SOA-C03 practice questions 141–150

1. Question 141 · 189 in bank

   Select 2

   Users are reporting consistent forced logouts from a stateful web application. The web application is hosted on Amazon EC2 instances that are in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) that has multiple target groups with one listener rule. The ALB is configured as the origin in an Amazon CloudFront distribution. Which combination of actions should a CloudOps engineer take to resolve the logout problem? (Choose two.)

   • AChange to the least outstanding requests algorithm on the ALB target group.
   • BConfigure cookie forwarding in the CloudFront distribution's cache behavior settings.
   • CConfigure header forwarding in the CloudFront distribution's cache behavior settings.
   • DEnable group-level stickiness on the ALB listener rule for the target groups.
   • EConfigure weighted target groups on the ALB.

   Show answer

   Answer: BD

   Next question

2. Question 142 · 189 in bank

   A company has a policy that requires all Amazon EC2 instances to have a specific set of tags. If an EC2 instance does not have the required tags, the noncompliant instance should be terminated. What is the MOST operationally efficient solution that meets these requirements?

   • ACreate an Amazon EventBridge rule to send all EC2 instance state changes to an AWS Lambda function to determine if each instance is compliant. Terminate any noncompliant instances.
   • BCreate an IAM policy that enforces all EC2 instance tag requirements. If the required tags are not in place for an instance, the policy will terminate noncompliant instance.
   • CCreate an AWS Lambda function to determine if each EC2 instance is compliant and terminate an instance if it is noncompliant. Schedule the Lambda function to invoke every 5 minutes.
   • DCreate an AWS Config rule to check if the required tags are present. If an EC2 instance is noncompliant, invoke an AWS Systems Manager Automation runbook to terminate the instance.

   Show answer

   Answer: D

   Next question

3. Question 143 · 189 in bank

   A company uses AWS Backup to back up critical Amazon EC2 instances daily. The company wants to test disaster recovery procedures by restoring an EC2 instance from a recent backup. Which solution will meet this requirement in the LEAST amount of time?

   • ARestore individual files from backups to the original EC2 instance to verify data integrity.
   • BRestore the most recent full backup to the original EC2 instance. Configure AWS Backup to update the instance by using changed blocks from subsequent incremental backups.
   • CIdentify the backup plan and recovery point for the EC2 instance. Use the restore backup option to create a new EC2 instance directly from the AMI-based recovery point.
   • DIdentify the backup plan and recovery point for the EC2 instance. Launch a new EC2 instance. Use AWS Backup root volume to restore the identified recovery point to the new instance.

   Show answer

   Answer: C

   Next question

4. Question 144 · 189 in bank

   A CloudOps engineer is setting up a fleet of Amazon EC2 instances in an Auto Scaling group for an application. The fleet should have 50% CPU available at all times to accommodate bursts of traffic. The load will increase significantly between the hours of 09:00 and 17:00, 7 days a week. How should the CloudOps engineer configure the scaling of the EC2 instances to meet these requirements?

   • ACreate a target tracking scaling policy that runs when the CPU utilization is higher than 90%.
   • BCreate a target tracking scaling policy that runs when the CPU utilization is higher than 50%. Create a scheduled scaling policy that ensures that the fleet is available at 09:00. Create a second scheduled scaling policy that scales in the fleet at 17:00.
   • CSet the Auto Scaling group to start with 2 instances by setting the desired instances, maximum instances, and minimum instances to 2. Create a scheduled scaling policy that ensures that the fleet is available at 09:00.
   • DCreate a scheduled scaling policy that ensures that the fleet is available at 09:00. Create a second scheduled scaling policy that scales in the fleet at 17:00.

   Show answer

   Answer: B

   Next question

5. Question 145 · 189 in bank

   A company runs a website from Sydney, Australia. Users in the United States (US) and Europe are reporting that images and videos are taking a long time to load. However, local testing in Australia indicates no performance issues. The website has a large amount of static content in the form of images and videos that are stored in Amazon S3. Which solution will result in the MOST improvement in the user experience for users in the US and Europe?

   • AConfigure AWS PrivateLink for Amazon S3.
   • BConfigure S3 Transfer Acceleration.
   • CCreate an Amazon CloudFront distribution. Distribute the static content to the CloudFront edge locations.
   • DCreate an Amazon API Gateway API in each AWS Region. Cache the content locally.

   Show answer

   Answer: C

   Next question

6. Question 146 · 189 in bank

   A gaming company uses Amazon EC2 Spot Instances to run game servers. Currently, the company uses small instance types. However, the company occasionally experiences spot unavailability. The company needs a solution that can automatically modify a spot request and add a new instance family when current instance types are unavailable. Which solution will meet this requirement?

   • AUse Amazon CloudWatch to log the event instance-stopped-no-capacity. Invoke an AWS Lambda function to modify the spot request.
   • BUse AWS CloudTrail to log EC2 spot request state changes. Configure an Amazon EventBridge rule on the CloudTrail log to invoke an AWS Lambda function to modify the spot request.
   • CUse Amazon CloudWatch logs and metrics to invoke an AWS Lambda function to modify the spot request.
   • DConfigure AWS Systems Manager Automation to detect spot request failures and run a runbook to implement the spot request.

   Show answer

   Answer: A

   Next question

7. Question 147 · 189 in bank

   A company has multiple AWS accounts that run applications in different AWS Regions. The company has configured Amazon CloudWatch alarms in each account to monitor CPU utilization and request latency metrics. An operations team must create a centralized dashboard in a single Region within the operations team's AWS account. The dashboard needs to be able to display metrics and alarm states from all applications. Which solution will meet these requirements?

   • AEnable the CloudWatch cross-account cross-Region console in each application account. Configure the sharing of metrics and alarms with the operations team's AWS account. In the operations team's AWS account, create a CloudWatch dashboard with the metrics and alarms from the application account.
   • BCreate an Amazon EventBridge rule in each application account to forward CloudWatch alarm state changes to an Amazon SNS topic in the operations team's AWS account. In the operations team's AWS account, create a CloudWatch dashboard with the metrics and alarms from the application accounts.
   • CDeploy AWS Lambda functions in each application account. Configure the functions to periodically extract CloudWatch metrics and alarm states and copy the values to CloudWatch in the operations team's AWS account. In the operations team's AWS account, create a CloudWatch dashboard with the metrics and alarms from the application accounts.
   • DSet up CloudWatch cross-account observability. Designate the operations team's AWS account as the monitoring account. Configure the application accounts as source accounts. In the operations team's AWS account, create a CloudWatch dashboard with the metrics and alarms from the application accounts.

   Show answer

   Answer: D

   Next question

8. Question 148 · 189 in bank

   A company needs to view a list of security groups that are open to the internet on port 3389. What should a CloudOps engineer do to meet this requirement?

   • AConfigure Amazon GuardDuty to scan security groups and report unrestricted access on port 3389.
   • BConfigure a service control policy (SCP) to identify security groups that allow unrestricted access on port 3389.
   • CUse AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.
   • DUse AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389.

   Show answer

   Answer: D

   Next question

9. Question 149 · 189 in bank

   A development team is building an application that will use an Amazon API Gateway REST API and AWS Lambda functions to receive and process requests. The Lambda functions will deliver messages to an Amazon SNS topic. External stakeholders subscribe to the SNS topic. The company wants to prevent sensitive data from being published to the SNS topic. Which solution will meet these requirements?

   • AAssociate a data protection policy with the SNS topic. Define policy statements that identify and protect the sensitive data.
   • BRun a sensitive data discovery job in Amazon Macie. Define the scope to identify and redact sensitive information within the workflow before publishing messages to the SNS topic.
   • CDeploy Amazon GuardDuty Lambda Protection. Define sensitive data patterns that generate specific finding types when the patterns are matched. Send notifications to the development team.
   • DUse Amazon Inspector to scan the Lambda function code for sensitive information. Activate an alert when Amazon Inspector finds sensitive information.

   Show answer

   Answer: A

   Next question

10. Question 150 · 189 in bank

    A CloudOps engineer has an AWS CloudFormation template that deploys an encrypted Amazon Machine Image (AMI). The AMI is encrypted with an AWS KMS asymmetric key. The CloudFormation template needs to be used in a second account. The CloudOps engineer copies the encrypted AMI to the second account. The new CloudFormation stack in the second account fails to launch. Which action should the CloudOps engineer take to resolve this issue?

    • AUpdate the CloudFormation template with the ID of the AMI in the second account. In the KMS key policy, allow the second account to access the KMS key.
    • BConvert the KMS key to a symmetric key. Copy the AMI to the second account. Deregister the AMI in the initial account. Register the AMI in the second account.
    • CExport the KMS key from the initial account. Import the KMS key into the second account. Update the CloudFormation template with the KMS key's new Amazon Resource Name (ARN).
    • DExport the KMS key from the initial account. Change the AMI permissions to mark the AMI as public. Import the KMS key into the second account.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C03 practice, question 141. 189 questions available.