SOA-C02 practice questions 211–220

1. Question 211 · 475 in bank

   A company has a hybrid environment. The company has set up an AWS Direct Connect connection between the company's on-premises data center and a workload that runs in a VPC. The company uses Amazon Route 53 for DNS on AWS. The company uses a private hosted zone to manage DNS names for a set of services that are hosted on AWS. The company wants the on-premises servers to use Route 53 for DNS resolution of the private hosted zone. Which solution will meet these requirements?

   • ACreate a Route 53 inbound endpoint. Ensure that security groups and routing allow the traffic from the on-premises data center. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the inbound endpoint.
   • BCreate a Route 53 outbound endpoint. Ensure that security groups and routing allow the traffic from the VPC. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone’s domain name to the IP addresses of the outbound endpoint.
   • CEdit the private hosted zone in Route 53 with a TXT record that references the on-premises DNS servers. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone’s domain name to the base of the VPC CIDR IPv4 network range, plus two.
   • DEdit the private hosted zone in Route 53 with a PTR record that references the on-premises DNS servers. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone’s domain name to the base of the VPC CIDR IPv4 network range, plus two.

   Show answer

   Answer: A

   Explanation

   "The company wants the on-premises servers to use Route 53 for DNS resolution of the private hosted zone." I think A should be the answer

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation

   Next question

2. Question 212 · 475 in bank

   A company is using an Amazon Aurora MySQL DB cluster that has point-in-time recovery, backtracking, and automatic backup enabled. A SysOps administrator needs to be able to roll back the DB cluster to a specific recovery point within the previous 72 hours. Restores must be completed in the same production DB cluster. Which solution will meet these requirements?

   • ACreate an Aurora Replica. Promote the replica to replace the primary DB instance.
   • BCreate an AWS Lambda function to restore an automatic backup to the existing DB cluster.
   • CUse backtracking to rewind the existing DB cluster to the desired recovery point.
   • DUse point-in-time recovery to restore the existing DB cluster to the desired recovery point.

   Show answer

   Answer: C

   Explanation

   C. within 72 hours, backtracking is enabled. Must not restore to a new DB. C is the only solution that meets all requirements.

   Source: Adapted from community discussion — Mecdrox

   References

   • AWS documentation

   Next question

3. Question 213 · 475 in bank

   A SysOps administrator is evaluating Amazon Route 53 DNS options to address concerns about high availability for an on-premises website. The website consists of two servers: a primary active server and a secondary passive server. Route 53 should route traffic to the primary server if the associated health check returns 2xx or 3xx HTTP codes. All other traffic should be directed to the secondary passive server. The failover record type, set ID, and routing policy have been set appropriately for both primary and secondary servers. Which next step should be taken to configure Route 53?

   • ACreate an A record for each server. Associate the records with the Route 53 HTTP health check.
   • BCreate an A record for each server. Associate the records with the Route 53 TCP health check.
   • CCreate an alias record for each server with evaluate target health set to yes. Associate the records with the Route 53 HTTP health check.
   • DCreate an alias record for each server with evaluate target health set to yes. Associate the records with the Route 53 TCP health check.

   Show answer

   Answer: A

   Explanation

   We are talking about two on-premise web servers, meaning we have IP addresses for them. What we should do is to create proper records in a public hosted zone, e.g. A-record in this case. We are not working with aliases for on-premise resources. Aliases are for resources in Cloud, e.g. ELB. Last thing is that we are talking about HTTP protocol.

   Source: Adapted from community discussion — kondratyevmn

   References

   • AWS documentation

   Next question

4. Question 214 · 475 in bank

   An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A SysOps administrator must ensure that the application can read, write, and delete messages from the SQS queues. Which solution will meet these requirements in the MOST secure manner?

   • ACreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues. Embed the IAM user's credentials in the application's configuration
   • BCreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the sqs:RecelveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues. Export the IAM user's access key and secret access key as environment variables on the EC2 instance.
   • CCreate and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows sqs:* permissions to the appropriate queues.
   • DCreate and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues.

   Show answer

   Answer: D

   Explanation

   FYI, 99.9% times you are not supposed to use the wildcard on any policy (service:*). you are always supposed to use the least privilege access, meaning you need to only declare the actions you need.

   Source: Adapted from community discussion — tgv

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 215 · 475 in bank

   A SysOps administrator needs to configure an Amazon S3 bucket to host a web application. The SysOps administrator has created the S3 bucket and has copied the static files for the web application to the S3 bucket. The company has a policy that all $3 buckets must not be public. What should the SysOps administrator do to meet these requirements?

   • ACreate an Amazon CloudFront distribution. Configure the S3 bucket as an origin with an origin access identity (OAI). Give the OAI the s3:GetObject permission in the S3 bucket policy.
   • BConfigure static website hosting in the S3 bucket. Use Amazon Route 53 to create a DNS CNAME to point to the S3 website endpoint.
   • CCreate an Application Load Balancer (ALB). Change the protocol to HTTPS in the ALB listener configuration. Forward the traffic to the S3 bucket.
   • DCreate an accelerator in AWS Global Accelerator. Set up a listener configuration for port 443. Set the endpoint type to forward the traffic to the S3 bucket.

   Show answer

   Answer: A

   Explanation

   B makes no sense since Route 53 will point to a bucket that does not have public permissions. . . Answer is A because you can create OAI and set s3 bucket as origin for CloudFront, and have the Bucket completely blocked publicly

   Source: Adapted from community discussion — null0xAF

   References

   • AWS documentation

   Next question

6. Question 216 · 475 in bank

   Select 2

   A company is building a web application on AWS. The company is using Amazon CloudFront with a domain name of www.example.com. All traffic to CloudFront must be encrypted in transit. The company already has provisioned an SSL certificate for www.example.com in AWS Certificate Manager (ACM). Which combination of steps should a SysOps administrator take to encrypt the traffic in transit? (Choose two.)

   • AFor each cache behavior in the CloudFront distribution, modify the Viewer Protocol Policy setting to redirect HTTP to HTTPS.
   • BFor each cache behavior in the CloudFront distribution, modify the Viewer Protocol Policy setting to allow HTTP and HTTPS.
   • CEnter the alternate domain name (CNAME) of www.example.com for the CloudFront distribution. Select the custom SSL certificate.
   • DConfigure an AWS WAF web ACL for the CloudFront distribution.
   • EConfigure CloudFront Origin Shield for the CloudFront origin.

   Show answer

   Answer: AC

   Explanation

   To encrypt the traffic in transit for a web application using Amazon CloudFront with an SSL certificate from AWS Certificate Manager (ACM), you should take the following steps: C. Enter the alternate domain name (CNAME) of www.example.com for the CloudFront distribution. Select the custom SSL certificate: This step ensures that CloudFront is configured to use the custom SSL certificate from ACM for encrypting the traffic between the viewer (client) and CloudFront. A. For each cache behavior in the CloudFront distribution, modify the Viewer Protocol Policy setting to redirect HTTP to HTTPS: This step enforces the use of HTTPS by redirecting any HTTP requests to HTTPS. This is an important security practice to ensure that all traffic is encrypted in transit.

   Source: Adapted from community discussion — AWSdeveloper08

   Next question

7. Question 217 · 475 in bank

   A company runs an application on hundreds of Amazon EC2 instances in three Availability Zones. The application calls a third-party API over the public internet. A SysOps administrator must provide the third party with a list of static IP addresses so that the third party can allow traffic from the application. Which solution will meet these requirements?

   • AAdd a NAT gateway in the public subnet of each Availability Zone. Make the NAT gateway the default route of all private subnets in those Availability Zones.
   • BAllocate one Elastic IP address in each Availability Zone. Associate the Elastic IP address with all the instances in the Availability Zone.
   • CPlace the instances behind a Network Load Balancer (NLB). Send the traffic to the internet through the private IP address of the NLB.
   • DUpdate the main route table to send the traffic to the internet through an Elastic IP address that is assigned to each instance.

   Show answer

   Answer: A

   Explanation

   From my perspective, you can't assign an elastic IP to multiple instances in an AZ. Also, the API will never see a private IP on the AWS side. To me, the answer is to have a static public IP (EIP) assigned to the NAT gateway in each AZ, and have the EC2 instances on a private subnet. Everytime and instance hits the external API, the API is going to see one of three unchanging EIPs. Enough said.

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • repost.aws documentation

   Next question

8. Question 218 · 475 in bank

   A company manages its multi-account environment by using AWS Organizations. The company needs to automate the creation of daily incremental backups of any Amazon Elastic Block Store (Amazon EBS) volume that is marked with a Lifecycle: Production tag in one of its primary AWS accounts. The company wants to prevent users from using Amazon EC2 * permissions to delete any of these production snapshots. What should a SysOps administrator do to meet these requirements?

   • ACreate a daily snapshot of all EBS volumes by using Amazon Data Lifecycle Manager. Specify Lifecycle as the tag key. Specify Production as the tag value.
   • BAssociate a service control policy (SCP) with the account to deny users the ability to delete EBS snapshots. Create an Amazon EventBridge rule with a 24-hour cron schedule. Configure EBS Create Snapshot as the target. Target all EBS volumes with the specified tags.
   • CCreate a daily snapshot of all EBS volumes by using AWS Backup. Specify Lifecycle as the tag key. Specify Production as the tag value.
   • DCreate a daily Amazon Machine Image (AMI) of every production EC2 instance within the AWS account by using Amazon Data Lifecycle Manager.

   Show answer

   Answer: C

   Explanation

   I think answer is "C" because using AWS backup is the established method/tool for this, and EC2 instance role/profile would not be allow to control or delete backups unless explicitly allowed. The word "cron" in en answer "B" is red flag that is is the wrong answer. I know all about cron, and it's invaluable and bullet proof on a system. However, it's anathema to AWS Cloud way of doing things. Wherever you see the word "cron" in AWS response, you know its the wrong answer (IMHO).

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 219 · 475 in bank

   A company hosts a Windows-based file server on a fleet of Amazon EC2 instances across multiple Availability Zones. The current setup does not allow application servers to access files simultaneously from the EC2 fleet. Which solution will allow this access in the MOST operationally efficient way?

   • ACreate an Amazon Elastic File System (Amazon EFS) Multi-AZ file system. Copy the files to the EFS file system. Connect the EFS file system to mount points on the application servers.
   • BCreate an Amazon FSx for Windows File Server Multi-AZ file system. Copy the files to the Amazon FSx file system. Adjust the connections from the application servers to use the share that the Amazon FSx file system exposes.
   • CCreate an Amazon Elastic Block Store (Amazon EBS) volume that has EBS Multi-Attach enabled. Create an Auto Scaling group for the Windows file server. Use a script in the file server's user data to attach the SharedFileAccess tag to the EBS volume during launch.
   • DCreate two Amazon FSx for Windows File Server file systems. Configure Distributed File System (DFS) replication between the file systems. Copy the files to the Amazon FSx file systems. Adjust the connections from the application servers to use the shares that the Amazon FSx file systems expose.

   Show answer

   Answer: B

   Explanation

   A is incorrect because talks about EFS in general. C is incorrect because EBS Multi-Attach only works for instances in the same AZ. D is incorrect because Distributed File System (DFS) replication applies only for regions. B is the correct answer. https://aws.amazon.com/blogs/storage/how-to-replicate-amazon-fsx-file-server-data-across-aws-regions/ https://aws.amazon.com/blogs/storage/delivering-instant-data-sharing-with-multi-attach-enabled-amazon-ebs/

   Source: Adapted from community discussion — Zotarix

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 220 · 475 in bank

    A company has deployed an application on Amazon EC2 instances in a single VPC. The company has placed the EC2 instances in a private subnet in the VPC. The EC2 instances need access to Amazon S3 buckets that are in the same AWS Region as the EC2 instances. A SysOps administrator must provide the EC2 instances with access to the S3 buckets without requiring any changes to the EC2 instances or the application. The EC2 instances must not have access to the internet. Which solution will meet these requirements?

    • ACreate an S3 gateway endpoint that uses the default gateway endpoint policy. Associate the private subnet with the gateway endpoint.
    • BCreate an S3 interface endpoint. Associate the EC2 instances with the interface endpoint.
    • CConfigure a NAT gateway. Associate the private subnet with the NAT gateway.
    • DConfigure a proxy EC2 instance. Update the private subnet route tables to route traffic through the proxy EC2 instance. Configure the proxy to route all S3 requests to the target S3 bucket.

    Show answer

    Answer: A

    Explanation

    Create an S3 gateway endpoint that uses the default gateway endpoint policy. Associate the private subnet with the gateway endpoint. Notes: Amazon S3 supports both gateway endpoints and interface endpoints. With a gateway endpoint, you can access Amazon S3 from your VPC, without requiring an internet gateway or NAT device for your VPC, and with no additional cost. However, gateway endpoints do not allow access from on-premises networks, from peered VPCs in other AWS Regions, or through a transit gateway. For those scenarios, you must use an interface endpoint, which is available for an additional cost. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html Interface endpoints - These endpoints are directly accessible from applications that are on premises over VPN and AWS Direct Connect, or in a different AWS Region over VPC peering. https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html

    Source: Adapted from community discussion — noahsark

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 211. 475 questions available.