SOA-C02 practice questions 151–160

1. Question 151 · 475 in bank

   A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API calls using the CLI. However, users are not prompted to enter MFA tokens, and are able to run CLI commands without MFA. In an attempt to enforce MFA, the company attached an IAM policy to all users that denies API calls that have not been authenticated with MFA. What additional step must be taken to ensure that API calls are authenticated using MFA?

   • AEnable MFA on IAM roles, and require IAM users to use role credentials to sign API calls.
   • BAsk the IAM users to log into the AWS Management Console with MFA before making API calls using the CLI.
   • CRestrict the IAM users to use of the console, as MFA is not supported for CLI use.
   • DRequire users to use temporary credentials from the get-session token command to sign API calls.

   Show answer

   Answer: D

   Explanation

   D. Require users to use temporary credentials from the get-session token command to sign API calls. In order to enforce MFA for API calls using the CLI, the company needs to require users to use temporary credentials obtained from the get-session-token command. This command will prompt the user to enter their MFA token, and will return temporary security credentials that include an MFA token. The user can then use these temporary credentials to sign API calls, which will ensure that the calls are authenticated using MFA. The temporary credentials will automatically expire after a set duration, ensuring that access is limited and secure.

   Source: Adapted from community discussion — awsguru1998

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 152 · 475 in bank

   A SysOps administrator has blocked public access to all company Amazon S3 buckets. The SysOps administrator wants to be notified when an S3 bucket becomes publicly readable in the future. What is the MOST operationally efficient way to meet this requirement?

   • ACreate an AWS Lambda function that periodically checks the public access settings for each S3 bucket. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications.
   • BCreate a cron script that uses the S3 API to check the public access settings for each S3 bucket. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications.
   • CEnable S3 Event Notifications for each S3 bucket. Subscribe S3 Event Notifications to an Amazon Simple Notification Service (Amazon SNS) topic.
   • DEnable the s3-bucket-public-read-prohibited managed rule in AWS Config. Subscribe the AWS Config rule to an Amazon Simple Notification Service (Amazon SNS) topic.

   Show answer

   Answer: D

   Explanation

   I pick D - it’s clearly not A, B. Also, it can’t be C since S3 events cannot publish notifications when public access is enabled (see, https://docs.aws.amazon.com/AmazonS3/latest/userguide/NotificationHowTo.html).

   Source: Adapted from community discussion — csG13

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 153 · 475 in bank

   A company plans to launch a static website on its domain example.com and subdomain www.example.com using Amazon S3. How should the SysOps administrator meet this requirement?

   • ACreate one S3 bucket named example.com for both the domain and subdomain.
   • BCreate one S3 bucket with a wildcard named *.example.com for both the domain and subdomain.
   • CCreate two S3 buckets named example.com and www.example.com. Configure the subdomain bucket to redirect requests to the domain bucket.
   • DCreate two S3 buckets named http://example.com and http://*.example.com. Configure the wildcard (*) bucket to redirect requests to the domain bucket.

   Show answer

   Answer: C

   Explanation

   In retrospect, I have to change my choice to "C" after reviewing the following URL: https://docs.aws.amazon.com/AmazonS3/latest/userguide/website-hosting-custom-domain-walkthrough.html It still seems to me that you could just use two Route 53 aliases to the same bucket, but the exam question is clearly referencing the steps in the web URL using two buckets.

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 154 · 475 in bank

   A SysOps administrator is configuring AWS Client VPN to connect users on a corporate network to AWS resources that are running in a VPC. According to compliance requirements, only traffic that is destined for the VPC can travel across the VPN tunnel. How should the SysOps administrator configure Client VPN to meet these requirements?

   • AAssociate the Client VPN endpoint with a private subnet that has an internet route through a NAT gateway.
   • BOn the Client VPN endpoint, turn on the split-tunnel option.
   • COn the Client VPN endpoint, specify DNS server IP addresses.
   • DSelect a private certificate to use as the identity certificate for the VPN client.

   Show answer

   Answer: B

   Explanation

   Answer B: Split tunnel on client, so traffic destined to resources other than VPN destination will use local internet or intranet. Otherwise everything will go through the VPN tunnel.

   Source: Adapted from community discussion — Spike2020

   References

   • AWS documentation

   Next question

5. Question 155 · 475 in bank

   A SysOps administrator is testing an application that is hosted on five Amazon EC2 instances. The instances run in an Auto Scaling group behind an Application Load Balancer (ALB). High CPU utilization during load testing is causing the Auto Scaling group to scale out. The SysOps administrator must troubleshoot to find the root cause of the high CPU utilization before the Auto Scaling group scales out. Which action should the SysOps administrator take to meet these requirements?

   • AEnable instance scale-in protection.
   • BPlace the instance into the Standby state.
   • CRemove the listener from the ALB.
   • DSuspend the Launch and Terminate process types.

   Show answer

   Answer: D

   Explanation

   Answer is D per the URL, and here is the command I derived from researching tis # Suspend ALB Launch and Terminate processes to inhibit scale-in/scale-out while debugging root cause of high CPU utilization aws autoscaling suspend-processes --auto-scaling-group-name my-asg --scaling-processes Launch Terminate https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-suspend-resume-processes.html

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation

   Next question

6. Question 156 · 475 in bank

   A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A SysOps administrator notices that some of these EC2 instances show up as healthy in the Auto Scaling group but show up as unhealthy in the ALB target group. What is a possible reason for this issue?

   • ASecurity groups are not allowing traffic between the ALB and the failing EC2 instances.
   • BThe Auto Scaling group health check is configured for EC2 status checks.
   • CThe EC2 instances are failing to launch and failing EC2 status checks.
   • DThe target group health check is configured with an incorrect port or path.

   Show answer

   Answer: D

   Explanation

   No, the correct answer is D. You need to pay more attention to how the question is worded. It says health checks in TARGET GROUPS. So based on this doc: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html "The load balancer sends a health check request to each registered target every HealthCheckIntervalSeconds seconds, using the specified port, protocol, and ping path."

   Source: Adapted from community discussion — xSohox

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 157 · 475 in bank

   A company is implementing security and compliance by using AWS Trusted Advisor. The company's SysOps team is validating the list of Trusted Advisor checks that it can access. Which factor will affect the quantity of available Trusted Advisor checks?

   • AWhether at least one Amazon EC2 instance is in the running state
   • BThe AWS Support plan
   • CAn AWS Organizations service control policy (SCP)
   • DWhether the AWS account root user has multi-factor authentication (MFA) enabled

   Show answer

   Answer: B

   Explanation

   Ans: B Ref.: https://aws.amazon.com/premiumsupport/faqs/?nc1=h_ls "Q: Which Trusted Advisor checks and features are available to all AWS customers? AWS Basic Support and AWS Developer Support customers get access to 6 security checks (S3 Bucket Permissions, Security Groups - Specific Ports Unrestricted, IAM Use, MFA on Root Account, EBS Public Snapshots, RDS Public Snapshots) and 50 service limit checks. AWS Business Support, AWS Enterprise On-Ramp, and AWS Enterprise Support customers get access to all 115 Trusted Advisor checks (14 cost optimization, 17 security, 24 fault tolerance, 10 performance, and 50 service limits) and recommendations."

   Source: Adapted from community discussion — Liongeek

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 158 · 475 in bank

   A SysOps administrator notices a scale up event for an Amazon EC2 Auto Scaling group. Amazon CloudWatch shows a spike in the RequestCount metric for the associated Application Load Balancer. The administrator would like to know the IP addresses for the source of the requests. Where can the administrator find this information?

   • AAuto Scaling logs
   • BAWS CloudTrail logs
   • CEC2 instance logs
   • DElastic Load Balancer access logs

   Show answer

   Answer: D

   Next question

9. Question 159 · 475 in bank

   A company plans to migrate several of its high performance computing (HPC) virtual machines (VMs) to Amazon EC2 instances on AWS. A SysOps administrator must identify a placement group for this deployment. The strategy must minimize network latency and must maximize network throughput between the HPC VMs. Which strategy should the SysOps administrator choose to meet these requirements?

   • ADeploy the instances in a cluster placement group in one Availability Zone.
   • BDeploy the instances in a partition placement group in two Availability Zones.
   • CDeploy the instances in a partition placement group in one Availability Zone.
   • DDeploy the instances in a spread placement group in two Availability Zones.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

10. Question 160 · 475 in bank

    An errant process is known to use an entire processor and run at 100%. A SysOps administrator wants to automate restarting an Amazon EC2 instance when the problem occurs for more than 2 minutes. How can this be accomplished?

    • ACreate an Amazon CloudWatch alarm for the EC2 instance with basic monitoring. Add an action to restart the instance.
    • BCreate an Amazon CloudWatch alarm for the EC2 instance with detailed monitoring. Add an action to restart the instance.
    • CCreate an AWS Lambda function to restart the EC2 instance, invoked on a scheduled basis every 2 minutes.
    • DCreate an AWS Lambda function to restart the EC2 instance, invoked by EC2 health checks.

    Show answer

    Answer: B

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 151. 475 questions available.