SOA-C02 practice questions 171–180

1. Question 171 · 475 in bank

   A SysOps administrator is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units within the same company. All data must be encrypted at rest. How should the administrator implement this process?

   • AWrite a script to download the encrypted snapshot, decrypt it using the AWS KMS encryption key used to encrypt the snapshot, then create a new volume in each account.
   • BUpdate the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.
   • CCreate an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other accounts. Require each account owner to create a new volume from that snapshot and encrypt it.
   • DCreate a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RDP, export the database contents into a file, then share this file with the other accounts.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. You must first update the key policy use to encrypt the volume, then share it with other accounts.

   Source: Adapted from community discussion — csG13

   References

   • AWS documentation

   Next question

2. Question 172 · 475 in bank

   A SysOps administrator configures an Amazon S3 gateway endpoint in a VPC. The private subnets inside the VPC do not have outbound internet access. User logs in to an Amazon EC2 instance in one of the private subnets and cannot upload a file to an Amazon S3 bucket in the same AWS Region. Which solution will solve this problem?

   • AUpdate the EC2 instance role policy to include s3:PutObject access to the target S3 bucket.
   • BUpdate the EC2 security group to allow outbound traffic to 0.0.0.0/0 for port 80.
   • CUpdate the EC2 subnet route table to include the S3 prefix list destination routes to the S3 gateway endpoint.
   • DUpdate the S3 bucket policy to allow s3:PutObject access from the private subnet CIDR block.

   Show answer

   Answer: C

   Explanation

   When an Amazon S3 gateway endpoint is configured in a VPC, the private subnets within the VPC need to have their route tables updated to route the S3 traffic to the gateway endpoint, instead of the internet. Without the appropriate route table updates, the EC2 instance in the private subnet will not be able to communicate with the S3 bucket, even if the instance has the necessary S3 permissions. Option A is incorrect because the issue is not related to the IAM role permissions, but rather the routing configuration. Option B is incorrect because allowing outbound traffic to 0.0.0.0/0 on port 80 is not necessary to solve this problem. The issue is with the routing to the S3 gateway endpoint, not the internet access. Option D is incorrect because the S3 bucket policy is not the issue here. The problem is with the routing, not the permissions on the S3 bucket.

   Source: Adapted from community discussion — Student013657

   References

   • repost.aws documentation
   • AWS documentation

   Next question

3. Question 173 · 475 in bank

   Select 2

   A company uses Amazon S3 to aggregate raw video footage from various media teams across the US. The company recently expanded into new geographies in Europe and Australia. The technical teams located in Europe and Australia reported delays when uploading large video files into the destination S3 bucket in the United States. What are the MOST cost effective ways to increase upload speeds into the S3 bucket? (Choose two.)

   • ACreate multiple AWS Direct Connect connections between AWS and branch offices in Europe and Australia for file uploads into the destination S3 bucket.
   • BCreate multiple AWS Site-to-Site VPN connections between AWS and branch offices in Europe and Australia for file uploads into the destination S3 bucket.
   • CUse Amazon S3 Transfer Acceleration for file uploads into the destination S3 bucket.
   • DUse AWS Global Accelerator for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.
   • EUse multipart uploads for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.

   Show answer

   Answer: CE

   Explanation

   C & E - are the most cost effective solutions to upload objects to S3. In particular, S3 transfer acceleration will only charge you if the upload is indeed accelerated. Multi-part upload is recommended by AWS when object’s size exceeds 100MB. Also, it’s recommended to maximise the use of available bandwidth.

   Source: Adapted from community discussion — csG13

   Next question

4. Question 174 · 475 in bank

   A SysOps administrator is helping a development team deploy an application to AWS. The AWS CloudFormation template includes an Amazon Linux EC2 instance, an Amazon Aurora DB cluster, and a hardcoded database password that must be rotated every 90 days. What is the MOST secure way to manage the database password?

   • AUse the AWS::SecretsManager::Secret resource with the GenerateSecretString property to automatically generate a password. Use the AWS::SecretsManager::RotationSchedule resource to define a rotation schedule for the password. Configure the application to retrieve the secret from AWS Secrets Manager to access the database.
   • BUse the AWS::SecretsManager::Secret resource with the SecretString property Accept a password as a CloudFormation parameter Use the AllowedPattern property of the CloudFormation parameter to require a minimum length, uppercase and lowercase letters, and special characters. Configure the application to retrieve the secret from AWS Secrets Manager to access the database.
   • CUse the AWS::SSM::Parameter resource. Accept input as a CloudFormation parameter to store the parameter as a secure string. Configure the application to retrieve the parameter from AWS Systems Manager Parameter Store to access the database.
   • DUse the AWS::SSM::Parameter resource. Accept input as a CloudFormation parameter to store the parameter as a string. Configure the application to retrieve the parameter from AWS Systems Manager Parameter Store to access the database.

   Show answer

   Answer: A

   Explanation

   The AWS::SecretsManager::Secret directive is only used to "Creates a new secret". Doesn't sound right that it would be used to accept an existing password (originating from where?). The question and response "B" seems to suggest you are just wanting to re-use an existing password in SecretsManager for a new DB Cluster (which is plausible). If so, rotation would already be configured for existing secret, but you shouldn't also be parsing for length, etc. I also think response has to be "A", but not just because it specifies rotation schedule. There is more to this than that.

   Source: Adapted from community discussion — Gomer

   Next question

5. Question 175 · 475 in bank

   Application A runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are in an Auto Scaling group and are in the same subnet that is associated with the NLB. Other applications from an on-premises environment cannot communicate with Application A on port 8080. To troubleshoot the issue, a SysOps administrator analyzes the flow logs. The flow logs include the following records:

   

   What is the reason for the rejected traffic?

   • AThe security group of the EC2 instances has no Allow rule for the traffic from the NLB.
   • BThe security group of the NLB has no Allow rule for the traffic from the on-premises environment.
   • CThe ACL of the on-premises environment does not allow traffic to the AWS environment.
   • DThe network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range.

   Show answer

   Answer: D

   Explanation

   I go for D. If your network ACL permits outbound ICMP traffic, the flow log displays two ACCEPT records (one for the originating ping and one for the response ping). If your security group denies inbound ICMP traffic, the flow log displays a single REJECT record, because the traffic was not permitted to reach your instance. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#:~:text=1431280876%201431280934%20%2D%20SKIPDATA-,Security%20group%20and%20network%20ACL%20rules,-If%20you%27re%20using

   Source: Adapted from community discussion — atseki

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 176 · 475 in bank

   A company's SysOps administrator maintains a highly available environment. The environment includes Amazon EC2 instances and an Amazon RDS Multi-AZ database. The EC2 instances are in an Auto Scaling group behind an Application Load Balancer. Recently, the company conducted a failover test. The SysOps administrator needs to decrease the failover time of the RDS database by at least 10%. Which solution will meet this requirement?

   • AIncrease the RDS instance size.
   • BModify the RDS cluster to run in a single Availability Zone.
   • CCreate a read replica in another AWS Region. Promote the read replica in case of failure.
   • DCreate an RDS proxy. Point the application to the proxy endpoint.

   Show answer

   Answer: D

   Explanation

   It’s D - RDS proxy can improve db failover by 32% for MySQL, PostgreSQL and 79% for Aurora service. https://aws.amazon.com/blogs/database/improving-application-availability-with-amazon-rds-proxy/

   Source: Adapted from community discussion — csG13

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 177 · 475 in bank

   A company's VPC has connectivity to an on-premises data center through an AWS Site-to-Site VPN. The company needs Amazon EC2 instances in the VPC to send DNS queries for example.com to the DNS servers in the data center. Which solution will meet these requirements?

   • ACreate an Amazon Route 53 Resolver inbound endpoint. Create a conditional forwarding rule on the on-premises DNS servers to forward DNS requests for example.com to the inbound endpoints.
   • BCreate an Amazon Route 53 Resolver inbound endpoint. Create a forwarding rule on the resolver that sends all queries for example.com to the on-premises DNS servers. Associate this rule with the VPC.
   • CCreate an Amazon Route 53 Resolver outbound endpoint. Create a conditional forwarding rule on the on-premises DNS servers to forward DNS requests for example.com to the outbound endpoints.
   • DCreate an Amazon Route 53 Resolver outbound endpoint. Create a forwarding rule on the resolver that sends all queries for example.com to the on-premises DNS servers. Associate this rule with the VPC.

   Show answer

   Answer: D

   Explanation

   D - since we want to forward DNS queries to an on-prem DNS server, we need to create a Route53 outbound resolver endpoint. The last step of the configuration process it to associate the rule with a VPC (not necessarily the same where we created the outbound endpoint). https://aws.amazon.com/premiumsupport/knowledge-center/route53-resolve-with-outbound-endpoint/

   Source: Adapted from community discussion — csG13

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 178 · 475 in bank

   Select 2

   A SysOps administrator is tasked with analyzing database performance. The database runs on a single Amazon RDS DB instance. The SysOps administrator finds that, during times of peak traffic, resources on the database are overutilized due to the amount of read traffic. Which actions should the SysOps administrator take to improve RDS performance? (Choose two.)

   • AAdd a read replica
   • BModify the application to use Amazon ElastiCache for Memcached.
   • CMigrate the database from RDS to Amazon DynamoDB.
   • DMigrate the database to Amazon EC2 with enhanced networking enabled.
   • EUpgrade the database to a Multi-AZ deployment.

   Show answer

   Answer: AB

   Explanation

   A. Adding a read replica can offload read traffic from the primary RDS instance to the replica, thus improving performance during times of peak traffic. B. Amazon ElastiCache for Memcached is an in-memory data store that can be used to improve read performance.

   Source: Adapted from community discussion — Vivec

   Next question

9. Question 179 · 475 in bank

   A company is planning to host an application on a set of Amazon EC2 instances that are distributed across multiple Availability Zones. The application must be able to scale to millions of requests each second. A SysOps administrator must design a solution to distribute the traffic to the EC2 instances. The solution must be optimized to handle sudden and volatile traffic patterns while using a single static IP address for each Availability Zone. Which solution will meet these requirements?

   • AAmazon Simple Queue Service (Amazon SQS) queue
   • BApplication Load Balancer
   • CAWS Global Accelerator
   • DNetwork Load Balancer

   Show answer

   Answer: D

   Explanation

   It's D. "Network Load Balancer is optimized to handle sudden and volatile traffic patterns while using a single static IP address per Availability Zone." https://aws.amazon.com/elasticloadbalancing/network-load-balancer/

   Source: Adapted from community discussion — doggiecai

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 180 · 475 in bank

    A company's SysOps administrator has created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instance are encrypted with AWS managed keys. The SysOps administrator creates an Amazon Machine Image (AMI) of the custom EC2 instance and plans to share the AMI with the company's other AWS accounts. The company requires that all AMIs are encrypted with AWS Key Management Service (AWS KMS) keys and that only authorized AWS accounts can access the shared AMIs. Which solution will securely share the AMI with the other AWS accounts?

    • AIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.
    • BIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the KMS key. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with.
    • CIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the KMS key Modify the permissions on the copied AMI to make it public.
    • DIn the account where the AMI was created, modify the key policy of the AWS managed key to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.

    Show answer

    Answer: B

    Explanation

    Things to note: you have an EC2 instance with encrypted EBS volumes with AWS managed keys (key point right here). Then, you create an AMI from this EC2 instance. This means it will be encrypted with that same AWS managed key. The requirement is simple, use KMS managed keys and only share with authorized accounts. Now the options: A- This starts good as you need a customer managed KMS key to be able to change the policy and add those kms actions to the other AWS accounts, however, that won't help with your AMI since it's still encrypted with the AWS managed key. C - this sounds good right up until the end, public kills it. even though they won't have the actions, you don't want to make it public. D - can't be D, you cannot modify the policy on a AWS managed key.

    Source: Adapted from community discussion — defmania00

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 171. 475 questions available.