SOA-C02 practice questions 261–270

1. Question 261 · 475 in bank

   Select 3

   A SysOps administrator is responsible for more than 50 Amazon EC2 instances that are deployed in a single production AWS account. The EC2 instances are running several different operating systems. The company's standards require patching to be completed at least once a month. The SysOps administrator wants to use AWS Systems Manager to reduce the number of hours the company spends on operating system patching each month. Which combination of steps should the SysOps administrator take to meet these requirements? (Choose three.)

   • AGroup similar EC2 instances together into resource groups by using AWS Resource Groups.
   • BCreate a schedule in Systems Manager Patch Manager. Specify the appropriate resource group as the target.
   • CSpecify Systems Manager Automation runbooks to patch the operating systems. Register the runbooks as tasks in the maintenance window. Specify the appropriate resource group as the target.
   • DCreate a Systems Manager Automation runbook to monitor and control the state of the patches required. Apply the runbook to Systems Manager Patch Manager.
   • ECreate a single Systems Manager maintenance window for each resource group.
   • FConfigure Systems Manager Fleet Manager to apply a Systems Manager Automation runbook to the appropriate resource group.

   Show answer

   Answer: ACE

   Explanation

   A: I see a "Resource Group" as the same as a "Patch Group", other than it was created by AWS Resource Groups Service. As I see it, both just apply tags to AWS instances. B: I don't see the term "schedule" EVER being used with Patch Manager. I'm of the opinion that a "Maintenance Window" isn't the same thing in this context. C: See the SSM Runbooks for patching "AWS-RunPatchBaseline" D: I couldn't find an SSM Runbook for monitor/control patch states. E: Maintenance Window is Patch Group setting F: I can't find a reference for using Fleet Manager with Patch Manager or run books.

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation

   Next question

2. Question 262 · 475 in bank

   A company has multiple AWS accounts. The company uses AWS Organizations with an organizational unit (OU) for the production account and another OU for the development account. Corporate policies state that developers may use only approved AWS services in the production account. What is the MOST operationally efficient solution to control the production account?

   • ACreate a customer managed policy in AWS Identity and Access Management (IAM). Apply the policy to all users within the production account.
   • BCreate a job function policy in AWS Identity and Access Management (IAM). Apply the policy to all users within the production OU.
   • CCreate a service control policy (SCP). Apply the SCP to the production OU.
   • DCreate an IAM policy. Apply the policy in Amazon API Gateway to restrict the production account.

   Show answer

   Answer: C

   Explanation

   To control the use of approved AWS services in the production account, the most operationally efficient solution would be to create a service control policy (SCP) and apply it to the production organizational unit (OU). An SCP is a type of policy that you can use with AWS Organizations to manage permissions in your organization’s accounts. With an SCP, you can specify the services and actions that users and roles can use in the accounts that are part of the OU to which the SCP is attached. This allows you to centrally control the use of approved AWS services in the production account. So, the correct answer would be C. Create a service control policy (SCP). Apply the SCP to the production OU.

   Source: Adapted from community discussion — [Removed]

   Next question

3. Question 263 · 475 in bank

   A company has applications that process transaction requests multiple times each minute. The applications write transaction data to a single Amazon RDS DB instance. As the company begins to process more transactions, the company becomes concerned that it has no failover solution in place for disaster recovery (DR). The company needs the DB instance to fail over automatically without losing any committed transactions. Which solution will meet these requirements?

   • ACreate an RDS read replica in the same AWS Region. Configure an AWS Lambda function to promote the replica as the primary DB instance during a DR scenario.
   • BCreate an RDS read replica in a different AWS Region. Configure an AWS Lambda function to promote the replica as the primary DB instance during a DR scenario.
   • CModify the DB instance to be a Multi-AZ deployment.
   • DSetup an Amazon CloudWatch alarm that monitors the DB instance memory utilization with a threshold greater than 90%. Invoke an AWS Lambda function to restart the DB instance.

   Show answer

   Answer: C

   Explanation

   Keyword is "Without losing any committed transactions." AWS Lambda function will need time to process the DB promotion. Multi-AZ is design for HA.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 264 · 475 in bank

   ASysOps administrator configures an application to run on Amazon EC2 instances behind an Application Load Balancer (ALB) in a simple scaling Auto Scaling group with the default settings. The Auto Scaling group is configured to use the RequestCountPerTarget metric for scaling. The SysOps administrator notices that the RequestCountPerTarget metric exceeded the specified limit twice in 180 seconds. How will the number of EC2 instances in this Auto Scaling group be affected in this scenario?

   • AThe Auto Scaling group will launch an additional EC2 instance every time the RequestCountPerTarget metric exceeds the predefined limit.
   • BThe Auto Scaling group will launch one EC2 instance and will wait for the default cooldown period before launching another instance.
   • CThe Auto Scaling group will send an alert to the ALB to rebalance the traffic and not add new EC2 instances until the load is normalized.
   • DThe Auto Scaling group will try to distribute the traffic among all EC2 instances before launching another instance.

   Show answer

   Answer: B

   Explanation

   B When the RequestCountPerTarget metric exceeds the specified limit, the Auto Scaling group will launch an additional EC2 instance to handle the increased load. However, after launching an instance, the Auto Scaling group will wait for the default cooldown period before launching another instance. The cooldown period is a configurable setting that helps ensure that the Auto Scaling group doesn’t launch or terminate additional instances before the previous scaling activity takes effect.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation

   Next question

5. Question 265 · 475 in bank

   A company has a secure website running on Amazon EC2 instances behind an Application Load Balancer (ALB). An SSL certificate from AWS Certificate Manager (ACM) is used on the ALB. Users with legacy web browsers are experiencing issues with the website. How should the SysOps administrator resolve these issues in the MOST operationally efficient manner?

   • ACreate a new SSL certificate in ACM and install the new certificate on the ALB to support legacy web browsers.
   • BCreate a second ALB and install a custom SSL certificate with a different domain name on the second ALB to support legacy web browsers.
   • CRemove the ALB from the configuration and install a custom SSL certificate on each web server.
   • DUpdate the SSL negotiation configuration of the ALB with a security policy that contains ciphers for legacy web browsers.

   Show answer

   Answer: D

   Explanation

   Resolution: - Identify your load balancer's security policy - Determine that protocols and ciphers that are supported by your load balancer's security policy - Update your load balancer's security policy, if necessary https://repost.aws/knowledge-center/elb-fix-ssl-tls-negotiation-error

   Source: Adapted from community discussion — Gomer

   References

   • repost.aws documentation
   • AWS documentation

   Next question

6. Question 266 · 475 in bank

   A company hosts an internet web application on Amazon EC2 instances. The company is replacing the application with a new AWS Lambda function. During a transition period, the company must route some traffic to the legacy application and some traffic to the new Lambda function. The company needs to use the URL path of request to determine the routing. Which solution will meet these requirements?

   • AConfigure a Gateway Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.
   • BConfigure a Network Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.
   • CConfigure a Network Load Balancer to use a regular expression to match the URL path to direct traffic to the new Lambda function.
   • DConfigure an Application Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.

   Show answer

   Answer: D

   References

   • repost.aws documentation

   Next question

7. Question 267 · 475 in bank

   A SysOps administrator launches an Amazon EC2 Linux instance in a public subnet. When the instance is running, the SysOps administrator obtains the public IP address and attempts to remotely connect to the Instance multiple times. However, the SysOps administrator always receives a timeout error. Which action will allow the SysOps administrator to remotely connect to the instance?

   • AAdd a route table entry in the public subnet for the SysOps administrator's IP address.
   • BAdd an outbound network ACL rule to allow TCP port 22 for the SysOps administrator's IP address.
   • CModify the instance security group to allow inbound SSH traffic from the SysOps administrator's IP address.
   • DModify the instance security group to allow outbound SSH traffic to the SysOps administrator's IP address.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

8. Question 268 · 475 in bank

   A company uses AWS Organizations to manage multiple AWS accounts. Corporate policy mandates that only specific AWS Regions can be used to store and process customer data. A SysOps administrator must prevent the provisioning of Amazon EC2 instances in unauthorized Regions by anyone in the company. What is the MOST operationally efficient solution that meets these requirements?

   • AConfigure AWS CloudTrail in all Regions to record all API activity. Create an Amazon EventBridge (Amazon CloudWatch Events) rule in all unauthorized Regions for ec2:RunInstances events. Use AWS Lambda to terminate the launched EC2 instances.
   • BIn each AWS account, create a managed IAM policy that uses a Region condition to deny the ec2:RunInstances action in all unauthorized Regions. Attach this policy to all IAM groups in each AWS account.
   • CIn each AWS account, create an IAM permissions boundary policy that uses a Region condition to deny the ec2:RunInstances action in all unauthorized Regions. Attach the permissions boundary policy to all IAM users in each AWS account.
   • DCreate a service control policy (SCP) in AWS Organizations to deny the ec2:RunInstances action in all unauthorized Regions. Attach this policy to the root level of the organization.

   Show answer

   Answer: D

   Explanation

   Def D here. If this question has something like "Use Control Tower and setup the landing zone with provisioned regions" that would take be correct but there is no Control Tower option on this one.

   Source: Adapted from community discussion — haxaffee

   Next question

9. Question 269 · 475 in bank

   SIMULATION - Instructions. If your AWS Management Console browser does not show that you are logged in to an AWS account, close the browser and relaunch the console by using the AWS Management Console shortcut from the VM desktop. If the copy-paste functionality is not working in your environment, refer to the instructions file on the VM desktop and use Ctrl+C, Ctrl+V or Command-C, Command-V. Create a solution to automate Amazon EBS Volume snapshots using Amazon Data Lifecycle Manager. 1. Use the us-east-2 Region for all resources. 2. Unless specified below, use the default configuration settings. 3. Create a snapshot of the existing EBS Volume named OriginalVolume. 4. Create a 1 GB EBS Volume from the snapshot with default encryption. 5. Add the tag Snapshot: true to the new EBS Volume. 6. Ensure that snapshots of all volumes with the tag Snapshot:true are taken every 6 hours and retained for 90 days. Do NOT use a cron expression. Ensure this is the only lifecycle policy that exists. Use the IAM role named DLMRole. Important: Click the Next button to complete this lab and continue to the next lab. Once you click the Next button, you will NOT be able to return to this lab.

   

   

   

   

   

   

   

   

   

   

   

   

   

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   There is no lab until further notice. "As of March 28, 2023, the AWS Certified SysOps Administrator - Associate exam will not include exam labs until further notice. This removal of exam labs is temporary while we evaluate the exam labs and make improvements to provide an optimal candidate experience."

   Source: Adapted from community discussion — Debugs_Bunny

   

   Next question

10. Question 270 · 475 in bank

    A company runs a high performance computing (HPC) application on an Amazon EC2 instance. The company needs to scale this architecture to two or more EC2 instances. The EC2 instances will need to communicate with each other at high speeds with low latency to support the application. The company wants to ensure that the network performance can support the required communication between the EC2 instances What should a SysOps administrator do to meet these requirements?

    • ACreate a cluster placement group. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Restore the EC2 instance from the AMI into the placement group. Launch the additional EC2 instances into the placement group.
    • BBack up the existing EC2 instance to an Amazon Machine Image (AMI). Create a launch template from the existing EC2 instance by specifying the AMI. Create an Auto Scaling group and configure the desired instance count.
    • CCreate a Network Load Balancer (NLB) and a target group. Launch the new EC2 instances and register them with the target group. Register the existing EC2 instance with the target group. Pass all application traffic through the NLB.
    • DBack up the existing EC2 instance to an Amazon Machine Image (AMI). Create additional clones of the EC2 instance from the AMI in the same Availability Zone where the existing EC2 instance is located.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 261. 475 questions available.