SOA-C02 practice questions 11–20

1. Question 11 · 475 in bank

   A SysOps administrator is designing a solution for an Amazon RDS for PostgreSQL DB instance. Database credentials must be stored and rotated monthly. The applications that connect to the DB instance send write-intensive traffic with variable client connections that sometimes increase significantly in a short period of time. Which solution should a SysOps administrator choose to meet these requirements?

   • AConfigure AWS Key Management Service (AWS KMS) to automatically rotate the keys for the DB instance. Use RDS Proxy to handle the increases in database connections.
   • BConfigure AWS Key Management Service (AWS KMS) to automatically rotate the keys for the DB instance. Use RDS read replicas to handle the increases in database connections.
   • CConfigure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS Proxy to handle the increases in database connections.
   • DConfigure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS read replicas to handle the increases in database connections.

   Show answer

   Answer: C

   Explanation

   It cannot be A or B as KMS cannot hold DB credentials, therefore must be Secrets Manager It cannot be D as the question states "Write intensive" so read only replicas cannot do this. Has to be C

   Source: Adapted from community discussion — englishborn

   References

   • AWS documentation

   Next question

2. Question 12 · 475 in bank

   A company wants to reduce costs for jobs that can be completed at any time. The jobs currently run by using multiple Amazon EC2 On-Demand Instances and the jobs take slightly less than 2 hours to complete. If a job falls for any reason it must be restarted from the beginning. Which solution will meet these requirements MOST cost-effectively?

   • APurchase Reserved Instances for the jobs.
   • BSubmit a request for a one-time Spot Instance for the jobs.
   • CSubmit a request for Spot Instances with a defined duration for the jobs.
   • DUse a mixture of On-Demand Instances and Spot Instances for the jobs.

   Show answer

   Answer: C

   Explanation

   It's no longer call "Defined Duration". Now we would use "Persistent Request" not "one-time" request. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-requests.html Request type: The Spot Instance request type that you choose determines what happens if your Spot Instance is interrupted. One-time: Amazon EC2 places a one-time request for your Spot Instance. If your Spot Instance is interrupted, the request is not resubmitted. Persistent request: Amazon EC2 places a persistent request for your Spot Instance. If your Spot Instance is interrupted, the request is resubmitted to replenish the interrupted Spot Instance.

   Source: Adapted from community discussion — JamesF92

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 13 · 475 in bank

   A SysOps administrator is provisioning an Amazon Elastic File System (Amazon EFS) file system to provide shared storage across multiple Amazon EC2 instances. The instances all exist in the same VPC across multiple Availability Zones. There are two instances in each Availability Zone. The SysOps administrator must make the file system accessible to each instance with the lowest possible latency. Which solution will meet these requirements?

   • ACreate a mount target for the EFS file system in the VPC. Use the mount target to mount the file system on each of the instances.
   • BCreate a mount target for the EFS file system in one Availability Zone of the VPC. Use the mount target to mount the file system on the instances in that Availability Zone. Share the directory with the other instances.
   • CCreate a mount target for each instance. Use each mount target to mount the EFS file system on each respective instance.
   • DCreate a mount target in each Availability Zone of the VPC. Use the mount target to mount the EFS file system on the instances in the respective Availability Zone.

   Show answer

   Answer: D

   Explanation

   It is D. A mount target provides an IP address for an NFSv4 endpoint at which you can mount an Amazon EFS file system. You mount your file system using its Domain Name Service (DNS) name, which resolves to the IP address of the EFS mount target in the same Availability Zone as your EC2 instance. You can create one mount target in each Availability Zone in an AWS Region. If there are multiple subnets in an Availability Zone in your VPC, you create a mount target in one of the subnets. Then all EC2 instances in that Availability Zone share that mount target. https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html

   Source: Adapted from community discussion — vjt

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 14 · 475 in bank

   An environment consists of 100 Amazon EC2 Windows instances. The Amazon CloudWatch agent is deployed and running on all EC2 Instances with a baseline configuration file to capture log files. There is a new requirement to capture the DHCP log files that exist on 50 of the instances. What is the MOST operationally efficient way to meet this new requirement?

   • ACreate an additional CloudWatch agent configuration file to capture the DHCP logs. Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file.
   • BLog in to each EC2 Instance with administrator rights. Create a PowerShell script to push the needed baseline log files and DHCP log files to CloudWatch.
   • CRun the CloudWatch agent configuration file wizard on each EC2 instance. Verify that the baseline log files are included and add the DHCP log files during the wizard creation process.
   • DRun the CloudWatch agent configuration file wizard on each EC2 instance and select the advanced detail level. This will capture the operating system log files.

   Show answer

   Answer: A

   Explanation

   While I find no real solution in the internet for Windows instances, I will go with A because I can't believe logging into EVERY INSTANCE with 100x is a valid solution. Who does that 2022.

   Source: Adapted from community discussion — haxaffee

   Next question

5. Question 15 · 475 in bank

   A company has 10 Amazon EC2 instances in its production account. A SysOps administrator must ensure that email notifications are sent to administrators each time there is an EC2 instance state change. Which solution will meet this requirements?

   • AConfigure an Amazon Route 53 simple routing policy that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic when an EC2 instance state changes. This SNS topic then sends notifications to its email subscribers.
   • BConfigure an Amazon Route 53 simple routing policy that publishes a message to an Amazon Simple Queue Service (Amazon SQS) queue when an EC2 instance state changes. This SQS queue then sends notifications to its email subscribers.
   • CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic when an EC2 instance state changes. This SNS topic then sends notifications to its email subscribers.
   • DCreate an Amazon EventBridge (Amazon CloudWatch Events) rule that publishes a message to an Amazon Simple Queue Service (Amazon SQS) queue when an EC2 instance state changes. This SQS queue then sends notifications to its email subscribers.

   Show answer

   Answer: C

   Explanation

   C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic when an EC2 instance state changes. This SNS topic then sends notifications to its email subscribers.

   Source: Adapted from community discussion — tamng

   Next question

6. Question 16 · 475 in bank

   A company has an application that runs on a fleet of Amazon EC2 instances behind an Elastic Load Balancer. The instances run in an Auto Scaling group. The application's performance remains consistent throughout most of each day. However, an increase in user traffic slows the performance during the same 4-hour period of time each day. What is the MOST operationally efficient solution that will resolve this issue?

   • AConfigure a second Elastic Load Balancer in front of the Auto Scaling group with a weighted routing policy.
   • BConfigure the fleet of EC2 instances to run on larger instance types to support the increase in user traffic.
   • CCreate a scheduled scaling action to scale out the number of EC2 instances shortly before the increase in user traffic occurs.
   • DManually add a few more EC2 instances to the Auto Scaling group to support the increase in user traffic.

   Show answer

   Answer: C

   Explanation

   I'm voting for C! They see the same slow performance at the same time each day. Scheduled scaling makes sense. Scheduled scaling helps you to set up your own scaling schedule according to predictable load changes. For example, let's say that every week the traffic to your web application starts to increase on Wednesday, remains high on Thursday, and starts to decrease on Friday. You can configure a schedule for Amazon EC2 Auto Scaling to increase capacity on Wednesday and decrease capacity on Friday. To use scheduled scaling, you create scheduled actions. Scheduled actions are performed automatically as a function of date and time. When you create a scheduled action, you specify when the scaling activity should occur and the new desired, minimum, and maximum sizes for the scaling action. You can create scheduled actions that scale one time only or that scale on a recurring schedule. https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-scheduled-scaling.html

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation

   Next question

7. Question 17 · 475 in bank

   A company hosts an application on an Amazon EC2 instance in a single AWS Region. The application requires support for non-HTTP TCP traffic and HTTP traffic. The company wants to deliver content with low latency by leveraging the AWS network. The company also wants to implement an Auto Scaling group with an Elastic Load Balancer. How should a SysOps administrator meet these requirements?

   • ACreate an Auto Scaling group with an Application Load Balancer (ALB). Add an Amazon CloudFront distribution with the ALB as the origin.
   • BCreate an Auto Scaling group with an Application Load Balancer (ALB). Add an accelerator with AWS Global Accelerator with the ALB as an endpoint.
   • CCreate an Auto Scaling group with a Network Load Balancer (NLB). Add an Amazon CloudFront distribution with the NLB as the origin.
   • DCreate an Auto Scaling group with a Network Load Balancer (NLB). Add an accelerator with AWS Global Accelerator with the NLB as an endpoint.

   Show answer

   Answer: D

   Explanation

   It is not A or B because ALB works with layer 7 of OSI model ( HTTP, HTTPS ) , NLB works with layer 4 ( TCP, UDP, TLS ) . it remains C or D . it is possible to have the eLB as the origin Cloudfront but CloudFront is designed to handle the HTTP protocol, while Global Accelerator is best used for HTTP and non-HTTP protocols such as TCP and UDP. So, my answer is D too.

   Source: Adapted from community discussion — Gorille69

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 18 · 475 in bank

   A SysOps administrator has an AWS CloudFormation template that is used to deploy an encrypted Amazon Machine Image (AMI). The CloudFormation template will be used in a second account so the SysOps administrator copies the encrypted AMI to the second account. When launching the new CloudFormation stack in the second account, it fails. Which action should the SysOps administrator take to correct the issue?

   • AChange the AMI permissions to mark the AMI as public.
   • BDeregister the AMI in the source account.
   • CRe-encrypt the destination AMI with an AWS Key Management Service (AWS KMS) key from the destination account.
   • DUpdate the CloudFormation template with the ID of the AMI in the destination account.

   Show answer

   Answer: D

   Explanation

   "Copying a source AMI results in an identical but distinct target AMI with its own unique identifier. You can change or deregister the source AMI with no effect on the target AMI. The reverse is also true." https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingAMIs.html

   Source: Adapted from community discussion — TwinSpark

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 19 · 475 in bank

   A company’s SysOps administrator deploys four new Amazon EC2 instances by using the standard Amazon Linux 2 Amazon Machine Image (AMI). The company needs to be able to use AWS Systems Manager to manage the instances. The SysOps administrator notices that the instances do not appear in the Systems Manager console. What must the SysOps administrator do to resolve this issue?

   • AConnect to each instance by using SSH. Install Systems Manager Agent on each instance. Configure Systems Manager Agent to start automatically when the instances start up.
   • BUse AWS Certificate Manager (ACM) to create a TLS certificate. Import the certificate into each instance. Configure Systems Manager Agent to use the TLS certificate for secure communications.
   • CConnect to each instance by using SSH. Create an ssm-user account. Add the ssm-user account to the /etc/sudoers.d directory.
   • DAttach an IAM instance profile to the instances. Ensure that the instance profile contains the AmazonSSMManagedInstanceCore policy.

   Show answer

   Answer: D

   Explanation

   "Amazon ECS Optimized Linux 2 Amazon Machine Images(AMI) now come with the AWS System Manager (SSM) Agent pre-installed" ref : https://aws.amazon.com/about-aws/whats-new/2020/02/amazon-ecs-optimized-linux-2-amis-come-pre-installed-aws-systems-manager-agent/#:~:text=Amazon%20ECS%20Optimized%20Linux%202,SSM)%20Agent%20pre%2Dinstalled.

   Source: Adapted from community discussion — fazlur21

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 20 · 475 in bank

    Select 2

    A SysOps administrator is maintaining a web application using an Amazon CloudFront web distribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All services have logging enabled. The administrator needs to investigate HTTP Layer 7 status codes from the web application. Which log sources contain the status codes? (Choose two.)

    • AVPC Flow Logs
    • BAWS CloudTrail logs
    • CALB access logs
    • DCloudFront access togs
    • ERDS logs

    Show answer

    Answer: CD

    Explanation

    why not B : AWS CloudTrail logs record API calls and events for AWS services, but they are not focused on capturing HTTP Layer 7 status codes from web application traffic.

    Source: Adapted from community discussion — jipark

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 11. 475 questions available.