SOA-C03 practice questions 101–110

1. Question 101 · 189 in bank

   Select 2

   A company is managing a website with a global user base hosted on Amazon EC2 with an Application Load Balancer (ALB). To reduce the load on the web servers, a CloudOps engineer configures an Amazon CloudFront distribution with the ALB as the origin. After a week of monitoring the solution, the CloudOps engineer notices that requests are still being served by the ALB and there is no change in the web server load. What are possible causes for this problem? (Choose two.)

   • ACloudFront does not have the ALB configured as the origin access identity.
   • BThe DNS is still pointing to the ALB instead of the CloudFront distribution.
   • CThe ALB security group is not permitting inbound traffic from CloudFront.
   • DThe default, minimum, and maximum Time to Live (TTL) are set to 0 seconds on the CloudFront distribution.
   • EThe target groups associated with the ALB are configured for sticky sessions.

   Show answer

   Answer: BD

   Next question

2. Question 102 · 189 in bank

   A CloudOps engineer has used AWS CloudFormation to deploy a serverless application into a production VPC. The application consists of an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway API. The CloudOps engineer must delete the AWS CloudFormation stack without deleting the DynamoDB table. Which action should the CloudOps engineer take before deleting the AWS CloudFormation stack?

   • AAdd a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
   • BAdd a Snapshot deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
   • CEnable termination protection on the AWS CloudFormation stack.
   • DUpdate the application's IAM policy with a Deny statement for the dynamodb:DeleteTable action.

   Show answer

   Answer: A

   Next question

3. Question 103 · 189 in bank

   A CloudOps engineer manages policies for many AWS member accounts in an AWS Organizations structure. Administrators on other teams have access to the account root user credentials of the member accounts. The CloudOps engineer must prevent all teams, including their administrators, from using Amazon DynamoDB. The solution must not affect the ability of the teams to access other AWS services. Which solution will meet these requirements?

   • AIn all member accounts, configure IAM policies that deny access to all DynamoDB resources for all users, including the root user.
   • BCreate a service control policy (SCP) in the management account to deny all DynamoDB actions. Apply the SCP to the root of the organization.
   • CIn all member accounts, configure IAM policies that deny AmazonDynamoDBFullAccess to all users, including the root user.
   • DRemove the default service control policy (SCP) in the management account. Create a replacement SCP that includes a single statement that denies all DynamoDB actions.

   Show answer

   Answer: B

   Next question

4. Question 104 · 189 in bank

   Select 2

   A CloudOps engineer must create an IAM policy for a developer who needs access to specific AWS services. Based on the requirements, the CloudOps engineer creates the following policy:

   

   Which actions does this policy allow? (Choose two.)

   • ACreate an AWS Storage Gateway.
   • BCreate an IAM role for an AWS Lambda function.
   • CDelete an Amazon SQS queue.
   • DDescribe AWS load balancers.
   • EInvoke an AWS Lambda function.

   Show answer

   Answer: DE

   Next question

5. Question 105 · 189 in bank

   A development team wants to match events on Amazon EventBridge where the state of an Amazon EC2 machine is not "terminated". An example event is as follows:

   

   Which event pattern should the development team use to find relevant events?

   • A{"detail": {"state": ["not equals-ignore-case": "terminated"]}}
   • B{"detail": {"state": ["! equals-ignore-case": "terminated"]}}
   • C{"detail": {"state": ["equals-ignore-case": "terminated"]}}
   • D{"detail": {"state": [{"anything-but": {"equals-ignore-case": "terminated"}}]}}

   Show answer

   Answer: D

   Next question

6. Question 106 · 189 in bank

   A CloudOps engineer is working on cost savings for a company. The CloudOps engineer notices multiple unused Elastic IP addresses. The addresses are spread across different accounts and AWS Regions in an organization in AWS Organizations. The CloudOps engineer must administer and track the addresses based on security domains. The CloudOps engineer must be able to view the history of assigned addresses. Which solution will meet these requirements?

   • AEnable AWS Config with an IP address tracking rule.
   • BUse Amazon CloudWatch with custom IP metrics to view addresses by account and Region.
   • CEnable Amazon VPC IP Address Manager for Organizations integrations.
   • DIn AWS Systems Manager Inventory, enable a resource data sync to Amazon S3 for IP tracking.

   Show answer

   Answer: C

   Next question

7. Question 107 · 189 in bank

   A company has a software as a service (SaaS) application. The company has integrated the application with AWS services by using the AWS SDK and an IAM user's access key ID and secret access key. The company needs to implement the principle of least privilege for the IAM user. The company must avoid the usage of permanent credentials. Which solution will meet these requirements?

   • AMigrate the application to use the AWS STS AssumeRoleWithSAML API operation.
   • BMigrate the application to use the AWS STS AssumeRole API operation. Allow the IAM user to call only AWS STS.
   • CAdd a policy to the existing IAM user to scope the permissions to only the permissions that the user needs for the application.
   • DAdd an IAM group to scope the permissions to only the permissions that the user needs for the application. Add the IAM user to the IAM group.

   Show answer

   Answer: B

   Next question

8. Question 108 · 189 in bank

   A company has many accounts in an organization in AWS Organizations. The company must automate resource provisioning from the organization's management account to the member accounts. Which solution will meet this requirement?

   • ACreate an AWS CloudFormation change set. Deploy the change set to all member accounts.
   • BCreate an AWS CloudFormation nested stack. Deploy the nested stack to all member accounts.
   • CCreate an AWS CloudFormation stack set. Deploy the stack set to all member accounts.
   • DCreate an AWS SAM template. Deploy the template to all member accounts.

   Show answer

   Answer: C

   Next question

9. Question 109 · 189 in bank

   To comply with regulations, a CloudOps engineer needs to back up an Amazon EC2 Amazon Machine Image (AMI) to an Amazon S3 bucket. If the CloudOps engineer restores the AMI from the bucket in the future, the AMI must use the same AMI image ID as the original AMI. Which solution will meet this requirement?

   • ACreate a copy of the AMI. Specify the destination S3 bucket. Set the launch permissions to implicit.
   • BArchive the snapshot that is associated with the AMI. Specify the S3 bucket as the archive destination.
   • CCreate a store image task. Specify the image ID and the destination S3 bucket.
   • DUse the AWS CLI copy-image command. Specify the image ID and the destination S3 bucket.

   Show answer

   Answer: C

   Next question

10. Question 110 · 189 in bank

    A CloudOps engineer has blocked public access to all company Amazon S3 buckets. The CloudOps engineer wants to be notified when an S3 bucket becomes publicly readable in the future. What is the MOST operationally efficient way to meet this requirement?

    • ACreate an AWS Lambda function that periodically checks the public access settings for each S3 bucket. Set up Amazon SNS to send notifications.
    • BCreate a cron script that uses the S3 API to check the public access settings for each S3 bucket. Set up Amazon SNS to send notifications.
    • CEnable S3 Event Notifications for each S3 bucket. Subscribe S3 Event Notifications to an Amazon SNS topic.
    • DEnable the s3-bucket-public-read-prohibited managed rule in AWS Config. Subscribe the AWS Config rule to an Amazon SNS topic.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C03 practice, question 101. 189 questions available.