SOA-C02 practice questions 271–280

1. Question 271 · 475 in bank

   A developer creates an AWS Lambda function that runs when an object is put into an Amazon S3 bucket. The function reformats the object and places the object back into the S3 bucket. During testing, the developer notices a recursive invocation loop. The developer asks a SysOps administrator to immediately stop the recursive invocations. What should the SysOps administrator do to stop the loop without errors?

   • ADelete all the objects from the S3 bucket.
   • BSet the function’s reserved concurrency to 0.
   • CUpdate the S3 bucket policy to deny access for the function.
   • DPublish a new version of the function.

   Show answer

   Answer: B

   Explanation

   https://aws.amazon.com/blogs/compute/avoiding-recursive-invocation-with-amazon-s3-and-aws-lambda/ Monitoring applications for recursive invocation Whenever you have a Lambda function writing objects back to the same S3 bucket that triggered the event, it’s best practice to limit the scaling in the development and testing phases. Use reserved concurrency to limit a function’s scaling, for example. Setting the function’s reserved concurrency to a lower limit prevents the function from scaling concurrently beyond that limit. It does not prevent the recursion, but limits the resources consumed as a safety mechanism.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 272 · 475 in bank

   A company has an application that runs behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon Route 53 record set contains an alias record for app.anycompany.com that references the ALB in us-west-2 and uses a simple routing policy. The application is experiencing an increase in users from other locations in the world. These users are experiencing high latency. Most of the new users are close to the ap-southeast-2 Region. The company deploys a copy of the application to ap-southeast-2. A SysOps administrator must implement a solution that automatically routes requests to the lowest latency endpoint for users without changing the URL. Which solution will meet these requirements?

   • AAdd a new value to the existing alias record for app.anycompany.com with the DNS name of the new ALB in ap-southeast-2.
   • BChange the existing alias record to use a geolocation routing policy. Create two geolocation records, one record that references each ALSelect the location that is closest to each Region.
   • CChange the existing alias record to use a latency routing policy. Create two latency records, one record that references each ALB.
   • DChange the existing alias record to use a multivalue routing policy Add the DNS name of each ALB to the record.

   Show answer

   Answer: C

   Explanation

   C To automatically route requests to the lowest latency endpoint for users without changing the URL, the SysOps administrator should change the existing alias record to use a latency routing policy and create two latency records, one record that references each ALB. With a latency routing policy, Amazon Route 53 routes traffic to the endpoint with the lowest latency for the user. This will ensure that users are automatically routed to the endpoint with the lowest latency, improving their experience.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 273 · 475 in bank

   A company stores files on 50 Amazon S3 buckets in the same AWS Region. The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost. Which solution will meet these requirements?

   • ACreate a gateway VPC endpoint for each S3 bucket. Attach the gateway VPC endpoints to each subnet inside the VPC.
   • BCreate an interface VPC endpoint for each S3 bucket. Attach the interface VPC endpoints to each subnet inside the VPC.
   • CCreate one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table.
   • DCreate one interface VPC endpoint for all the S3 buckets. Add the interface VPC endpoint to the VPC route table.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

4. Question 274 · 475 in bank

   A company's security policy states that connecting to Amazon EC2 instances is not permitted through SSH and ROP. If access is required, authorized staff can connect to instances by using AWS Systems Manager Session Manager. Users report that they are unable to connect to one specific Amazon EC2 instance that is running Ubuntu and has AWS Systems Manager Agent (SSM Agent) pre-installed. These users are able to use Session Manager to connect to other instances in the same subnet, and they are in an IAM group that has Session Manager permission for all instances. What should a SysOps administrator do to resolve this issue?

   • AAdd an inbound rule for port 22 in the security group associated with the Ubuntu instance.
   • BAssign the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile for the Ubuntu instance.
   • CConfigure the SSM Agent to log in with a user name of “ubuntu”.
   • DGenerate a new key pair, configure Session Manager to use this new key pair, and provide the private key to the users.

   Show answer

   Answer: B

   Explanation

   By assigning the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile associated with the Ubuntu instance, you grant the necessary permissions for the instance to communicate with AWS Systems Manager. This policy includes the required permissions for Session Manager to establish connections to EC2 instances.

   Source: Adapted from community discussion — Pete987

   Next question

5. Question 275 · 475 in bank

   A SysOps administrator is configuring Amazon CloudWatch alarms. A particular is constantly in the ALARM state. What could be the reason for this issue?

   • AAlarms continue to evaluate metrics against configured thresholds, even after they are triggered.
   • BAfter alarms are triggered, they remain in the ALARM state until they are manually disabled.
   • CAfter an alarm is triggered and an action is performed, the application logic must reset the alarm to its normal state.
   • DThe alarm is not receiving appropriate metrics.

   Show answer

   Answer: A

   Explanation

   For any period of one minute or longer, an alarm is evaluated every minute and the evaluation is based on the window of time defined by the Period and Evaluation Periods. For example, if the Period is 5 minutes (300 seconds) and Evaluation Periods is 1, then at the end of minute 5 the alarm evaluates based on data from minutes 1 to 5. Then at the end of minute 6, the alarm is evaluated based on the data from minutes 2 to 6.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation

   Next question

6. Question 276 · 475 in bank

   A company has set up an IPsec tunnel between its AWS environment and its on-premises data center. The tunnel is reporting as UP, but the Amazon EC2 instances are not able to ping any on-premises resources. What should a SysOps administrator do to resolve this issue?

   • ACreate a new inbound rule on the EC2 instances’ security groups to allow ICMP traffic from the on-premises CIDR.
   • BCreate a peering connection between the IPsec tunnel and the subnet of the EC2 instances.
   • CEnable route propagation for the virtual private gateway in the route table that is assigned to the subnet of the EC2 instances.
   • DModify the VPC’s DHCP options set. Add the IPsec tunnel to the VPN section.

   Show answer

   Answer: C

   Explanation

   C: Enabling route propagation for the virtual private gateway in the route table associated with the subnet of the EC2 instances will allow the VPC route table to learn and propagate the routes for the on-premises network. This ensures that the EC2 instances know how to reach the on-premises resources through the IPsec tunnel.

   Source: Adapted from community discussion — Pete987

   References

   • AWS documentation

   Next question

7. Question 277 · 475 in bank

   A company hosts a production MySQL database on an Amazon Aurora single-node DB cluster. The database is queried heavily for reporting purposes. The DB cluster is experiencing periods of performance degradation because of high CPU utilization and maximum connections errors. A SysOps administrator needs to improve the stability of the database. Which solution will meet these requirements?

   • ACreate an Aurora Replica node. Create an Auto Scaling policy to scale replicas based on CPU utilization. Ensure that all reporting requests use the read-only connection string
   • BCreate a second Aurora MySQL single-node DB cluster in a second Availability Zone. Ensure that all reporting requests use the connection string for this additional node
   • CCreate an AWS Lambda function that caches reporting requests. Ensure that all reporting requests call the Lambda function
   • DCreate a multi-node Amazon ElastiCache cluster. Ensure that all reporting requests use the ElastiCache cluster. Use the database if the data is not in the cache.

   Show answer

   Answer: A

   Explanation

   Creating an Aurora Replica node will offload the reporting workload from the primary DB instance, reducing the CPU utilization and improving stability. By creating an Auto Scaling policy to scale replicas based on CPU utilization, you can automatically add or remove replicas as needed to handle the reporting workload. Ensuring that all reporting requests use the read-only connection string directs the reporting workload to the replica nodes, further reducing the load on the primary DB instance.

   Source: Adapted from community discussion — jlmadvig

   Next question

8. Question 278 · 475 in bank

   A company's public website is hosted in an Amazon S3 bucket in the us-east-1 Region behind an Amazon CloudFront distribution. The company wants to ensure that the website is protected from DDoS attacks. A SysOps administrator needs to deploy a solution that gives the company the ability to maintain control over the rate limit at which DDoS protections are applied. Which solution will meet these requirements?

   • ADeploy a global-scoped AWS WAF web ACL with an allow default action. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the CloudFront distribution.
   • BDeploy an AWS WAF web ACL with an allow default action in us-east-1. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the S3 bucket.
   • CDeploy a global-scoped AWS WAF web ACL with a block default action. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the CloudFront distribution.
   • DDeploy an AWS WAF web ACL with a block default action in us-east-1. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the S3 bucket.

   Show answer

   Answer: A

   Explanation

   Your configuration of your own rules and rule groups depends in part on whether you want to allow or block most web requests. For example, if you want to allow most requests, you would set the web ACL default action to Allow, and then add rules that identify web requests that you want to block, such as the following: Requests that originate from IP addresses that are making an unreasonable number of requests Requests that originate from countries that either you don't do business in or are the frequent source of attacks Requests that include fake values in the User-agent header Requests that appear to include malicious SQL code https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-default-action.html

   Source: Adapted from community discussion — ignajtpolandstrong

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 279 · 475 in bank

   A company runs a web application that users access using the name www example com. The company manages the domain name example.com using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application through CloudFront. What is the MOST cost-effective way to achieve this?

   • ACreate a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL.
   • BCreate an ALIAS record in Amazon Route 53 that points to the CioudFront distribution URL.
   • CCreate an A record in Amazon Route 53 that points to the public IP address of the web application,
   • DCreate a PTR record in Amazon Route 53 that points to the public IP address of the web application.

   Show answer

   Answer: B

   Explanation

   Option B is the correct answer because ALIAS records in Amazon Route 53 are used to map domain names directly to AWS resources like CloudFront distributions, S3 buckets, Elastic Load Balancers, and more. ALIAS records provide a more efficient and cost-effective way to route traffic to these AWS resources compared to CNAME records.

   Source: Adapted from community discussion — trvtrinh

   Next question

10. Question 280 · 475 in bank

    A company is managing multiple AWS accounts in AWS Organizations. The company is reviewing internal security of its AWS environment. The company’s security administrator has their own AWS account and wants to review the VPC configuration of developer AWS accounts. Which solution will meet these requirements in the MOST secure manner?

    • ACreate an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to an IAM user. Share the user credentials with the security administrator.
    • BCreate an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions. Assign the policy to an IAM user. Share the user credentials with the security administrator.
    • CCreate an IAM policy in each developer account that has administrator access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.
    • DCreate an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.

    Show answer

    Answer: D

    Explanation

    The most secure way for the security administrator to review the VPC configuration of developer AWS accounts would be to create an IAM policy in each developer account that has read-only access related to VPC resources and assign the policy to a cross-account IAM role. The security administrator can then assume the role from their own account to review the VPC configuration. This approach avoids sharing user credentials and provides the security administrator with the necessary permissions to review the VPC configuration without granting unnecessary access. So, the correct answer would be D. Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.

    Source: Adapted from community discussion — [Removed]

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 271. 475 questions available.