an AWS account for potential unauthorized AWS Management Console logins from multiple geographic locations. Which solution will meet this requirement?

  • AConfigure Amazon Cognito to detect any compromised IAM credentials.
  • BSet up Amazon Inspector. Scan and monitor resources for unauthorized logins.
  • CSet up AWS Config. Add the iam-policy-blacklisted-check managed rule to the account.
  • DConfigure Amazon GuardDuty to monitor the UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B finding. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Amazon GuardDuty to monitor the UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B finding.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Amazon GuardDuty continuously monitors for threats and malicious activity. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 174

Single page →
Topic 1 · Question 174 · Select all that apply

A company has an Amazon RDS DB instance. The company wants to implement a caching service while maintaining high availability. Which combination of actions will meet these requirements? (Choose two.)

  • AAdd Auto Discovery to the data store.
  • BCreate an Amazon ElastiCache for Memcached data store.
  • CCreate an Amazon ElastiCache for Redis data store. (correct answer)
  • DEnable Multi-AZ for the data store. (correct answer)
  • EEnable Multi-threading for the data store.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Create an Amazon ElastiCache for Redis data store. Option D: Enable Multi-AZ for the data store.

Explanation

Amazon ElastiCache provides in-memory caching (Redis/Memcached) to reduce latency and offload the database.

SOA-C02 Question 175

Single page →
Topic 1 · Question 175

A company monitors its account activity using AWS CloudTrail, and is concerned that some log files are being tampered with after the logs have been delivered to the account’s Amazon S3 bucket. Moving forward, how can the SysOps administrator confirm that the log files have not been modified after being delivered to the S3 bucket?

  • AStream the CloudTrail logs to Amazon CloudWatch Logs to store logs at a secondary location.
  • BEnable log file integrity validation and use digest files to verify the hash value of the log file. (correct answer)
  • CReplicate the S3 log bucket across regions, and encrypt log files with S3 managed keys.
  • DEnable S3 server access logging to track requests made to the log bucket for security audits.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable log file integrity validation and use digest files to verify the hash value of the log file.

SOA-C02 Question 176

Single page →
Topic 1 · Question 176

A SysOps administrator is reviewing AWS Trusted Advisor warnings and encounters a warning for an S3 bucket policy that has open access permissions. While discussing the issue with the bucket owner, the administrator realizes the S3 bucket is an origin for an Amazon CloudFront web distribution. Which action should the administrator take to ensure that users access objects in Amazon S3 by using only CloudFront URLs?

  • AEncrypt the S3 bucket content with Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
  • BCreate an origin access identity and grant it permissions to read objects in the S3 bucket. (correct answer)
  • CAssign an IAM user to the CloudFront distribution and grant the user permissions in the S3 bucket policy.
  • DAssign an IAM role to the CloudFront distribution and grant the role permissions in the S3 bucket policy.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an origin access identity and grant it permissions to read objects in the S3 bucket.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 177

Single page →
Topic 1 · Question 177

A SysOps administrator is reviewing AWS Trusted Advisor recommendations. The SysOps administrator notices that all the application servers for a finance application are listed in the Low Utilization Amazon EC2 Instances check. The application runs on three instances across three Availability Zones. The SysOps administrator must reduce the cost of running the application without affecting the application’s availability or design. Which solution will meet these requirements?

  • AReduce the number of application servers.
  • BApply rightsizing recommendations from AWS Cost Explorer to reduce the instance size. (correct answer)
  • CProvision an Application Load Balancer in front of the instances.
  • DScale up the instance size of the application servers.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Apply rightsizing recommendations from AWS Cost Explorer to reduce the instance size.

Explanation

AWS Cost Explorer analyzes and visualizes AWS spend.

SOA-C02 Question 178

Single page →
Topic 1 · Question 178

A company hosts its website in the us-east-1 Region. The company is preparing to deploy its website into the eu-central-1 Region. Website visitors who are located in Europe should access the website that is hosted in eu-central-1. All other visitors access the website that is hosted in us-east-1. The company uses Amazon Route 53 to manage the website’s DNS records. Which routing policy should a SysOps administrator apply to the Route 53 record set to meet these requirements?

  • AGeolocation routing policy (correct answer)
  • BGeoproximity routing policy
  • CLatency routing policy
  • DMultivalue answer routing policy
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Geolocation routing policy.

SOA-C02 Question 179

Single page →
Topic 1 · Question 179

An organization with a large IT department has decided to migrate to AWS. With different job functions in the IT department, it is not desirable to give all users access to all AWS resources. Currently the organization handles access via LDAP group membership. What is the BEST method to allow access using current LDAP credentials?

  • ACreate an AWS Directory Service Simple AD. Replicate the on-premises LDAP directory to Simple AD.
  • BCreate a Lambda function to read LDAP groups and automate the creation of IAM users.
  • CUse AWS CloudFormation to create IAM roles. Deploy Direct Connect to allow access to the on-premises LDAP server.
  • DFederate the LDAP directory with IAM using SAML. Create different IAM roles to correspond to different LDAP groups to limit permissions. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Federate the LDAP directory with IAM using SAML. Create different IAM roles to correspond to different LDAP groups to limit permissions.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SOA-C02 Question 180

Single page →
Topic 1 · Question 180

A SysOps administrator has created an Amazon EC2 instance using an AWS CloudFormation template in the us-east-1 Region. The administrator finds that this template has failed to create an EC2 instance in the us-west-2 Region. What is one cause for this failure?

  • AResource tags defined in the CloudFormation template are specific to the us-east-1 Region.
  • BThe Amazon Machine Image (AMI) ID referenced in the CloudFormation template could not be found in the us-west-2 Region. (correct answer)
  • CThe cfn-init script did not run during resource provisioning in the us-west-2 Region.
  • DThe IAM user was not created in the specified Region.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: The Amazon Machine Image (AMI) ID referenced in the CloudFormation template could not be found in the us-west-2 Region.

Explanation

AWS CloudFormation provisions infrastructure as code repeatably.

Showing questions 161–180 of 477 · Page 9 of 24