SOA-C02 practice questions 201–210

1. Question 201 · 475 in bank

   Select 2

   A SysOps administrator must configure Amazon S3 to host a simple nonproduction webpage. The SysOps administrator has created an empty S3 bucket from the AWS Management Console. The S3 bucket has the default configuration in place. Which combination of actions should the SysOps administrator take to complete this process? (Choose two.)

   • AConfigure the S3 bucket by using the "Redirect requests for an object" functionality to point to the bucket root URL.
   • BTurn off the "Block all public access" setting. Allow public access by using a bucket ACL that contains <Permission>WEBSITE</Permission>.
   • CTurn off the "Block all public access" setting. Allow public access by using a bucket ACL that allows access to the AuthenticatedUsers grantee.
   • DTurn off the "Block all public access" setting. Set a bucket policy that allows "Principal": the s3:GetObject action.
   • ECreate an index.html document. Configure static website hosting, and upload the index document to the S3 bucket.

   Show answer

   Answer: DE

   Explanation

   Step 1: Create a bucket Step 2: Enable static website hosting Step 3: Edit Block Public Access settings Step 4: Add a bucket policy that makes your bucket content publicly available Step 5: Configure an index document Step 6: Configure an error document Step 7: Test your website endpoint Step 8: Clean up https://docs.aws.amazon.com/AmazonS3/latest/userguide/HostingWebsiteOnS3Setup.html

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation

   Next question

2. Question 202 · 475 in bank

   AnyCompany has acquired Example Corp and is attempting to consolidate the business systems of both companies. AnyCompany’s IT department needs to integrate with Example Corp’s IT ticketing system. A SysOps administrator must implement a solution that uses Amazon CloudWatch alarms for Amazon EC2 instances in AnyCompany’s account to create new tickets in Example Corp’s ticketing system. The ticketing system provides an HTTPS endpoint for the creation of new tickets. The ticketing system accepts messages in the following JSON format:

   

   Which approach to creating tickets from the CloudWatch alarms will meet these requirements with the LEAST development time?

   • ACreate an Amazon EventBridge rule that filters appropriate events and specifies EventBridge API destinations as a target. Configure EventBridge API destinations to send events to the HTTPS endpoint. In the EventBridge rule, create an input transformer to convert the source to a compatible output for the ticketing system.
   • BCreate an Amazon EventBridge rule that filters appropriate events and specifies an Amazon Kinesis data stream as the target. Create an AWS Lambda function to receive events from the Kinesis data stream. Configure the Lambda function to start an AWS Glue job to transform the data and forward the output to the HTTPS endpoint.
   • CCreate an Amazon EventBridge rule that filters appropriate events and specifies Amazon Simple Notification Service (Amazon SNS) as a target. Configure Amazon SNS to transform the events and send the events to the HTTPS endpoint.
   • DCreate an Amazon EventBridge rule that filters appropriate events and specifies an AWS Step Functions state machine as a target. Create an AWS Lambda function and an AWS Glue job in Step Functions to transform the events and send the events to the HTTPS endpoint.

   Show answer

   Answer: A

   Explanation

   EventBridge Rule with API Destinations: EventBridge allows you to create rules that match certain events (in this case, CloudWatch alarms) and forward them to specified targets. API Destinations are one such target, which allows you to directly send the events to an HTTPS endpoint, such as the ticketing system. No Additional Services: Option A involves setting up an EventBridge rule and using the API Destinations feature, which means there are no additional services like Kinesis, Lambda, or Step Functions to configure and manage. This simplifies the solution and reduces development time. Input Transformer: The input transformer in the EventBridge rule allows you to convert the source data (CloudWatch alarm event) into the required JSON format for the ticketing system. This makes it easy to transform the data without the need for additional AWS Glue jobs or complex transformations.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 203 · 475 in bank

   A SysOps administrator needs to provision a new fleet of Amazon EC2 Spot Instances in an Amazon EC2 Auto Scaling group. The Auto Scaling group will use a wide range of instance types. The configured fleet must come from pools that have the most availability for the number of instances that are launched. Which solution will meet these requirements?

   • ALaunch the Spot Instances up to the maximum capacity of the Auto Scaling group.
   • BLaunch the Spot Instances by using the diversified strategy.
   • CLaunch the Spot Instances by using the capacity optimized strategy.
   • DUse the Spot Instance advisor to help determine the best Spot allocation strategy.

   Show answer

   Answer: C

   Explanation

   capacity-optimized strategy automatically analyzes the available Spot capacity pools and selects the pool that provides the highest chance of launching the desired number of instances. Spot Instance Advisor can provide guidance on Spot instance pricing and interruption history, but it does not specifically address the goal of selecting pools with the most availabilit https://aws.amazon.com/about-aws/whats-new/2019/08/new-capacity-optimized-allocation-strategy-for-provisioning-amazon-ec2-spot-instances/

   Source: Adapted from community discussion — rev2211

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 204 · 475 in bank

   A SysOps administrator creates a custom Amazon Machine Image (AMI) in the eu-west-2 Region and uses the AMI to launch Amazon EC2 instances. The SysOps administrator needs to use the same AMI to launch EC2 instances in two other Regions: us-east-1 and us-east-2. What must the SysOps administrator do to use the custom AMI in the additional Regions?

   • ACopy the AMI to the additional Regions.
   • BMake the AMI public in the Community AMIs section of the AWS Management Console.
   • CShare the AMI to the additional Regions. Assign the required access permissions.
   • DCopy the AMI to a new Amazon S3 bucket. Assign access permissions to the AMI for the additional Regions.

   Show answer

   Answer: A

   Explanation

   Region – AMIs are a Regional resource. When you share an AMI, it is only available in that Region. To make an AMI available in a different Region, copy the AMI to the Region and then share it. For more information, see Copy an AMI. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html

   Source: Adapted from community discussion — kondratyevmn

   References

   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 205 · 475 in bank

   A company has many accounts in an organization in AWS Organizations. The company must automate resource provisioning from the organization’s management account to the member accounts. Which solution will meet this requirement?

   • ACreate an AWS CloudFormation change set. Deploy the change set to all member accounts.
   • BCreate an AWS CloudFormation nested stack. Deploy the nested stack to all member accounts.
   • CCreate an AWS CloudFormation stack set. Deploy the stack set to all member accounts.
   • DCreate an AWS Serverless Application Model (AWS SAM) template. Deploy the template to all member accounts.

   Show answer

   Answer: C

   Explanation

   change sets = like a previews of what the IAC will do nested sets = pre saved configurations you could use again in a different template stack sets = allows creation, deletion , updating of stacks across multiple accounts

   Source: Adapted from community discussion — Bhrino

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 206 · 475 in bank

   A company is building an interactive application for personal finance. The application stores financial data in Amazon S3, and the data must be encrypted. The company does not want to provide its own encryption keys. However, the company wants to maintain an audit trail that shows when an encryption key was used and who used the key. Which solution will meet these requirements?

   • AUse client-side encryption with client-provided keys. Upload the encrypted user data to Amazon S3.
   • BUse server-side encryption with S3 managed encryption keys (SSE-S3) to encrypt the user data on Amazon S3.
   • CUse server-side encryption with customer-provided encryption keys (SSE-C) to encrypt the user data on Amazon S3.
   • DUse server-side encryption with AWS KMS managed encryption keys (SSE-KMS) to encrypt the user data on Amazon S3.

   Show answer

   Answer: D

   Explanation

   While SSE-S3 is convenient, it doesn't allow the company to have control over key management or maintain a detailed audit trail for key usage. AWS KMS provides detailed audit logs through AWS CloudTrail, which allows you to monitor and log all API calls related to key usage

   Source: Adapted from community discussion — nharaz

   References

   • AWS documentation

   Next question

7. Question 207 · 475 in bank

   Select 2

   A company has an AWS CloudFormation template that creates an Amazon S3 bucket. A user authenticates to the corporate AWS account with their Active Directory credentials and attempts to deploy the CloudFormation template. However, the stack creation fails. Which factors could cause this failure? (Choose two.)

   • AThe user’s IAM policy does not allow the cloudformation:CreateStack action.
   • BThe user’s IAM policy does not allow the cloudformation:CreateStackSet action.
   • CThe user’s IAM policy does not allow the s3:CreateBucket action.
   • DThe user’s IAM policy explicitly denies the s3:ListBucket action.
   • EThe user’s IAM policy explicitly denies the s3:PutObject action.

   Show answer

   Answer: AC

   Explanation

   Options B, D, and E are not relevant to the CloudFormation stack creation failure for an S3 bucket. Option B is related to CloudFormation StackSets, not individual stacks. Option D and E are related to specific S3 bucket actions (list and put) and are not directly related to the stack creation process. Therefore, the correct answers are A and C.

   Source: Adapted from community discussion — trvtrinh

   Next question

8. Question 208 · 475 in bank

   Select 2

   An Amazon RDS for PostgreSQL DB cluster has automated backups turned on with a 7-day retention period. A SysOps administrator needs to create a new RDS DB cluster by using data that is no more than 24 hours old from the original DB cluster. Which solutions will meet these requirements with the LEAST operational overhead? (Choose two.)

   • AIdentify the most recent automated snapshot. Restore the snapshot to a new RDS DB cluster.
   • BBack up the database to Amazon S3 by using native database backup tools. Create a new RDS DB cluster and restore the data to the new RDS DB cluster.
   • CCreate a read replica instance in the original RDS DB cluster. Promote the read replica to a standalone DB cluster.
   • DCreate a new RDS DB cluster. Use AWS Database Migration Service (AWS DMS) to migrate data from the current RDS DB cluster to the newly created RDS DB cluster.
   • EUse the pg_dump utility to export data from the original RDS DB cluster to an Amazon EC2 instance. Create a new RDS DB cluster. Use the pg_restore utility to import the data from the EC2 instance to the new RDS DB cluster.

   Show answer

   Answer: AC

   Explanation

   Option A - Automated Snapshot: Since automated backups are enabled with a 7-day retention period, you can easily identify the most recent automated snapshot taken within the last 24 hours. You can use this snapshot to restore a new RDS DB cluster. This process is straightforward and does not require much operational overhead. Option C - Read Replica and Promotion: By creating a read replica in the original RDS DB cluster, you ensure that the replica stays up-to-date with the source database in near real-time. To meet the requirement of having data no more than 24 hours old, you can promote the read replica to a standalone DB cluster within the desired time frame. This option leverages the replication mechanism and is also relatively simple to implement.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 209 · 475 in bank

   Select 2

   A company is managing a website with a global user base hosted on Amazon EC2 with an Application Load Balancer (ALB). To reduce the load on the web servers, a SysOps administrator configures an Amazon CloudFront distribution with the ALB as the origin. After a week of monitoring the solution, the administrator notices that requests are still being served by the ALB and there is no change in the web server load. What are possible causes for this problem? (Choose two.)

   • ACloudFront does not have the ALB configured as the origin access identity.
   • BThe DNS is still pointing to the ALB instead of the CloudFront distribution.
   • CThe ALB security group is not permitting inbound traffic from CloudFront.
   • DThe default, minimum, and maximum Time to Live (TTL) are set to 0 seconds on the CloudFront distribution.
   • EThe target groups associated with the ALB are configured for sticky sessions.

   Show answer

   Answer: BD

   Explanation

   B. The DNS is still pointing to the ALB instead of the CloudFront distribution. Explanation: If the DNS is still directing user traffic directly to the ALB instead of the CloudFront distribution, then the requests will not be served through CloudFront, and there won't be any reduction in the web server load. D. The default, minimum, and maximum Time to Live (TTL) are set to 0 seconds on the CloudFront distribution. Explanation: If the Time to Live (TTL) settings are set to 0 seconds, it means that CloudFront will not cache any responses from the ALB and will forward each request directly to the ALB. This will result in the ALB still serving all the requests, and there won't be any offloading of the web server load.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 210 · 475 in bank

    Select 2

    A SysOps administrator needs to configure the Amazon Route 53 hosted zone for example.com and www.example.com to point to an Application Load Balancer (ALB). Which combination of actions should the SysOps administrator take to meet these requirements? (Choose two.)

    • AConfigure an A record for example.com to point to the IP address of the ALB.
    • BConfigure an A record for www.example.com to point to the IP address of the ALB.
    • CConfigure an alias record for example.com to point to the CNAME of the ALB.
    • DConfigure an alias record for www.example.com to point to the Route 53 example.com record.
    • EConfigure a CNAME record for example.com to point to the CNAME of the ALB.

    Show answer

    Answer: CD

    Explanation

    To route domain traffic to an ELB load balancer, use Amazon Route 53 to create an alias record that points to your load balancer. An alias record is a Route 53 extension to DNS. It's similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such as www.example.com. (You can create CNAME records only for subdomains.) https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer.html

    Source: Adapted from community discussion — [Removed]

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 201. 475 questions available.