SOA-C03 practice questions 61–70

1. Question 61 · 189 in bank

   Select 2

   A CloudOps engineer wants to provide access to AWS services by attaching an IAM policy to multiple IAM users The CloudOps engineer also wants to be able to change the policy and create new versions. Which combination of actions will meet these requirements? (Choose two.)

   • AAdd the users to an IAM service-linked role. Attach the policy to the role.
   • BAdd the users to an IAM user group. Attach the policy to the group.
   • CCreate an AWS managed policy.
   • DCreate a customer managed policy.
   • ECreate an inline policy.

   Show answer

   Answer: BD

   Next question

2. Question 62 · 189 in bank

   A company runs an application on Amazon EC2 instances that are in an Amazon EC2 Auto Scaling group. Scale-out actions take a long time to become complete because of long-running boot scripts. A CloudOps engineer must implement a solution to reduce the required time for scale-out actions without overprovisioning the Auto Scaling group. Which solution will meet these requirements?

   • AChange the launch configuration to use a larger instance size.
   • BIncrease the minimum number of instances in the Auto Scaling group.
   • CAdd a predictive scaling policy to the Auto Scaling group.
   • DAdd a warm pool to the Auto Scaling group.

   Show answer

   Answer: D

   Next question

3. Question 63 · 189 in bank

   A CloudOps engineer creates a new VPC that includes a public subnet and a private subnet. The CloudOps engineer successfully launches 11 Amazon EC2 instances in the private subnet The CloudOps engineer attempts to launch one more EC2 instance in the same subnet. However, the CloudOps engineer receives an error message that states that not enough free IP addresses are available. What must the CloudOps engineer do to deploy more EC2 instances?

   • AEdit the private subnet to change the CIDR block to /27.
   • BEdit the private subnet to extend across a second Availability Zone.
   • CAssign additional Elastic IP addresses to the private subnet.
   • DCreate a new private subnet to hold the required EC2 instances.

   Show answer

   Answer: D

   Next question

4. Question 64 · 189 in bank

   A CloudOps engineer needs to build an event infrastructure for a set of custom application-specific events. The events must be sent to an AWS Lambda function for processing. The CloudOps engineer must record the events to replay later by event type or event time. Which solution will meet these requirements?

   • ACreate an Amazon EventBridge custom event bus. Create an archive on the custom event bus. Create a rule to send the custom events to the Lambda function.
   • BCreate an archive on the Amazon EventBridge default event bus. Use pattern matching to record the custom events. Create a rule to send the custom events to the Lambda function.
   • CCreate an archive on the Amazon EventBridge default event bus. Create an EventBridge pipe to ingest the custom events and to save the custom events in the archive. Create a rule to send the custom events to the Lambda function.
   • DCreate a log group in Amazon CloudWatch Logs. Create an Amazon EventBridge rule to send the custom events to the Lambda function and to the log group.

   Show answer

   Answer: A

   Next question

5. Question 65 · 189 in bank

   Select 2

   A CloudOps engineer has an AWS CloudFormation template of the company's existing infrastructure in us-west-2. The CloudOps engineer attempts to use the template to launch a new stack in eu-west-1, but the stack only partially deploys, receives an error message, and then rolls back. Why would this template fail to deploy? (Choose two.)

   • AThe template referenced an IAM user that is not available in eu-west-1.
   • BThe template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1.
   • CThe template did not have the proper level of permissions to deploy the resources.
   • DThe template requested services that do not exist in eu-west-1.
   • ECloudFormation templates can be used only to update existing services

   Show answer

   Answer: BD

   Next question

6. Question 66 · 189 in bank

   A company's website runs on an Amazon EC2 Linux instance. The website needs to serve PDF files from an Amazon S3 bucket. All public access to S3 bucket is blocked at the account level. The company needs to allow website users to download the PDF files. Which solution will meet these requirements with the LEAST administrative effort?

   • ACreate an IAM role that has a policy that allows s3:list* and s3:get* permissions. Assign the role to the EC2 instance. Assign a company employee to download requested PDF file to the EC2 instance and to deliver the files to website users. Create an AWS Lambda function to periodically delete local files.
   • BCreate an Amazon CloudFront distribution that uses an origin access control (OAC) that points to the S3 bucket. Apply a bucket policy to the bucket to allow connections from the CloudFront distribution. Assign a company employee to provide a download URL that contains the distribution URL and the object path to users when users request PDF files.
   • CChange the S3 bucket permissions to allow public access on the source S3 bucket. Assign a company employee to provide a PDF file URL to users when users request the PDF files.
   • DDeploy an EC2 instance that has an 1AM instance profile to a public subnet. Use a signed URL from the EC2 instance to provide temporary access to the S3 bucket for website users.

   Show answer

   Answer: D

   Next question

7. Question 67 · 189 in bank

   A financial services company stores customer images in an Amazon S3 bucket in the us-east-1 Region. To comply with regulations, the company must ensure that all existing objects are replicated to an S3 bucket in a second AWS Region. If an object replication fails, the company must be able to retry replication for the object. Which solution will meet these requirements?

   • AConfigure Amazon S3 Cross-Region Replication (CRR). Use Amazon S3 live replication to replicate existing objects.
   • BConfigure Amazon S3 Cross-Region Replication (CRR). Use S3 Batch Replication to replicate existing objects.
   • CConfigure Amazon S3 Cross-Region Replication (CRR). Use S3 Replication Time Control (S3 RTC) to replicate existing objects.
   • DUse S3 Lifecycle rules to move objects to the destination bucket in a second Region.

   Show answer

   Answer: B

   Next question

8. Question 68 · 189 in bank

   A company uses memory-optimized Amazon EC2 instances behind a Network Load Balancer (NLB) to run an application. The company launched the EC2 instances from an AWS provided Red Hat Enterprise Linux (RHEL) Amazon Machine Image (AMI). A CloudOps engineer must monitor RAM utilization in 5-minute intervals. The CloudOps engineer must ensure that the EC2 instances scale in and out appropriately based on incoming load. Which solution will meet these requirements?

   • AConfigure detailed monitoring for the EC2 instances. Configure the Amazon CloudWatch agent on the EC2 instances. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_active metric.
   • BConfigure detailed monitoring for the EC2 instances. Use the mem_used_percent metric that the detailed monitoring feature provides. Create an IAM role that allows the CloudWatch agent to upload data. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.
   • CConfigure basic monitoring for the EC2 instances. Configure the Amazon CloudWatch agent on the EC2 instances. Create an IAM role that allows the CloudWatch agent to upload data. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.
   • DConfigure basic monitoring for the EC2 instances. Use the standard mem_used_percent metric for monitoring. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.

   Show answer

   Answer: C

   Next question

9. Question 69 · 189 in bank

   A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must ensure that all AWS resources meet specific security requirements. The company must not deploy any EC2 instances in the ap-southeast-2 Region. The company must completely block root user actions in all member accounts. The company must prevent any user from deleting AWS CloudTrail logs, including administrators. The company requires a centrally managed solution that the company can automatically apply to all existing and future accounts. Which solution will meet these requirements?

   • ACreate AWS Config rules with remediation actions in each account to detect policy violations. Implement IAM permissions boundaries for the account root users.
   • BEnable AWS Security Hub across the organization. Create custom security standards to enforce the security requirements. Use AWS CloudFormation StackSets to deploy the standards to all the accounts in the organization. Set up Security Hub automated remediation actions.
   • CUse AWS Control Tower for account governance. Configure Region deny controls. Use service control policies (SCPs) to restrict root user access.
   • DConfigure AWS Firewall Manager with security policies to meet the security requirements. Use an AWS Config aggregator with organization-wide conformance packs to detect security policy violations.

   Show answer

   Answer: C

   Next question

10. Question 70 · 189 in bank

    A company uses hundreds of Amazon EC2 On-Demand Instances and Spot Instances to run production and non-production workloads. The company installs and configures the AWS Systems Manager Agent (SSM Agent) on the EC2 instances. During a recent instance patch operation, some instances were not patched because the instances were either busy or down. The company needs to generate a report that lists the current patch version of all instances. Which solution will meet these requirements in the MOST operationally efficient way?

    • AUse Systems Manager Inventory to collect patch versions. Generate a report of all instances.
    • BUse Systems Manager Run Command to remotely collect patch version information. Generate a report of all instances.
    • CUse AWS Config to track EC2 instance configuration changes by using output from the SSM Agents. Create a custom rule to check for patch versions. Generate a report of all unpatched instances.
    • DUse AWS Config to monitor the patch status of the EC2 instances by using output from the SSM Agents. Create a configuration compliance rule to check whether patches are installed. Generate a report of all instances.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C03 practice, question 61. 189 questions available.