SOA-C03 practice questions 131–140

1. Question 131 · 189 in bank

   A company stores critical data in Amazon S3 buckets. A CloudOps engineer must build a solution to record all S3 API activity. Which action will meet this requirement?

   • AConfigure S3 bucket metrics to record object access logs.
   • BCreate an AWS CloudTrail trail to log data events for all S3 objects.
   • CEnable S3 server access logging for each S3 bucket.
   • DUse AWS IAM Access Analyzer for Amazon S3 to store object access logs.

   Show answer

   Answer: B

   Next question

2. Question 132 · 189 in bank

   A healthcare company uses Amazon SageMaker within a VPC to build machine learning (ML) models that use data that is stored in Amazon S3 buckets. The company wants to ensure that SageMaker accesses the data securely without using public IP addresses. Which solution will meet this requirement?

   • ACreate Amazon S3 gateway endpoints. Configure SageMaker to access the S3 buckets by using AWS PrivateLink.
   • BProvision a NAT gateway within the same VPC where the company runs SageMaker. Configure SageMaker to access the S3 buckets by using the NAT gateway.
   • CConfigure an AWS Site-to-Site VPN connection to connect SageMaker to the S3 buckets.
   • DConfigure AWS Transit Gateway to route traffic from SageMaker to the S3 buckets.

   Show answer

   Answer: A

   Next question

3. Question 133 · 189 in bank

   An ecommerce company hires a cybersecurity company to audit the ecommerce company's AWS account. The cybersecurity company requests read-only access to the account. The ecommerce company creates an IAM role, adds a trust relationship with the cybersecurity company's AWS account, and adds read-only permissions to the ecommerce company's account. An employee at the cybersecurity company unsuccessfully tries to assume the read-only role that the ecommerce company created. A CloudOps engineer at the ecommerce company must resolve the access issue. Which solution will meet this requirement?

   • AConfigure multi-factor authentication (MFA).
   • BConfigure an identity provider by using OpenID Connect (OIDC).
   • CCreate a policy that allows the sts:AssumeRole action. Add the policy to the cybersecurity employee's role. Ensure that the resource for the policy is the role that the employee needs to assume.
   • DCreate a policy that allows the sts:SetSourceIdentity action. Add the policy to the cybersecurity employee's role. Ensure that the resource for the policy is in the ecommerce company's account.

   Show answer

   Answer: C

   Next question

4. Question 134 · 189 in bank

   A company uses AWS Lambda to process files that users upload to an Amazon S3 bucket. When a user uploads a file to the S3 bucket, S3 Event Notifications invokes a Lambda function to process the file. The company wants to automatically invoke the Lambda function only for flies with a .txt extension that users upload to the S3 bucket. Which solution will meet these requirements?

   • AConfigure a Lambda function that is invoked by S3 PUT requests for .txt files in the S3 bucket.
   • BConfigure a Lambda function that is invoked by S3 GET requests for .txt files in the S3 bucket.
   • CConfigure an S3 bucket notification to send all object creation events to an Amazon SNS topic. Subscribe the Lambda function to the SNS topic. Apply a filter policy on the SNS topic for .txt file extensions.
   • DModify the existing S3 Event Notifications configuration to send events for .txt file uploads to Amazon CloudWatch Logs to invoke the existing Lambda function.

   Show answer

   Answer: A

   Next question

5. Question 135 · 189 in bank

   A company uses two production environments for deployments. A blue stack and a green stack are each behind a unique Application Load Balancer (ALB). The company wants to use DNS to send some traffic to green and gradually increase traffic over time. The company wants automatic tailback if green becomes unhealthy. Which DNS configuration will meet these requirements?

   • ACreate Amazon Route 53 weighted alias records that point to each ALB. Attach health checks. Adjust the weights during deployment.
   • BUse Amazon Route 53 latency-based alias records for both ALBs with health checks. Reduce TTL. Add a checker-latency dashboard. Rely on the policy to steer a small percentage of traffic to green during the ramp.
   • CPoint the apex at one ALB. Register blue and green as target groups. Use a listener rule with weighted targets for gradual shifts. Rely on target-group health to shift traffic.
   • DUse an Amazon Route 53 failover record. Set green as primary and blue as secondary. Set both to 50/50.

   Show answer

   Answer: A

   Next question

6. Question 136 · 189 in bank

   A company's financial department needs to view the cost details of each project in an AWS account. A CloudOps engineer must perform the initial configuration that is required to view cost for each project in Cost Explorer. Which solution will meet this requirement?

   • AActivate cost allocation tags. Add a project tag to the appropriate resources.
   • BConfigure consolidated billing. Create AWS Cost and Usage Reports.
   • CUse AWS Budgets. Create AWS Budgets reports.
   • DUse cost categories to define custom groups that are based on AWS cost and usage dimensions.

   Show answer

   Answer: A

   Next question

7. Question 137 · 189 in bank

   A CloudOps engineer wants to use AWS CloudFormation stacks to deploy Amazon CloudFront resources in an account. The CloudOps engineer will use custom domain names, such as www.example.com and example.com. When the CloudOps engineer tries to deploy a CloudFormation stack, the CloudOps engineer receives the following error: "Resource handler returned message: Invalid request provided: AWS::CloudFront::Distribution: One or more of the CNAMEs you provided are already associated with a different resource." What should the CloudOps engineer do to deploy the stack successfully?

   • ACheck the names that are specified for CNAMEs in the stack and correct them. Redeploy the stack.
   • BCheck the number of specified CNAMEs in the stack for each distribution. Reduce the number to 10.
   • CRemove any CNAMEs that correspond to CNAMEs in the existing CloudFront resource. Redeploy the stack.
   • DRemove the CNAME property from the template. Redeploy the stack.

   Show answer

   Answer: C

   Next question

8. Question 138 · 189 in bank

   A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6-only subnets. How should a CloudOps engineer configure the VPC to meet these requirements?

   • ACreate and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
   • BCreate and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.
   • CCreate and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets.
   • DCreate and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.

   Show answer

   Answer: C

   Next question

9. Question 139 · 189 in bank

   A company is using Amazon S3 buckets to store datasets. The company has several teams that use Amazon Athena to run one-time queries against the datasets. A CloudOps engineer must implement a solution that stores each team's Athena query results in that team's individual S3 bucket. Which solution will meet this requirement?

   • ACreate individual Athena workgroups that have separate S3 query result locations.
   • BConfigure an AWS Glue Data Catalog database for each team. Instruct the teams to run their queries on tables in their separate databases.
   • CRequire each team to use the primary Athena workgroup. Instruct the teams to set individual S3 result locations when they query Athena.
   • DCreate an AWS Glue security configuration. Associate the security configuration with each team.

   Show answer

   Answer: A

   Next question

10. Question 140 · 189 in bank

    A company has a new application that runs on three Amazon EC2 instances. The EC2 instances are spread across three Availability Zones in a single AWS Region. The application is accessible on TCP port 1028. The company wants to balance traffic across all the EC2 instances. Which solution will meet these requirements with the LEAST operational overhead?

    • ACreate an Application Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group.
    • BCreate a Network Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group.
    • CCreate a Gateway Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group.
    • DLaunch an EC2 instance with HAProxy configured that forwards requests to the three IP addresses.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C03 practice, question 131. 189 questions available.