SOA-C02 practice questions 101–110

1. Question 101 · 475 in bank

   A team is managing an AWS account that is a member of an organization in AWS Organizations. The organization has consolidated billing features enabled. The account hosts several applications. A SysOps administrator has applied tags to resources within the account to reflect the environment. The team needs a report of the breakdown of charges by environment. What should the SysOps administrator do to meet this requirement?

   • AFilter, map, and categorize resource groups in Tag Editor.
   • BEnsure that the organization's service control policies (SCPs) allow access to cost allocation tags.
   • CEnsure that the IAM credentials that are used to access Cost Explorer have permissions to group cost by tags.
   • DActivate the tag keys for cost allocation on the organization's management account.

   Show answer

   Answer: D

   Explanation

   D You must activate both types of tags separately before they can appear in Cost Explorer or on a cost allocation report. https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

   Source: Adapted from community discussion — moonwalkeryj

   References

   • AWS documentation
   • aws.amazon.com documentation
   • AWS documentation

   Next question

2. Question 102 · 475 in bank

   A company has a simple web application that runs on a set of Amazon EC2 instances behind an Elastic Load Balancer in the eu-west-2 Region. Amazon Route 53 holds a DNS record for the application with a simple routing policy. Users from all over the world access the application through their web browsers. The company needs to create additional copies of the application in the us-east-1 Region and in the ap-south-1 Region. The company must direct users to the Region that provides the fastest response times when the users load the application. What should a SysOps administrator do to meet these requirements?

   • AIn each new Region, create a new Elastic Load Balancer and a new set of EC2 instances to run a copy of the application. Transition to a geolocation routing policy.
   • BIn each new Region, create a copy of the application on new EC2 instances. Add these new EC2 instances to the Elastic Load Balancer in eu-west-2. Transition to a latency routing policy.
   • CIn each new Region, create a copy of the application on new EC2 instances. Add these new EC2 instances to the Elastic Load Balancer in eu-west-2. Transition to a multivalue routing policy.
   • DIn each new Region, create a new Elastic Load Balancer and a new set of EC2 instances to run a copy of the application. Transition to a latency routing policy.

   Show answer

   Answer: D

   Explanation

   I'd say "latency routing" is the only solution to for "users from all over the world access the application" to have "fastest response times". If the users were limited to the three specified regions, then the answer might be A.

   Source: Adapted from community discussion — Gomer

   Next question

3. Question 103 · 475 in bank

   Select 2

   A company creates a new member account by using AWS Organizations. A SysOps administrator needs to add AWS Business Support to the new account. Which combination of steps must the SysOps administrator take to meet this requirement? (Choose two.)

   • ASign in to the new account by using IAM credentials. Change the support plan.
   • BSign in to the new account by using root user credentials. Change the support plan.
   • CUse the AWS Support API to change the support plan.
   • DReset the password of the account root user.
   • ECreate an IAM user that has administrator privileges in the new account.

   Show answer

   Answer: AE

   Explanation

   Correct answers are A and E. The combination of option B and D also works, but the best practice is using an IAM user, not the root user. https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html

   Source: Adapted from community discussion — Untamables

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 104 · 475 in bank

   A SysOps administrator creates two VPCs, VPC1 and VPC2, in a company’s AWS account The SysOps administrator deploys a Linux Amazon EC2 instance in VPC1 and deploys an Amazon RDS for MySQL DB instance in VPC2. The DB instance is deployed in a private subnet. An application that runs on the EC2 instance needs to connect to the database. What should the SysOps administrator do to give the EC2 instance the ability to connect to the database?

   • AEnter the DB instance connection string into the VPC1 route table.
   • BConfigure VPC peering between the two VPCs.
   • CAdd the same IPv4 CIDR range for both VPCs.
   • DConnect to the DB instance by using the DB instance’s public IP address.

   Show answer

   Answer: B

   Next question

5. Question 105 · 475 in bank

   A company uses an Amazon S3 bucket to store data files. The S3 bucket contains hundreds of objects. The company needs to replace a tag on all the objects in the S3 bucket with another tag. What is the MOST operationally efficient way to meet this requirement?

   • AUse S3 Batch Operations. Specify the operation to replace all object tags.
   • BUse the AWS CLI to get the tags for each object. Save the tags in a list. Use S3 Batch Operations. Specify the operation to delete all object tags. Use the AWS CLI and the list to retag the objects.
   • CUse the AWS CLI to get the tags for each object. Save the tags in a list. Use the AWS CLI and the list to remove the object tags. Use the AWS CLI and the list to retag the objects.
   • DUse the AWS CLI to copy the objects to another S3 bucket. Add the new tag to the copied objects. Delete the original objects.

   Show answer

   Answer: A

   Explanation

   A is the correct answer. The question is asking to replace existing tag with another, not adding new tags. Therefore, batch operations is correct (A). Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-put-object-tagging.html

   Source: Adapted from community discussion — Gil80

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 106 · 475 in bank

   A company needs to take an inventory of applications that are running on multiple Amazon EC2 instances. The company has configured users and roles with the appropriate permissions for AWS Systems Manager. An updated version of Systems Manager Agent has been installed and is running on every instance. While configuring an inventory collection, a SysOps administrator discovers that not all the instances in a single subnet are managed by Systems Manager. What must the SysOps administrator do to fix this issue?

   • AEnsure that all the EC2 instances have the correct tags for Systems Manager access.
   • BConfigure AWS Identity and Access Management Access Analyzer to determine and automatically remediate the issue.
   • CEnsure that all the EC2 instances have an instance profile with Systems Manager access.
   • DConfigure Systems Manager to use an interface VPC endpoint.

   Show answer

   Answer: C

   Explanation

   It looks like C for me. I don't think it's D. In order to be D, all instances in that subnet shouldn't be in SSM but question says that SOME INSTANCES IN THE SAME SUBNET...

   Source: Adapted from community discussion — Liongeek

   Next question

7. Question 107 · 475 in bank

   A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company’s risk team must receive immediate notification about any delete events. Which solution will meet these requirements?

   • AEnable S3 server access logging for audit logs. Set up an Amazon Simple Notification Service (Amazon SNS) notification for the S3 bucket. Select DeleteObject for the event type for the alert system.
   • BEnable S3 server access logging for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance to download the access logs each day and to scan for a DeleteObject event.
   • CUse Amazon CloudWatch Logs for audit logs. Use Amazon CloudWatch alarms with an Amazon Simple Notification Service (Amazon SNS) notification for the alert system.
   • DUse Amazon CloudWatch Logs for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance each day to compare the list of the items with the list from the previous day. Configure the cron job to send a notification if an item is missing.

   Show answer

   Answer: A

   Explanation

   A To meet the requirements of logging all access attempts to the S3 bucket and receiving immediate notification about any delete events, the company can enable S3 server access logging and set up an Amazon Simple Notification Service (Amazon SNS) notification for the S3 bucket. The S3 server access logs will record all access attempts to the bucket, including delete events, and the SNS notification can be configured to send an alert when a DeleteObject event occurs.

   Source: Adapted from community discussion — MrMLB

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 108 · 475 in bank

   A SysOps administrator receives an alert from Amazon GuardDuty about suspicious network activity on an Amazon EC2 instance. The GuardDuty finding lists a new external IP address as a traffic destination. The SysOps administrator does not recognize the external IP address. The SysOps administrator must block traffic to the external IP address that GuardDuty identified. Which solution will meet this requirement?

   • ACreate a new security group to block traffic to the external IP address. Assign the new security group to the EC2 instance.
   • BUse VPC flow logs with Amazon Athena to block traffic to the external IP address.
   • CCreate a network ACL. Add an outbound deny rule for traffic to the external IP address.
   • DCreate a new security group to block traffic to the external IP address. Assign the new security group to the entire VPC.

   Show answer

   Answer: C

   Explanation

   Security groups are out because you allow traffic using security groups not block. VPC flow logs with Athena? How can that help? And the ACL outbound rule to block the IP? ACL makes the most sense because if the IP is the destination the outbound rule to block will do. However it would make more sense to modify existing ACL because a subnet can be associated with only one ACL. So I am going to say C is the correct one.

   Source: Adapted from community discussion — beznika

   Next question

9. Question 109 · 475 in bank

   A company’s reporting job that used to run in 15 minutes is now taking an hour to run. An application generates the reports. The application runs on Amazon EC2 instances and extracts data from an Amazon RDS for MySQL database. A SysOps administrator checks the Amazon CloudWatch dashboard for the RDS instance and notices that the Read IOPS metrics are high, even when the reports are not running. The SysOps administrator needs to improve the performance and the availability of the RDS instance. Which solution will meet these requirements?

   • AConfigure an Amazon ElastiCache cluster in front of the RDS instance. Update the reporting job to query the ElastiCache cluster.
   • BDeploy an RDS read replica. Update the reporting job to query the reader endpoint.
   • CCreate an Amazon CloudFront distribution. Set the RDS instance as the origin. Update the reporting job to query the CloudFront distribution.
   • DIncrease the size of the RDS instance.

   Show answer

   Answer: B

   Explanation

   There is not enough information to make a distinction between A and B. Separating I/O from writes and reads, vs. caching, depends on how write intensive the RDS is. If it's doing nearly zero writes, a read replica at the same I/O level won't solve the problem. That information is not provided. A or B, depending on data.

   Source: Adapted from community discussion — joanneli77

   Next question

10. Question 110 · 475 in bank

    A company’s SysOps administrator regularly checks the AWS Personal Health Dashboard in each of the company’s accounts. The accounts are part of an organization in AWS Organizations. The company recently added 10 more accounts to the organization. The SysOps administrator must consolidate the alerts from each account’s Personal Health Dashboard. Which solution will meet this requirement with the LEAST amount of effort?

    • AEnable organizational view in AWS Health.
    • BConfigure the Personal Health Dashboard in each account to forward events to a central AWS CloudTrail log.
    • CCreate an AWS Lambda function to query the AWS Health API and to write all events to an Amazon DynamoDB table.
    • DUse the AWS Health API to write events to an Amazon DynamoDB table.

    Show answer

    Answer: A

    Explanation

    A. Enable organizational view in AWS Health. Explanation: By enabling organizational view in AWS Health, you can aggregate and view the status of AWS Personal Health Dashboard across all accounts in your organization in AWS Organizations. This feature provides a centralized view of the health of all accounts, making it easier for the SysOps administrator to monitor and respond to alerts from a single dashboard rather than checking each account individually.

    Source: Adapted from community discussion — Christina666

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 101. 475 questions available.