SOA-C02 practice questions 1–10

1. Question 1 · 475 in bank

   A company has an infernal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone. A SysOps administrator must make the application highly available. Which action should the SysOps administrator take to meet this requirement?

   • AIncrease the maximum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
   • BIncrease the minimum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
   • CUpdate the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.
   • DUpdate the Auto Scaling group to launch new instances in an Availability Zone in a second AWS Region.

   Show answer

   Answer: C

   Explanation

   Option C is the answer. Spreading it across zones. A and B doesnt make it highly available if a zone goes down. D is false as ASG is region bound, as seen here: https://docs.aws.amazon.com/autoscaling/ec2/userguide/auto-scaling-benefits.html

   Source: Adapted from community discussion — Finger41

   References

   • AWS documentation

   Next question

2. Question 2 · 475 in bank

   A SysOps administrator is troubleshooting an AWS CloudFormation template whereby multiple Amazon EC2 instances are being created. The template is working in us-east-1, but it is failing in us-west-2 with the error code: AMI [ami-12345678] does not exist How should the Administrator ensure that the AWS CloudFormation template is working in every region?

   • ACopy the source region's Amazon Machine Image (AMI) to the destination region and assign it the same ID.
   • BEdit the AWS CloudFormation template to specify the region code as part of the fully qualified AMI ID.
   • CEdit the AWS CloudFormation template to offer a drop-down list of all AMIs to the user by using the AWS::EC2::AMI::ImageID control.
   • DModify the AWS CloudFormation template by including the AMI IDs in the ג€Mappingsג€ section. Refer to the proper mapping within the template for the proper AMI ID.

   Show answer

   Answer: D

   Explanation

   Parameters: EnvironmentType: Description: The environment type Type: String Default: test AllowedValues: - prod - test ConstraintDescription: must be a prod or test Mappings: RegionAndInstanceTypeToAMIID: us-east-1: test: "ami-8ff710e2" prod: "ami-f5f41398" us-west-2: test: "ami-eff1028f" prod: "ami-d0f506b0" ...other regions and AMI IDs... Resources: ...other resources... Outputs: TestOutput: Description: Return the name of the AMI ID that matches the region and environment type keys Value: !FindInMap [RegionAndInstanceTypeToAMIID, !Ref "AWS::Region", !Ref EnvironmentType]

   Source: Adapted from community discussion — Goozian

   References

   • AWS documentation

   Next question

3. Question 3 · 475 in bank

   A company has a policy that requires all Amazon EC2 instances to have a specific set of tags. If an EC2 instance does not have the required tags, the noncompliant instance should be terminated. What is the MOST operationally efficient solution that meets these requirement?

   • ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule to send all EC2 instance state changes to an AWS Lambda function to determine if each instance is compliant. Terminate any noncompliant instances.
   • BCreate an IAM policy that enforces all EC2 instance tag requirements. If the required tags are not in place for an instance, the policy will terminate noncompliant instance.
   • CCreate an AWS Lambda function to determine if each EC2 instance is compliant and terminate an instance if it is noncompliant. Schedule the Lambda function to invoke every 5 minutes.
   • DCreate an AWS Config rule to check if the required tags are present. If an EC2 instance is noncompliant, invoke an AWS Systems Manager Automation document to terminate the instance.

   Show answer

   Answer: D

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 4 · 475 in bank

   Select 2

   A SysOps administrator wants to manage a web server application with AWS Elastic Beanstalk. The Elastic Beanstalk service must maintain full capacity for new deployments at all times. Which deployment policies satisfy this requirement? (Choose two.)

   • AAll at once
   • BImmutable
   • CRebuild
   • DRolling
   • ERolling with additional batch

   Show answer

   Answer: BE

   Explanation

   BE https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.rolling-version-deploy.html B -- Immutable deployments perform an immutable update to launch a full set of new instances running the new version of the application in a separate Auto Scaling group, alongside the instances running the old version. Immutable deployments can prevent issues caused by partially completed rolling deployments. If the new instances don't pass health checks, Elastic Beanstalk terminates them, leaving the original instances untouched. E --To maintain full capacity during deployments, you can configure your environment to launch a new batch of instances before taking any instances out of service. This option is known as a rolling deployment with an additional batch. When the deployment completes, Elastic Beanstalk terminates the additional batch of instances.

   Source: Adapted from community discussion — Atown

   References

   • AWS documentation

   Next question

5. Question 5 · 475 in bank

   Select 2

   A company has an Auto Scaling group of Amazon EC2 instances that scale based on average CPU utilization. The Auto Scaling group events log indicates an InsufficientInstanceCapacity error. Which actions should a SysOps administrator take to remediate this issue? (Choose two.)

   • AChange the instance type that the company is using.
   • BConfigure the Auto Scaling group in different Availability Zones.
   • CConfigure the Auto Scaling group to use different Amazon Elastic Block Store (Amazon EBS) volume sizes.
   • DIncrease the maximum size of the Auto Scaling group.
   • ERequest an increase in the instance service quota.

   Show answer

   Answer: AB

   Explanation

   https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/troubleshooting-launch.html#troubleshooting-launch-capacity Solution To resolve the issue, try the following: Wait a few minutes and then submit your request again; capacity can shift frequently. Submit a new request with a reduced number of instances. For example, if you're making a single request to launch 15 instances, try making 3 requests for 5 instances, or 15 requests for 1 instance instead. ****If you're launching an instance, submit a new request without specifying an Availability Zone. ****If you're launching an instance, submit a new request using a different instance type (which you can resize at a later stage). For more information, see Change the instance type. If you are launching instances into a cluster placement group, you can get an insufficient capacity error. For more information, see Placement group rules and limitations.

   Source: Adapted from community discussion — skinnyxpuppy

   References

   • AWS documentation

   Next question

6. Question 6 · 475 in bank

   Select 2

   A SysOps administrator needs to control access to groups of Amazon EC2 instances using AWS Systems Manager Session Manager. Specific tags on the EC2 instances have already been added. Which additional actions should the administrator take to control access? (Choose two.)

   • AAttach an IAM policy to the users or groups that require access to the EC2 instances.
   • BAttach an IAM role to control access to the EC2 instances.
   • CCreate a placement group for the EC2 instances and add a specific tag.
   • DCreate a service account and attach it to the EC2 instances that need to be controlled.
   • ECreate an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element.

   Show answer

   Answer: AE

   Explanation

   A. Attach an IAM policy to the users or groups that require access to the EC2 instances: IAM policies can be used to control access to resources in AWS. The policy can specify which actions are allowed or denied and which resources the user or group can access. In this case, the policy should include permissions to use the Session Manager service. E. Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element: This policy can specify that access is granted only to instances with specific tags. For example, a policy could specify that users or groups can only access instances that have a specific tag, such as "Environment=Prod". This helps to ensure that only the appropriate instances are accessed.

   Source: Adapted from community discussion — Vivec

   References

   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 7 · 475 in bank

   A company has an AWS Lambda function in Account A. The Lambda function needs to read the objects in an Amazon S3 bucket in Account B. A SysOps administrator must create corresponding IAM roles in both accounts. Which solution will meet these requirements?

   • AIn Account A, create a Lambda execution role to assume the role in Account B. In Account B. create a role that the function can assume to gain access to the S3 bucket.
   • BIn Account A, create a Lambda execution role that provides access to the S3 bucket. In Account B, create a role that the function can assume.
   • CIn Account A, create a role that the function can assume. In Account B, create a Lambda execution role that provides access to the S3 bucket.
   • DIn Account A. create a role that the function can assume to gain access to the S3 bucket. In Account B, create a Lambda execution role to assume the role in Account A.

   Show answer

   Answer: A

   Explanation

   Account A: Lambda function needs a role to "ask permission" (assume a role) in Account B. Account B: S3 bucket has a role that says, "If Account A asks properly, let them access my bucket."

   Source: Adapted from community discussion — OlehKom

   References

   • AWS documentation

   Next question

8. Question 8 · 475 in bank

   An AWS Lambda function is intermittently failing several times a day. A SysOps administrator must find out how often this error has occurred in the last 7 days. Which action will meet this requirement in the MOST operationally efficient manner?

   • AUse Amazon Athena to query the Amazon CloudWatch logs that are associated with the Lambda function.
   • BUse Amazon Athena to query the AWS CloudTrail logs that are associated with the Lambda function.
   • CUse Amazon CloudWatch Logs Insights to query the associated Lambda function logs.
   • DUse Amazon OpenSearch Service (Amazon Elasticsearch Service) to stream the Amazon CloudWatch logs for the Lambda function.

   Show answer

   Answer: C

   Explanation

   why not A : Using Amazon Athena to query CloudWatch logs could work, but it introduces additional complexity by setting up and managing Athena. why not B : Querying AWS CloudTrail logs is primarily for tracking API activity and resource changes. It might not provide the same level of visibility into Lambda function errors

   Source: Adapted from community discussion — jipark

   References

   • AWS documentation

   Next question

9. Question 9 · 475 in bank

   A company is using Amazon CloudFront to serve static content for its web application to its users. The CloudFront distribution uses an existing on-premises website as a custom origin. The company requires the use of TLS between CloudFront and the origin server. This configuration has worked as expected for several months. However, users are now experiencing HTTP 502 (Bad Gateway) errors when they view webpages that include content from the CloudFront distribution. What should a SysOps administrator do to resolve this problem?

   • AExamine the expiration date on the certificate on the origin site. Validate that the certificate has not expired. Replace the certificate if necessary.
   • BExamine the hostname on the certificate on the origin site. Validate that the hostname matches one of the hostnames on the CloudFront distribution. Replace the certificate if necessary.
   • CExamine the firewall rules that are associated with the origin server. Validate that port 443 is open for inbound traffic from the internet. Create an inbound rule if necessary.
   • DExamine the network ACL rules that are associated with the CloudFront distribution. Validate that port 443 is open for outbound traffic to the origin server. Create an outbound rule if necessary.

   Show answer

   Answer: A

   Explanation

   A! is correct HTTP 502 errors from CloudFront can occur because of the following reasons: There's an SSL negotiation failure because the origin is using SSL/TLS protocols and ciphers that aren't supported by CloudFront. There's an SSL negotiation failure because the SSL certificate on the origin is expired or invalid, or because the certificate chain is invalid. There's a host header mismatch in the SSL negotiation between your CloudFront distribution and the custom origin. The custom origin isn't responding on the ports specified in the origin settings of the CloudFront distribution. The custom origin is ending the connection to CloudFront too quickly. https://aws.amazon.com/premiumsupport/knowledge-center/resolve-cloudfront-connection-error/

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 10 · 475 in bank

    An Amazon CloudFront distribution has a single Amazon S3 bucket as its origin. A SysOps administrator must ensure that users can access the S3 bucket only through requests from the CloudFront endpoint. Which solution will meet these requirements?

    • AConfigure S3 Block Public Access on the S3 bucket. Update the S3 bucket policy to allow the GetObject action from only the CloudFront distribution.
    • BConfigure Origin Shield in the CloudFront distribution. Update the CloudFront origin to include a custom Origin_Shield header.
    • CCreate an origin access identity (OAI). Assign the OAI to the CloudFront distribution. Update the S3 bucket policy to restrict access to the OAI.
    • DCreate an origin access identity (OAI). Assign the OAI to the S3 bucket. Update the CloudFront origin to include a custom Origin header with the OAI value.

    Show answer

    Answer: C

    Explanation

    They probably typed wrongly. If I recall correctly, the button reads somewhere along the lines of 'bucket can restrict access to only OAI', and what it achieves is allowing S3 objects to be accessed only through CloudFront.

    Source: Adapted from community discussion — Surferbolt

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 1. 475 questions available.