SOA-C03 practice questions 171–180

1. Question 171 · 189 in bank

   A company uses an AWS Cloud Formation template to provision an Amazon EC2 instance and an Amazon RDS DB instance. A CloudOps engineer must update the template to ensure that the DB instance is created before the EC2 instance is launched. What should the CloudOps engineer do to meet this requirement?

   • AAdd a wait condition to the template. Update the EC2 instance user data script to send a signal after the EC2 instance is started.
   • BAdd the DependsOn attribute to the EC2 instance resource, and provide the logical name of the RDS resource.
   • CChange the order of the resources in the template so that the RDS resource is listed before the EC2 instance resource.
   • DCreate multiple templates. Use AWS CloudFormation StackSets to wait for one stack to complete before the second stack is created.

   Show answer

   Answer: B

   Next question

2. Question 172 · 189 in bank

   A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company's risk team must receive immediate notification about any delete events. Which solution will meet these requirements?

   • AEnable S3 server access logging for audit logs. Set up an Amazon SNS notification for the S3 bucket. Select DeleteObject for the event type for the alert system.
   • BEnable S3 server access logging for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance to download the access logs each day and to scan for a DeleteObject event.
   • CUse Amazon CloudWatch Logs for audit logs. Use Amazon CloudWatch alarms with an Amazon SNS notification for the alert system.
   • DUse Amazon CloudWatch Logs for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance each day to compare the list of the items with the list from the previous day. Configure the cron job to send a notification if an item is missing.

   Show answer

   Answer: A

   Next question

3. Question 173 · 189 in bank

   A company wants to automate the processing of photos that upload to an Amazon S3 bucket. A CloudOps engineer must invoke a 2-minute processing workflow immediately when a new photo uploads. The CloudOps engineer must initiate the workflow by using a native S3 notification destination. Which solution will meet these requirements with the LEAST operational overhead?

   • ASend an Amazon S3 event notification to an Amazon SQS queue to invoke an AWS Lambda function for processing.
   • BConfigure an Amazon S3 event notification to invoke an AWS Lambda function upon each object upload.
   • CConfigure an Amazon S3 event notification to publish events to an Amazon EventBridge bus that routes events to an AWS Lambda function.
   • DConfigure an Amazon S3 event notification to notify an AWS Step Functions state machine to start the transformation process.

   Show answer

   Answer: B

   Next question

4. Question 174 · 189 in bank

   A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account. A CloudOps engineer needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account. What must the CloudOps engineer do to meet this requirement?

   • ACreate a new AWS KMS key in the shared account. Configure the key policy to give read access to the development account's root principal.
   • BRequest a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
   • CRequest a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
   • DCreate a new AWS KMS key in the development account. Configure the key policy to give read access to the shared account's root principal. Use Route 53 from the shared account to create a validation record set that references the Amazon Resource Name (ARN) of the KMS key.

   Show answer

   Answer: C

   Next question

5. Question 175 · 189 in bank

   A retail company runs its primary ecommerce web application in the us-east-1 AWS Region with a fully configured disaster recovery (DR) environment in the us-west-2 Region. The company requires automatic failover to the DR environment if the primary environment becomes unhealthy. How should the company configure Amazon Route 53 to enable automated failover between the primary and DR environments?

   • ACreate a Route 53 health check that monitors the primary web application endpoint. Configure a failover routing policy with primary and secondary records that point to the respective primary and secondary environments. Set the primary record with the health check association. Configure the secondary record as the failover record.
   • BCreate two Route 53 latency-based routing records. Point one routing record at each environment. Configure Amazon CloudWatch alarms to monitor the primary environment. Use an Amazon EventBridge rule to update the latency routing weights when the primary environment becomes unhealthy.
   • CConfigure a Route 53 geolocation routing policy that directs all global traffic to the primary Region by default. Set up Route 53 DNS Firewall rules to detect application failures and automatically update the geolocation routing to redirect traffic to the secondary Region.
   • DDeploy Route 53 Resolver DNS Firewall rule groups in both Regions. Configure Amazon CloudWatch alarms to monitor the primary environment. Use Amazon EventBridge rules to trigger DNS Firewall actions that redirect queries to the DR environment when failures occur.

   Show answer

   Answer: A

   Next question

6. Question 176 · 189 in bank

   A CloudOps engineer must load test a new Amazon CloudFront distribution to assess data transfer and latency performance. Which solution will meet this requirement?

   • ASend client requests from a single geographic region. Configure the load test so that each client makes an identical DNS request. Focus the client requests on the IP address that the DNS returns.
   • BSend client requests from a single geographic region. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.
   • CSend client requests from multiple geographic regions. Configure the load test so that each client makes an identical DNS request. Focus the client requests on the IP address that the DNS returns.
   • DSend client requests from multiple geographic regions. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.

   Show answer

   Answer: D

   Next question

7. Question 177 · 189 in bank

   A company is expanding globally and needs to back up data on Amazon EBS volumes to a different AWS Region. Most of the EBS volumes that store the data are encrypted, but some of the EBS volumes are unencrypted. The company needs the backup data from all the EBS volumes to be encrypted. Which solution will meet these requirements with the LEAST management overhead?

   • AConfigure a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM) to create the EBS volume snapshots with cross-Region backups enabled. Encrypt the snapshot copies by using AWS KMS.
   • BCreate a point-in-time snapshot of the EBS volumes. When the snapshot status is COMPLETED, copy the snapshots to another Region and set the Encrypted parameter to False.
   • CCreate a point-in-time snapshot of the EBS volumes. Copy the snapshots to an Amazon S3 bucket that uses server-side encryption. Turn on S3 CrossRegion Replication on the S3 bucket.
   • DSchedule an AWS Lambda function with the Python runtime. Configure the Lambda function to create the EBS volume snapshots, encrypt the unencrypted snapshots, and copy the snapshots to another Region.

   Show answer

   Answer: A

   Next question

8. Question 178 · 189 in bank

   A CloudOps engineer needs to give an existing AWS Lambda function access to an existing Amazon S3 bucket. Traffic between the Lambda function and the S3 bucket must not use public IP addresses. The Lambda function has been configured to run in a VPC. Which solution will meet these requirements?

   • AConfigure VPC sharing between the Lambda VPC and the S3 bucket.
   • BAttach a transit gateway to the Lambda VPC to allow the Lambda function to connect to the S3 bucket.
   • CCreate a NAT gateway. Associate the NAT gateway with the subnet where the Lambda function is configured to run.
   • DCreate an S3 interface endpoint. Change the Lambda function to use the new S3 DNS name.

   Show answer

   Answer: D

   Next question

9. Question 179 · 189 in bank

   A company has an application that runs on Amazon EC2 instances. The application stores data on an Amazon RDS for MySQL Single-AZ DB instance. Requests to the DB instance from the application include reads and writes. A CloudOps engineer must implement a solution that provides failover for the DB instance. The solution must minimize application downtime. Which solution will meet these requirements?

   • AModify the DB instance to be a Multi-AZ DB instance deployment.
   • BAdd a read replica in the same Availability Zone where the DB instance is deployed.
   • CAdd the DB instance to an Auto Scaling group that has a minimum capacity of 2 and a desired capacity of 2.
   • DUse RDS Proxy to configure a proxy in front of the DB instance.

   Show answer

   Answer: A

   Next question

10. Question 180 · 189 in bank

    Select 2

    A company is building a web application on AWS. The company is using Amazon CloudFront with a domain name of www.example.com. All traffic to CloudFront must be encrypted in transit. The company already has provisioned an SSL certificate for www.example.com in AWS Certificate Manager (ACM). Which combination of steps should a CloudOps engineer take to encrypt the traffic in transit? (Choose two.)

    • AFor each cache behavior in the CloudFront distribution, modify the Viewer Protocol Policy setting to redirect HTTP to HTTPS.
    • BFor each cache behavior in the CloudFront distribution, modify the Viewer Protocol Policy setting to allow HTTP and HTTPS.
    • CEnter the alternate domain name (CNAME) of www.example.com for the CloudFront distribution. Select the custom SSL certificate.
    • DConfigure an AWS WAF web ACL for the CloudFront distribution.
    • EConfigure CloudFront Origin Shield for the CloudFront origin.

    Show answer

    Answer: AC

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C03 practice, question 171. 189 questions available.