SOA-C02 practice questions 121–130

1. Question 121 · 475 in bank

   Select 2

   A company’s SysOps administrator must ensure that all Amazon EC2 Windows instances that are launched in an AWS account have a third-party agent installed. The third-party agent has an .msi package. The company uses AWS Systems Manager for patching, and the Windows instances are tagged appropriately. The third-party agent requires periodic updates as new versions are released. The SysOps administrator must deploy these updates automatically. Which combination of steps will meet these requirements with the LEAST operational effort? (Choose two.)

   • ACreate a Systems Manager Distributor package for the third-party agent.
   • BMake sure that Systems Manager Inventory is configured. If Systems Manager Inventory is not configured, set up a new inventory for instances that is based on the appropriate tag value for Windows.
   • CCreate a Systems Manager State Manager association to run the AWS-RunRemoteScript document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windows with a schedule of 1 day.
   • DCreate a Systems Manager State Manager association to run the AWS-ConfigureAWSPackage document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windows with a schedule of 1 day.
   • ECreate a Systems Manager OpsItem with the tag value for Windows. Attach the Systems Manager Distributor package to the OpsItem. Create a maintenance window that is specific to the package deployment. Configure the maintenance window to cover 24 hours a day.

   Show answer

   Answer: AD

   Explanation

   Correct answer is AD: You can just read a description of each SSM document: AWS-ConfigureAWSPackage "Install or uninstall a Distributor package. You can install the latest version, default version, or a version of the package you specify." AWS-RunRemoteScript "Execute scripts stored in a REMOTE location. The following remote locations are currently supported: GitHub (public and private) and Amazon S3 (S3). The following script types are currently supported: #! support on Linux and file associations on Windows." So we need to create a Distributor package and then create State Manager association to run the AWS-ConfigureAWSPackage

   Source: Adapted from community discussion — xSohox

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 122 · 475 in bank

   A company runs hundreds of Amazon EC2 instances in a single AWS Region. Each EC2 instance has two attached 1 GiB General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volumes. A critical workload is using all the available IOPS capacity on the EBS volumes. According to company policy, the company cannot change instance types or EBS volume types without completing lengthy acceptance tests to validate that the company’s applications will function properly. A SysOps administrator needs to increase the I/O performance of the EBS volumes as quickly as possible. Which action should the SysOps administrator take to meet these requirements?

   • AIncrease the size of the 1 GiB EBS volumes.
   • BAdd two additional elastic network interfaces on each EC2 instance.
   • CTurn on Transfer Acceleration on the EBS volumes in the Region.
   • DAdd all the EC2 instances to a cluster placement group.

   Show answer

   Answer: A

   Explanation

   A. 100% positive. "With Amazon EBS Elastic Volumes, you can increase the volume size, change the volume type, or adjust the performance of your EBS volumes. If your instance supports Elastic Volumes, you can do so without detaching the volume or restarting the instance. This enables you to continue using your application while the changes take effect." https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modify-volume.html They have Elastic Volumes in place (per the question) and that's exactly why it is specified in the question. As others have mentioned, increasing the volume size increases IOPS, up to the volume type max. For gp2, you can have a volume size of 1 GiB - 16 TiB with a max IOPS of 16,000 for the 16 TiB volume size. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

   Source: Adapted from community discussion — Domdom120

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 123 · 475 in bank

   A company needs to deploy a new workload on AWS. The company must encrypt all data at rest and must rotate the encryption keys once each year. The workload uses an Amazon RDS for MySQL Multi-AZ database for data storage. Which configuration approach will meet these requirements?

   • AEnable Transparent Data Encryption (TDE) in the MySQL configuration file. Manually rotate the key every 12 months.
   • BEnable RDS encryption on the database at creation time by using the AWS managed key for Amazon RDS.
   • CCreate a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable RDS encryption on the database at creation time by using the KMS key.
   • DCreate a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the RDS DB instance.

   Show answer

   Answer: C

   Explanation

   Automatic key rotation is supported only on symmetric encryption KMS keys. You cannot enable automatic rotation of asymmetric KMS keys, HMAC KMS keys, KMS keys with imported key material, or KMS keys in a custom key store. To enable or disable automatic rotation of a set of related multi-Region keys, set the property on the primary key.

   Source: Adapted from community discussion — Christina666

   Next question

4. Question 124 · 475 in bank

   A company hosts a static website on Amazon S3. The website is served by an Amazon CloudFront distribution with a default TTL of 86,400 seconds. The company recently uploaded an updated version of the website to Amazon S3. However, users still see the old content when they refresh the site. A SysOps administrator must make the new version of the website visible to users as soon as possible. Which solution meets these requirements?

   • AAdjust the TTL value for the DNS CNAME record that is pointing to the CloudFront distribution.
   • BCreate an invalidation on the CloudFront distribution for the old S3 objects.
   • CCreate a new CloudFront distribution. Update the DNS records to point to the new CloudFront distribution.
   • DUpdate the DNS record for the website to point to the S3 bucket.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. You can create an invalidation on the CloudFront distribution for the old S3 objects. This will remove the specified objects from CloudFront edge caches, forcing CloudFront to retrieve the updated content from the origin (in this case, the S3 bucket). This will make the new version of the website visible to users as soon as possible.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation

   Next question

5. Question 125 · 475 in bank

   A company has an application that is deployed to two AWS Regions in an active-passive configuration. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in each Region. The instances are in an Amazon EC2 Auto Scaling group in each Region. The application uses an Amazon Route 53 hosted zone for DNS. A SysOps administrator needs to configure automatic failover to the secondary Region. What should the SysOps administrator do to meet these requirements?

   • AConfigure Route 53 alias records that point to each ALB. Choose a failover routing policy. Set Evaluate Target Health to Yes.
   • BConfigure CNAME records that point to each ALChoose a failover routing policy. Set Evaluate Target Health to Yes.
   • CConfigure Elastic Load Balancing (ELB) health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.
   • DConfigure EC2 health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.

   Show answer

   Answer: A

   Explanation

   To configure automatic failover to the secondary Region for an application that is deployed to two AWS Regions in an active-passive configuration, the following steps should be taken: Configure Route 53 alias records that point to each ALB in the two Regions. Choose a failover routing policy, such as Failover or Geolocation. Set Evaluate Target Health to Yes to ensure that Route 53 only responds to DNS queries with healthy ALB endpoints.

   Source: Adapted from community discussion — Vivec

   Next question

6. Question 126 · 475 in bank

   A company is implementing a monitoring solution that is based on machine learning. The monitoring solution consumes Amazon EventBridge (Amazon CloudWatch Events) events that are generated by Amazon EC2 Auto Scaling. The monitoring solution provides detection of anomalous behavior such as unanticipated scaling events and is configured as an EventBridge (CloudWatch Events) API destination. During initial testing, the company discovers that the monitoring solution is not receiving events. However, Amazon CloudWatch is showing that the EventBridge (CloudWatch Events) rule is being invoked. A SysOps administrator must implement a solution to retrieve client error details to help resolve this issue. Which solution will meet these requirements with the LEAST operational effort?

   • ACreate an EventBridge (CloudWatch Events) archive for the event pattern to replay the events. Increase the logging on the monitoring solution. Use replay to invoke the monitoring solution. Examine the error details.
   • BAdd an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue for the target. Process the messages in the dead-letter queue to retrieve error details.
   • CCreate a second EventBridge (CloudWatch Events) rule for the same event pattern to target an AWS Lambda function. Configure the Lambda function to invoke the monitoring solution and to record the results to Amazon CloudWatch Logs. Examine the errors in the logs.
   • DConfigure the EventBridge (CloudWatch Events) rule to send error messages to an Amazon Simple Notification Service (Amazon SNS) topic.

   Show answer

   Answer: A

   Explanation

   Answer is absolutely "A" based on the links already provided. You need to replay the events, and try and identify why the monitoring app isn't able to contact EventBridge API. If you replace the monitoring app with SQS que, your just going to log Auto Scaling events. That isn't going to help you figure out why monitoring app isn't getting these same events through the EventBridge API. The SQS "B" answer may be easier than "A", but it isn't going to do any good on debugging EventBridge API access issue (probably a permissions/role/policy issue)

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 127 · 475 in bank

   A company is storing backups in an Amazon S3 bucket. The backups must not be deleted for at least 3 months after the backups are created. What should a SysOps administrator do to meet this requirement?

   • AConfigure an IAM policy that denies the s3:DeleteObject action for all users. Three months after an object is written, remove the policy.
   • BEnable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
   • CEnable S3 Versioning on the existing S3 bucket. Configure S3 Lifecycle rules to protect the backups.
   • DEnable S3 Object Lock on a new S3 bucket in governance mode. Place all backups in the new S3 bucket with a retention period of 3 months.

   Show answer

   Answer: B

   Explanation

   B. Compliance mode is required for this situation. Comparison and reference below: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html In governance mode, users can't overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period. In compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened. Compliance mode helps ensure that an object version can't be overwritten or deleted for the duration of the retention period.

   Source: Adapted from community discussion — Domdom120

   References

   • AWS documentation

   Next question

8. Question 128 · 475 in bank

   A SysOps administrator needs to track the costs of data transfer between AWS Regions. The SysOps administrator must implement a solution to send alerts to an email distribution list when transfer costs reach 75% of a specific threshold. What should the SysOps administrator do to meet these requirements?

   • ACreate an AWS Cost and Usage Report. Analyze the results in Amazon Athena. Configure an alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when costs reach 75% of the threshold. Subscribe the email distribution list to the topic.
   • BCreate an Amazon CloudWatch billing alarm to detect when costs reach 75% of the threshold. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email distribution list to the topic.
   • CUse AWS Budgets to create a cost budget for data transfer costs. Set an alert at 75% of the budgeted amount. Configure the budget to send a notification to the email distribution list when costs reach 75% of the threshold.
   • DSet up a VPC flow log. Set up a subscription filter to an AWS Lambda function to analyze data transfer. Configure the Lambda function to send a notification to the email distribution list when costs reach 75% of the threshold.

   Show answer

   Answer: C

   Explanation

   I was very confused by B and C, because they both do alerts. However, only "Budgets" lets yo select specific services and regions, and alarm based on forecast expenses. I made up a table of the differences between CW Billing Alarms and Budgets alarms, which is too big to post. However, these links helped gel my thoughts on this: https://aws.amazon.com/blogs/aws/aws-budgets-update-track-cloud-costs-and-usage/ https://stackoverflow.com/questions/67680601/whats-the-difference-between-alarm-budget-and-cloudwatch-alarms-billing

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation

   Next question

9. Question 129 · 475 in bank

   A company needs to archive all audit logs for 10 years. The company must protect the logs from any future edits. Which solution will meet these requirements?

   • AStore the data in an Amazon Elastic Block Store (Amazon EBS) volume. Configure AWS Key Management Service (AWS KMS) encryption.
   • BStore the data in an Amazon S3 Glacier vault. Configure a vault lock policy for write-once, read-many (WORM) access.
   • CStore the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Configure server-side encryption.
   • DStore the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Configure multi-factor authentication (MFA).

   Show answer

   Answer: B

   Explanation

   B. Store the data in an Amazon S3 Glacier vault. Configure a vault lock policy for write-once, read-many (WORM) access. This will ensure that the data is stored securely with encryption and that it cannot be modified or deleted once it has been stored in the vault. The write-once, read-many (WORM) access provided by a vault lock policy helps ensure data immutability and compliance with regulatory requirements for long-term data retention.

   Source: Adapted from community discussion — awsguru1998

   References

   • AWS documentation

   Next question

10. Question 130 · 475 in bank

    A company’s AWS Lambda function is experiencing performance issues. The Lambda function performs many CPU-intensive operations. The Lambda function is not running fast enough and is creating bottlenecks in the system. What should a SysOps administrator do to resolve this issue?

    • AIn the CPU launch options for the Lambda function, activate hyperthreading.
    • BTurn off the AWS managed encryption.
    • CIncrease the amount of memory for the Lambda function.
    • DLoad the required code into a custom layer.

    Show answer

    Answer: C

    Explanation

    Option C (Increase the amount of memory for the Lambda function) is the correct choice. AWS Lambda allows you to configure the amount of memory allocated to a function, and this has a direct impact on the available CPU power. When you increase the memory, Lambda automatically allocates proportional CPU power, which can significantly improve the performance of CPU-intensive operations. The more memory you allocate, the more CPU power the function receives, leading to faster execution times. Option D (Load the required code into a custom layer) is unrelated to addressing the performance issues caused by CPU-intensive operations. Custom layers in AWS Lambda are used to share code libraries and dependencies among multiple functions. While it can be helpful for code reuse and organization, it won't directly resolve the CPU bottleneck issue.

    Source: Adapted from community discussion — Christina666

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 121. 475 questions available.