SOA-C02 practice questions 281–290

1. Question 281 · 475 in bank

   Select 2

   A company wants to monitor the security groups of its Amazon EC2 instances to ensure that SSH is not open to the public. If the port is opened, the company needs to close the port as soon as possible. Which combination of actions should a SysOps administrator take to meet these requirements? (Choose two.)

   • AAdd an Amazon CloudWatch alarm to detect the security groups that allow SSH.
   • BAdd an AWS Config rule to detect the security groups that allow SSH.
   • CAdd an assessment template to Amazon Inspector to detect the security groups that allow SSH.
   • DCall an AWS Systems Manager Automation runbook to close the port.
   • ECall AWS Systems Manager Run Command to close the port.

   Show answer

   Answer: BD

   Explanation

   Add an AWS Config rule to detect the security groups that allow SSH. By creating a custom AWS Config rule, you can define the desired configuration that checks if SSH ports are open in security groups. This rule will evaluate the current state of the security groups and report any violations. Call an AWS Systems Manager Automation runbook to close the port. Set up an AWS Systems Manager Automation runbook that can be triggered when a violation is detected by the AWS Config rule. The runbook should include the necessary steps to close the SSH port in the affected security groups, ensuring that the port is no longer accessible to the public.

   Source: Adapted from community discussion — Pete987

   References

   • AWS documentation

   Next question

2. Question 282 · 475 in bank

   A company runs an application on Amazon EC2 instances that are in an Amazon EC2 Auto Scaling group. Scale-out actions take a long time to become complete because of long-running boot scripts. A SysOps administrator must implement a solution to reduce the required time for scale-out actions without overprovisioning the Auto Scaling group. Which solution will meet these requirements?

   • AChange the launch configuration to use a larger instance size.
   • BIncrease the minimum number of instances in the Auto Scaling group.
   • CAdd a predictive scaling policy to the Auto Scaling group.
   • DAdd a warm pool to the Auto Scaling group.

   Show answer

   Answer: D

   Explanation

   A warm pool gives you the ability to decrease latency for your applications that have exceptionally long boot times, for example, because instances need to write massive amounts of data to disk. With warm pools, you no longer have to over-provision your Auto Scaling groups to manage latency in order to improve application performance. Hence the correct answer is D. Source: https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-warm-pools.html

   Source: Adapted from community discussion — Zotarix

   References

   • AWS documentation

   Next question

3. Question 283 · 475 in bank

   A company asks a SysOps administrator to provision an additional environment for an application in four additional AWS Regions. The application is running on more than 100 Amazon C2 instances in the us-east-1 Region, using fully configured Amazon Machine Images (AMIs). The company has an AWS CloudFormation template to deploy resources in us-east-1. What should the SysOps administrator do to provision the application in the MOST operationally efficient manner?

   • ACopy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs.
   • BCreate a snapshot of the running instance. Copy the snapshot to the other Regions. Create an AMI from the snapshots. Update the CloudFormation template for each Region to use the new AMI.
   • CRun the existing CloudFormation template in each additional Region based on the success of the template that is used currently in us-east-1.
   • DUpdate the CloudF ormation template to include the additional Regions in the Auto Scaling group. Update the existing stack in us-east-1.

   Show answer

   Answer: A

   Explanation

   A. Copy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs. This option involves copying the AMI from the us-east-1 Region to the additional Regions using the aws ec2 copy-image command. Once the AMI is available in each of the target Regions, the CloudFormation template can be updated to include mappings for the copied AMIs in each Region. This allows you to use the fully configured AMI in each Region without needing to recreate it from scratch or take snapshots of running instances.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation

   Next question

4. Question 284 · 475 in bank

   A company runs its applications on a large number of Amazon EC2 instances. A SysOps administrator must implement a solution to notify the operations team whenever an EC2 instance state changes. What is the MOST operationally efficient solution that meets these requirements?

   • ACreate a script that captures instance state changes and publishes a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Use AWS Systems Manager Run Command to run the script on all EC2 instances.
   • BCreate an Amazon EventBridge event rule that captures EC2 instance state changes. Set an Amazon Simple Notification Service (Amazon SNS) topic as the target
   • CCreate an Amazon EventBridge event rule that captures EC2 instance state changes. Set as the target an AWS Lambda function that publishes a notification to an Amazon Simple Notification Service (Amazon SNS) topic.
   • DCreate an AWS Config custom rule that evaluates instance state changes with automatic remediation. Use the rule to invoke an AWS Lambda function that publishes a notification to an Amazon Simple Notification Service (Amazon SNS) topic.

   Show answer

   Answer: B

   Explanation

   B. Create an Amazon EventBridge event rule that captures EC2 instance state changes. Set an Amazon Simple Notification Service (Amazon SNS) topic as the target

   Source: Adapted from community discussion — [Removed]

   References

   • repost.aws documentation

   Next question

5. Question 285 · 475 in bank

   Select 2

   A company has migrated its legacy on-premises web application to an Amazon EC2 instance. The web application requires a single static public IP address to accept traffic and process requests. End users must be able to reach the web application through the example.com domain. A SysOps administrator must implement a solution that maintains the web application with the least amount of effort. Which combination of actions will meet these requirements? (Choose two.)

   • AConfigure an Application Load Balancer (ALB). Add the EC2 instance to a target group that is associated with the ALB.
   • BCreate an Amazon Route 53 A record for the associated EC2 IP address.
   • CCreate an Amazon Route 53 CNAME record for the associated EC2 IP address.
   • DCreate an Elastic IP address, and associate it with the EC2 instance.
   • ECreate an Auto Scaling group with a minimum capacity of 1 and a maximum capacity of 2.

   Show answer

   Answer: BD

   Explanation

   D. Create an Elastic IP address, and associate it with the EC2 instance. This will give your EC2 instance a static public IP address that does not change, even if you stop and start the instance or if there are underlying infrastructure changes. This is important to maintain the single static public IP address required by the web application. B. Create an Amazon Route 53 A record for the associated EC2 IP address. After obtaining the Elastic IP address from step 1, you can create a simple A record in Amazon Route 53 that points the example.com domain to the Elastic IP address. This will allow end users to reach the web application through the example.com domain.

   Source: Adapted from community discussion — trvtrinh

   Next question

6. Question 286 · 475 in bank

   A company is using an Amazon DynamoDB table for data. A SysOps administrator must configure replication of the table to another AWS Region for disaster recovery. What should the SysOps administrator do to meet this requirement?

   • AEnable DynamoDB Accelerator (DAX).
   • BEnable DynamoDB Streams, and add a global secondary index (GSI).
   • CEnable DynamoDB Streams, and add a global table Region.
   • DEnable point-in-time recovery.

   Show answer

   Answer: C

   Explanation

   C: Enable DynamoDB Streams, and add a global table Region When you enable DynamoDB Streams on a table and configure a global table, changes made to the table are recorded in the stream. By adding a global table Region, you create a replica of the table in another AWS Region. Any changes made to the original table are replicated asynchronously to the replica table in the other Region. This setup provides disaster recovery by ensuring that if the primary Region becomes unavailable, you can failover to the replica in the other Region. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GlobalTables.html

   Source: Adapted from community discussion — joshnort

   References

   • AWS documentation

   Next question

7. Question 287 · 475 in bank

   A company has an existing public web application for www.example.com. The Application Load Balancer (ALB) is configured with a single HTTP 80 listener. A SysOps administrator must ensure that all web requests to www.example.com are encrypted between the client and the ALB. The SysOps administrator already has requested and validated a public certificate for www.example.com in AWS Certificate Manager (ACM). Existing users of the application must not be required to change the endpoint to which they are connecting. Which additional set of steps should the SysOps administrator take to meet these requirements?

   • ACreate an additional ALB listener for HTTPS on port 443. Set the default action to forward all traffic to the target group. Specify the ACM certificate that was created for www.example.com as the default SSL certificate.
   • BCreate an additional ALB listener for HTTPS on port 443. Set the default action to forward all traffic to the target group. Specify the ACM certificate that was created for www.example.com as the default SSL certificate. Delete the original HTTP listener on port 80.
   • CModify the ALB default rule for the HTTP port 80 listener. Create a rule in the listener to forward all traffic for the host www example.com to the target group. Specify the ACM certificate that was created for www.example.com as the default SSL certificate.
   • DModify the ALB default rule for the HTTP port 80 listener to redirect to HTTPS on port 443. Create an additional HTTPS listener on port 443. Set the default action to forward all traffic to the target group. Specify the ACM certificate that was created for www example.com as the default SSL certificate.

   Show answer

   Answer: D

   Explanation

   D. Modify the ALB default rule for the HTTP port 80 listener to redirect to HTTPS on port 443. Create an additional HTTPS listener on port 443. Set the default action to forward all traffic to the target group. Specify the ACM certificate that was created for www example.com as the default SSL certificate.

   Source: Adapted from community discussion — [Removed]

   Next question

8. Question 288 · 475 in bank

   A company runs its entire suite of applications on Amazon EC2 instances. The company plans to move the applications to containers and AWS Fargate. Within 6 months, the company plans to retire its EC2 instances and use only Fargate. The company has been able to estimate its future Fargate costs. A SysOps administrator needs to choose a purchasing option to help the company minimize costs. The SysOps administrator must maximize any discounts that are available and must ensure that there are no unused reservations. Which purchasing option will meet these requirements?

   • ACompute Savings Plans for 1 year with the No Upfront payment option
   • BCompute Savings Plans for 1 year with the Partial Upfront payment option
   • CEC2 Instance Savings Plans for 1 year with the All Upfront payment option
   • DEC2 Reserved Instances for 1 year with the Partial Upfront payment option

   Show answer

   Answer: B

   Explanation

   1. Maximize discounts: Option B with partial prepayment may offer higher discounts than Option A with no prepayment. 2. Avoid unused reservations: Savings Plans are highly flexible and minimize the risk of unused reservations when migrating from EC2 to Fargate. 3. Migrate to Fargate in 6 months: Option B with a partial prepayment commitment is suitable when a company plans to fully migrate to Fargate within 6 months, and given this, is more concerned with mid- to long-term cost savings than short-term gains. Considering these factors, Option B: Calculating Savings Plans for one year using the Partial Prepayment option would be the most appropriate for the requirements.

   Source: Adapted from community discussion — junrun3

   References

   • AWS documentation

   Next question

9. Question 289 · 475 in bank

   A SysOps administrator developed a Python script that uses the AWS SDK to conduct several maintenance tasks. The script needs to run automatically every night. What is the MOST operationally efficient solution that meets this requirement?

   • AConvert the Python script to an AWS Lambda function. Use an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the function every night.
   • BConvert the Python script to an AWS Lambda function. Use AWS CloudTrail to invoke the function every night.
   • CDeploy the Python script to an Amazon EC2 instance. Use Amazon EventBride (Amazon CloudWatch Events) to schedule the instance to start and stop every night.
   • DDeploy the Python script to an Amazon EC2 instance. Use AWS Systems Manager to schedule the instance to start and stop every night.

   Show answer

   Answer: A

   Explanation

   Converting the Python script to an AWS Lambda function and using an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the function every night is a serverless and fully managed solution, which means that the administrator does not have to worry about managing the underlying infrastructure or scaling. AWS Lambda allows for easy deployment, scaling, and management of code in response to events. EventBridge (CloudWatch Events) provides a reliable way to schedule events and to invoke AWS services on a schedule.

   Source: Adapted from community discussion — airraid2010

   References

   • AWS documentation

   Next question

10. Question 290 · 475 in bank

    A manufacturing company uses an Amazon RDS DB instance to store inventory of all stock items. The company maintains several AWS Lambda functions that interact with the database to add, update, and delete items. The Lambda functions use hardcoded credentials to connect to the database. A SysOps administrator must ensure that the database credentials are never stored in plaintext and that the password is rotated every 30 days. Which solution will meet these requirements in the MOST operationally efficient manner?

    • AStore the database password as an environment variable for each Lambda function. Create a new Lambda function that is named PasswordRotate. Use Amazon EventBridge to schedule the PasswordRotate function every 30 days to change the database password and update the environment variable for each Lambda function.
    • BUse AWS Key Management Service (AWS KMS) to encrypt the database password and to store the encrypted password as an environment variable for each Lambda function. Grant each Lambda function access to the KMS key so that the database password can be decrypted when required. Create a new Lambda function that is named PasswordRotate to change the password every 30 days.
    • CUse AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from Secrets Manager.
    • DUse AWS Systems Manager Parameter Store to create a secure string to store credentials for the database. Create a new Lambda function called PasswordRotate. Use Amazon EventBridge to schedule the PasswordRotate function every 30 days to change the database password and to update the secret within Parameter Store. Update each Lambda function to access the database password from Parameter Store.

    Show answer

    Answer: C

    Explanation

    C. Use AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from Secrets Manager.

    Source: Adapted from community discussion — [Removed]

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 281. 475 questions available.