SOA-C02 practice questions 191–200

1. Question 191 · 475 in bank

   A SysOps administrator needs to collect the content of log files from a custom application that is deployed across hundreds of Amazon EC2 instances running Ubuntu. The log files need to be stored in Amazon CloudWatch Logs. How should the SysOps administrator collect the application log files with the LOWEST operational overhead?

   • AConfigure the syslogd service on each EC2 instance to collect and send the application log files to CloudWatch Logs.
   • BInstall the CloudWatch agent by using the Amazon Linux package manager on each EC2 instance. Configure each agent to collect the application log files.
   • CInstall the CloudWatch agent on each EC2 instance by using AWS Systems Manager. Create an agent configuration on each instance by using the CloudWatch configuration wizard. Configure each agent to collect the application log files.
   • DStore a CloudWatch agent configuration in the AWS Systems Manager Parameter Store. Install the CloudWatch agent on each EC2 instance by using Systems Manager. Configure each agent to collect the application log files.

   Show answer

   Answer: D

   Explanation

   At first reading I chose "C". However, in doing a little research its clear Amazon suggests using parameter store to a config centrally so you don't have to run the wizard a bunch of ties. I couldn't find a link to document exact steps, but the following links outline that it can be done: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file-wizard.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-on-EC2-Instance-fleet.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-commandline-fleet.html

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 192 · 475 in bank

   Select 2

   A SysOps administrator needs to design a disaster recovery (DR) plan for an application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The application uses an Amazon Aurora PostgreSQL database. The recovery time objective (RTO) and recovery point objective (RPO) are 15 minutes each. Which combination of steps should the SysOps administrator take to meet these requirements MOST cost-effectively? (Choose two.)

   • AConfigure Aurora backups to be exported to the DR Region.
   • BConfigure the Aurora cluster to replicate data to the DR Region by using the Aurora global database option.
   • CConfigure the DR Region with an ALB and an Auto Scaling group. Use the same configuration as in the primary Region.
   • DConfigure the DR Region with an ALB and an Auto Scaling group. Set the Auto Scaling group's minimum capacity, maximum capacity, and desired capacity to 1.
   • EManually launch a new ALB and a new Auto Scaling group by using AWS CloudFormation during a failover activity.

   Show answer

   Answer: BD

   Explanation

   A vs B: Backups run in intervals -> will lose data up to the last backup point -> cannot achieve low RPO. B is better solution C vs D: D works because the ASG maintains capacity to 1, that means resource are always at least available for failover. C is more costly. E: when you see manual, you run

   Source: Adapted from community discussion — imvb88

   References

   • AWS documentation

   Next question

3. Question 193 · 475 in bank

   A SysOps administrator is creating a simple, public-facing website running on Amazon EC2. The SysOps administrator created the EC2 instance in an existing public subnet and assigned an Elastic IP address to the instance. Next, the SysOps administrator created and applied a new security group to the instance to allow incoming HTTP traffic from 0.0.0.0/0. Finally, the SysOps administrator created a new network ACL and applied it to the subnet to allow incoming HTTP traffic from 0.0.0.0/0. However, the website cannot be reached from the internet. What is the cause of this issue?

   • AThe SysOps administrator did not create an outbound rule that allows ephemeral port return traffic in the new network ACL.
   • BThe SysOps administrator did not create an outbound rule in the security group that allows HTTP traffic from port 80.
   • CThe Elastic IP address assigned to the EC2 instance has changed.
   • DThere is an additional network ACL associated with the subnet that includes a rule that denies inbound HTTP traffic from port 80.

   Show answer

   Answer: A

   Explanation

   I agree with A. I don't know if comment is necessary, because anyone who understands NACLs knows you have to enable the ephemeral ports to serve a HTTP response to 0.0.0.0/0 origins.

   Source: Adapted from community discussion — Gomer

   Next question

4. Question 194 · 475 in bank

   A company has an application that uses an Amazon Elastic File System (Amazon EFS) file system. A recent incident that involved an application logic error corrupted several files. The company wants to improve its ability to back up and recover the EFS file system. The company must be able to recover individual files rapidly. Which solution meets these requirements MOST cost-effectively?

   • AConfigure Amazon Data Lifecycle Manager (Amazon DLM) to archive a copy of the data to an Amazon S3 Glacier vault. Use S3 Glacier retrieval requests to retrieve individual files.
   • BCreate a second EFS file system in another AWS Region. Configure AWS DataSync to copy the data to the backup file system. Recover files by copying them from the backup EFS file system.
   • CEnable AWS Backup in Amazon EFS to back up the file system to an Amazon S3 Glacier vault. Use S3 Glacier retrieval requests to retrieve individual files.
   • DEnable AWS Backup in Amazon EFS to back up the file system to a backup vault. Use a partial restore job to retrieve individual files.

   Show answer

   Answer: D

   Explanation

   When an archive gets into GLACIER there is not way to retrieve it RAPIDLY, so answer is not A or C, AWS backup is a good option . Option D for me

   Source: Adapted from community discussion — mana25

   Next question

5. Question 195 · 475 in bank

   Select 2

   A company migrates a write-once, ready-many (WORM) drive to an Amazon S3 bucket that has S3 Object Lock configured in governance mode. During the migration, the company copies unneeded data to the S3 bucket. A SysOps administrator attempts to delete the unneeded data from the S3 bucket by using the AWS CLI. However, the SysOps administrator receives an error. Which combination of steps should the SysOps administrator take to successfully delete the unneeded data? (Choose two.)

   • AIncrease the Retain Until Date.
   • BAssume a role that has the s3:BypassLegalRetention permission.
   • CAssume a role that has the s3:BypassGovernanceRetention permission.
   • DInclude the x-amz-bypass-governance-retention:true header in the request when issuing the delete command.
   • EInclude the x-amz-bypass-legal-retention:true header in the request when issuing the delete command.

   Show answer

   Answer: CD

   Explanation

   "To override or remove governance-mode retention settings, a user must have the s3:BypassGovernanceRetention permission and must explicitly include x-amz-bypass-governance-retention:true as a request header with any request that requires overriding governance mode." https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-modes

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation

   Next question

6. Question 196 · 475 in bank

   A company needs to view a list of security groups that are open to the internet on port 3389. What should a SysOps administrator do to meet this requirement?

   • AConfigure Amazon GuardDuty to scan security groups and report unrestricted access on port 3389.
   • BConfigure a service control policy (SCP) to identify security groups that allow unrestricted access on port 3389.
   • CUse AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.
   • DUse AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389.

   Show answer

   Answer: D

   Explanation

   AWS Trusted Advisor is a service that provides best practice recommendations to help optimize your AWS environment. It can detect security-related issues, including security groups with overly permissive rules. In this case, it can help you identify security groups that are open to the internet on port 3389, which is the Remote Desktop Protocol (RDP) port. By using AWS Trusted Advisor, the SysOps administrator can quickly access a list of security groups that have this unrestricted access configuration. This allows them to review and take necessary actions to tighten the security settings and restrict access as needed.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation

   Next question

7. Question 197 · 475 in bank

   Select 2

   A company website contains a web tier and a database tier on AWS. The web tier consists of Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones. The database tier runs on an Amazon RDS for MySQL Multi-AZ DB instance. The database subnet network ACLs are restricted to only the web subnets that need access to the database. The web subnets use the default network ACL with the default rules. The company's operations team has added a third subnet to the Auto Scaling group configuration. After an Auto Scaling event occurs, some users report that they intermittently receive an error message. The error message states that the server cannot connect to the database. The operations team has confirmed that the route tables are correct and that the required ports are open on all security groups. Which combination of actions should a SysOps administrator take so that the web servers can communicate with the DB instance? (Choose two.)

   • AOn the default ACL, create inbound Allow rules of type TCP with the ephemeral port range and the source as the database subnets.
   • BOn the default ACL, create outbound Allow rules of type MySQL/Aurora (3306). Specify the destinations as the database subnets.
   • COn the network ACLs for the database subnets, create an inbound Allow rule of type MySQL/Aurora (3306). Specify the source as the third web subnet.
   • DOn the network ACLs for the database subnets, create an outbound Allow rule of type TCP with the ephemeral port range and the destination as the third web subnet.
   • EOn the network ACLs for the database subnets, create an outbound Allow rule of type MySQL/Aurora (3306). Specify the destination as the third web subnet.

   Show answer

   Answer: CD

   Explanation

   The simplified logic I came up with is if the same existing/working public NACL is applied to the new pub subnet, then no change should need to be made to the rules. On the other hand, the custom DB subnet NACL needs to have new incoming/outgoing rules to also operate with the new public subnet. Incoming is always going to be 3306 to the DB listener (MySQL). Outgoing is always going to be ephemeral from the DB server to public subnet. I must be slow or tired, but It took some effort for this to become clear in my mind tonight. Your only allowing an existing subnet, and you don't want to touch any existing configurations or your going to create a new problem and maybe be looking for a new job. I'd always document a checklist before doing something this, and run it through peer review and change control before touching prod. I'd turn those notes into a SOP and include any references I could fine documenting AWS best practices, etc. Enough said.

   Source: Adapted from community discussion — Gomer

   References

   • repost.aws documentation

   Next question

8. Question 198 · 475 in bank

   A SysOps administrator has been able to consolidate multiple, secure websites onto a single server, and each site is running on a different port. The administrator now wants to start a duplicate server in a second Availability Zone and put both behind a load balancer for high availability. What would be the command line necessary to deploy one of the sites’ certificates to the load balancer?

   • Aaws kms modify-listener –-load-balancer-name my-load-balancer -–certificates CertificateArn=arn:aws:iam::123456789012:server-certifiate/my-new-server-cert
   • Baws elb set-load-balancer-listener-ssl-certificate --load-balancer-name my-load-balancer –-load-balancer-port 443 –-ssl-certificate-id arn:aws:iam::123456789012:server-certificate/new-server-cert
   • Caws ec2 put-ssl-certificate –-load-balancer-name my-load-balancer –-load-balancer-port 443 –-ssl-certificate-id arn:aws:iam::123456789012:server-certificate/new-server-cert
   • Daws acm put-ssl-certificate –-load-balancer-name my-load-balancer –-load-balancer-port 443 –-ssl-certificate-id arn:aws:iam::123456789012:server-certificate/new-server-cert

   Show answer

   Answer: B

   Explanation

   Sets the certificate that terminates the specified listener’s SSL connections. The specified certificate replaces any prior certificate that was used on the same load balancer and port. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/elb/set-load-balancer-listener-ssl-certificate.html

   Source: Adapted from community discussion — tgv

   References

   • AWS documentation

   Next question

9. Question 199 · 475 in bank

   A SysOps administrator is preparing to deploy an application to Amazon EC2 instances that are in an Auto Scaling group. The application requires dependencies to be installed. Application updates are issued weekly. The SysOps administrator needs to implement a solution to incorporate the application updates on a regular basis. The solution also must conduct a vulnerability scan during Amazon Machine Image (AMI) creation. What is the MOST operationally efficient solution that meets these requirements?

   • ACreate a script that uses Packer. Schedule a cron job to run the script.
   • BInstall the application and its dependencies on an EC2 instance. Create an AMI of the EC2 instance.
   • CUse EC2 Image Builder with a custom recipe to install the application and its dependencies.
   • DInvoke the EC2 CreateImage API operation by using an Amazon EventBridge scheduled rule.

   Show answer

   Answer: C

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 200 · 475 in bank

    An AWS CloudFormation template creates an Amazon RDS instance. This template is used to build up development environments as needed and then delete the stack when the environment is no longer required. The RDS-persisted data must be retained for further use, even after the CloudFormation stack is deleted. How can this be achieved in a reliable and efficient way?

    • AWrite a script to continue backing up the RDS instance every five minutes.
    • BCreate an AWS Lambda function to take a snapshot of the RDS instance, and manually invoke the function before deleting the stack.
    • CUse the Snapshot Deletion Policy in the CloudFormation template definition of the RDS instance.
    • DCreate a new CloudFormation template to perform backups of the RDS instance, and run this template before deleting the stack.

    Show answer

    Answer: C

    Explanation

    It would be "DeletionPolicy": "Snapshot Since you are trying to delete resource but keep a backup. Retain will keep the Instance itself.

    Source: Adapted from community discussion — null0xAF

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 191. 475 questions available.