SOA-C03 practice questions 181–189

1. Question 181 · 189 in bank

   A company has a non-production application that runs on an Amazon EC2 instance. The instance has an Amazon EBS volume attached. Each time an instance health check fails, a CloudOps engineer resolves the issue by rebooting the instance. The CloudOps engineer must implement an automated solution to reboot the instance after a failed health check. The CloudOps engineer creates a service-linked IAM role for Amazon EventBridge. What should the CloudOps engineer do next to meet the automation requirement?

   • ACreate an Amazon CloudWatch alarm for the HealthyHostCount metric. Include a search expression in the alarm that matches the instance. Configure the alarm to perform an EC2 reboot action when the metric value is greater than zero.
   • BCreate an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric. Include a search expression in the alarm that matches the instance. Configure the alarm to perform an EC2 recover action when the metric value is greater than zero.
   • CCreate an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric. Use the instance ID as a dimension. Configure the alarm to perform an EC2 reboot action when the metric value is greater than zero.
   • DConfigure detailed monitoring for the instance. Create an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric. Use the EC2 Amazon Machine Image (AMI) ID as a dimension. Configure the alarm to perform an EC2 stop instance operation and then an EC2 start instance operation when the metric value is greater than zero.

   Show answer

   Answer: C

   Next question

2. Question 182 · 189 in bank

   A compliance team requires all administrator passwords for Amazon RDS DB instances to be changed at least annually. Which solution meets this requirement in the MOST operationally efficient manner?

   • AStore the database credentials in AWS Secrets Manager. Configure automatic rotation for the secret every 365 days.
   • BStore the database credentials as a parameter in the RDS parameter group. Create a database trigger to rotate the password every 365 days.
   • CStore the database credentials in a private Amazon S3 bucket. Schedule an AWS Lambda function to generate a new set of credentials every 365 days.
   • DStore the database credentials in AWS Systems Manager Parameter Store as a secure string parameter. Configure automatic rotation for the parameter every 365 days.

   Show answer

   Answer: A

   Next question

3. Question 183 · 189 in bank

   A company uses AWS Organizations to manage multiple AWS accounts. Corporate policy mandates that only specific AWS Regions can be used to store and process customer data. A CloudOps engineer must prevent the provisioning of Amazon EC2 instances in unauthorized Regions by anyone in the company. What is the MOST operationally efficient solution that meets these requirements?

   • AConfigure AWS CloudTrail in all Regions to record all API activity. Create an Amazon EventBridge rule in all unauthorized Regions for ec2:RunInstances events. Use AWS Lambda to terminate the launched EC2 instances.
   • BIn each AWS account, create a managed IAM policy that uses a Region condition to deny the ec2:RunInstances action in all unauthorized Regions. Attach this policy to all IAM groups in each AWS account.
   • CIn each AWS account, create an IAM permissions boundary policy that uses a Region condition to deny the ec2:RunInstances action in all unauthorized Regions. Attach the permissions boundary policy to all IAM users in each AWS account.
   • DCreate a service control policy (SCP) in AWS Organizations to deny the ec2:RunInstances action in all unauthorized Regions. Attach this policy to the root level of the organization.

   Show answer

   Answer: D

   Next question

4. Question 184 · 189 in bank

   A company has AWS accounts in an organization in AWS Organizations. The company has built an AWS Lambda function in one account. The Lambda function needs to retrieve a list of Amazon EC2 instances that are running in another account. Which solution will provide this access MOST securely?

   • ACreate an IAM user in the account where the EC2 instances are running. Collect access keys from the user. Store these credentials in AWS Systems Manager Parameter Store in the account of the Lambda function. Configure the Lambda function to use the access key and the secret key.
   • BConfigure the Lambda function's execution role to assume a cross-account IAM role in the account where the EC2 instances are running. Modify the trust policy of the cross-account role to allow the Lambda function to assume the role. Add the AWS STS AssumeRole API operation to the Lambda function's code.
   • CFrom the management account in the organization, call the Organizations CreatePolicy API operation to create a new service control policy (SCP). Configure the SCP to grant lambda:InvokeFunction permission. Assign the SCP to the organization root.
   • DCreate a new resource-based policy for the Lambda function. In the policy, set the Principal to "*" and set the Action to lambda:InvokeFunction. Create a condition on the policy to allow access when the value of the aws:PrincipalOrgID condition key matches the organization's ID.

   Show answer

   Answer: B

   Next question

5. Question 185 · 189 in bank

   An application is running on an Amazon EC2 instance in a VPC with the default DHCP option set. The application connects to an on-premises Microsoft SQL Server database with the DNS name mssql.example.com. The application is unable to resolve the database DNS name. Which solution will fix this problem?

   • ACreate an Amazon Route 53 Resolver inbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
   • BCreate an Amazon Route 53 Resolver inbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
   • CCreate an Amazon Route 53 Resolver outbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
   • DCreate an Amazon Route 53 Resolver outbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.

   Show answer

   Answer: C

   Next question

6. Question 186 · 189 in bank

   A company uses an AWS Lambda function to process user uploads to an Amazon S3 bucket. The Lambda function runs in response to Amazon S3 PutObject events. A CloudOps engineer needs to set up monitoring for the Lambda function. The CloudOps engineer wants to receive a notification through an Amazon SNS topic if the function takes more than 10 seconds to process an event. Which solution will meet this requirement?

   • ACollect Amazon CloudWatch logs for the Lambda function. Create a metric filter to extract the PostRuntimeExtensionsDuration metric from the logs. Create a CloudWatch alarm to publish a notification to the SNS topic when the function runtime exceeds 10 seconds.
   • BCollect Amazon CloudWatch metrics for the Lambda function to extract the function runtime. Create a CloudWatch alarm to publish a notification to the SNS topic when the runtime exceeds 10 seconds.
   • CConfigure an Amazon CloudWatch metric filter to capture the runtime of the Lambda function. Set the function's timeout setting to 10 seconds. Create an SNS subscription to alert the CloudOps engineer if the function times out.
   • DUse Amazon CloudWatch Logs Insights to query Lambda logs for the function runtime. Set up a CloudWatch alarm based on the query result. Configure Amazon SNS to send notifications when function runtime exceeds 10 seconds.

   Show answer

   Answer: B

   Next question

7. Question 187 · 189 in bank

   A company recently purchased Savings Plans. The company wants to receive email notification when the company's utilization drops below 90% for a given day. Which solution will meet this requirement?

   • ACreate an Amazon CloudWatch alarm to monitor the Savings Plan check in AWS Trusted Advisor. Configure an Amazon SQS queue for email notification when the utilization drops below 90% for a given day.
   • BCreate an Amazon CloudWatch alarm to monitor the SavingsPlansUtilization metric under the AWS/SavingsPlans namespace in CloudWatch. Configure an Amazon SQS queue for email notification when the utilization drops below 90% for a given day.
   • CCreate a Savings Plans alert to monitor the daily utilization of the Savings Plans. Configure an Amazon SNS topic for email notification when the utilization drops below 90% for a given day.
   • DUse AWS Budgets to create a Savings Plans budget to track the daily utilization of the Savings Plans. Configure an Amazon SNS topic for email notification when the utilization drops below 90% for a given day.

   Show answer

   Answer: D

   Next question

8. Question 188 · 189 in bank

   A company's ecommerce application is running on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. Customers report that the website is occasionally down. When the website is down, the website returns an HTTP 500 (server error) status message to customer browsers. The Auto Scaling group's health check is configured for EC2 status checks, and the instances are healthy. Which solution will resolve the problem?

   • AReplace the ALB with a Network Load Balancer.
   • BAdd Elastic Load Balancing (ELB) health checks to the Auto Scaling group.
   • CUpdate the target group configuration on the ALB. Enable session affinity (sticky sessions).
   • DInstall the Amazon CloudWatch agent on all the instances. Configure the agent to reboot the instances.

   Show answer

   Answer: B

   Next question

9. Question 189 · 189 in bank

   A company has created a new video-on-demand (VOD) application. The application runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The company configured an Amazon CloudFront distribution and set the ALB as the origin. Because of increasing application demand, the company wants to move all video files to a central Amazon S3 bucket. A CloudOps engineer needs to ensure that video files can be cached at edge locations after the company migrates the files to Amazon S3. Which solution will meet this requirement?

   • AConfigure CloudFront to send the X-Forwarded-For header to the origin and to redirect video requests to Amazon S3 instead of the ALB.
   • BConfigure a new CloudFront cache behavior to route to Amazon S3 as a new origin, based on matching an URL path pattern.
   • CConfigure URL signing in the CloudFront distribution by using a custom policy. Ensure that video files are accessed through signed URLs only.
   • DConfigure a CloudFront origin group. Specify the required HTTP status codes to direct connection attempts to a secondary origin.

   Show answer

   Answer: B

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C03 practice, question 181. 189 questions available.