SOA-C02 practice questions 21–30

1. Question 21 · 475 in bank

   Select 2

   A company wants to be alerted through email when IAM CreateUser API calls are made within its AWS account. Which combination of actions should a SysOps administrator take to meet this requirement? (Choose two.)

   • ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the event source and IAM CreateUser as the specific API call for the event pattern.
   • BCreate an Amazon EventBridge (Amazon CloudWatch Events) rule with Amazon CloudSearch as the event source and IAM CreateUser as the specific API call for the event pattern.
   • CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS IAM Access Analyzer as the event source and IAM CreateUser as the specific API call for the event pattern.
   • DUse an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email subscription.
   • EUse an Amazon Simple Email Service (Amazon SES) notification as an event target with an email subscription.

   Show answer

   Answer: AD

   Explanation

   my mistype (please remove first comment : why not E : Amazon SES (Simple Email Service) can send emails, but it is not typically used as a direct event target for CloudWatch Events

   Source: Adapted from community discussion — jipark

   Next question

2. Question 22 · 475 in bank

   A database is running on an Amazon RDS Multi-AZ DB instance. A recent security audit found the database to be out of compliance because it was not encrypted. Which approach will resolve the encryption requirement?

   • ALog in to the RDS console and select the encryption box to encrypt the database.
   • BCreate a new encrypted Amazon EBS volume and attach it to the instance.
   • CEncrypt the standby replica in the secondary Availability Zone and promote it to the primary instance.
   • DTake a snapshot of the RDS instance, copy and encrypt the snapshot, and then restore to the new RDS instance.

   Show answer

   Answer: D

   Explanation

   D. You can only encrypt an Amazon RDS DB instance when you create it, not after the DB instance is created. However, because you can encrypt a copy of an unencrypted snapshot, you can effectively add encryption to an unencrypted DB instance. That is, you can create a snapshot of your DB instance, and then create an encrypted copy of that snapshot. You can then restore a DB instance from the encrypted snapshot, and thus you have an encrypted copy of your original DB instance. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html

   Source: Adapted from community discussion — Xelnak

   References

   • AWS documentation

   Next question

3. Question 23 · 475 in bank

   A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted. What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?

   • ASet up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
   • BUse service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.
   • CCreate an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
   • DUse AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.

   Show answer

   Answer: B

   Next question

4. Question 24 · 475 in bank

   A SysOps administrator has successfully deployed a VPC with an AWS CloudFormation template. The SysOps administrator wants to deploy the same template across multiple accounts that are managed through AWS Organizations. Which solution will meet this requirement with the LEAST operational overhead?

   • AAssume the OrganizationAccountAccessRole IAM role from the management account. Deploy the template in each of the accounts.
   • BCreate an AWS Lambda function to assume a role in each account. Deploy the template by using the AWS CloudFormation CreateStack API call.
   • CCreate an AWS Lambda function to query for a list of accounts. Deploy the template by using the AWS CloudFormation CreateStack API call.
   • DUse AWS CloudFormation StackSets from the management account to deploy the template in each of the accounts.

   Show answer

   Answer: D

   Explanation

   AWS CloudFormation StackSets extends the capability of stacks by enabling you to create, update, or delete stacks across multiple accounts and AWS Regions

   Source: Adapted from community discussion — Hello23

   References

   • AWS documentation

   Next question

5. Question 25 · 475 in bank

   A company has an application that is running on Amazon EC2 instances in a VPC. The application needs access to download software updates from the internet. The VPC has public subnets and private subnets. The company’s security policy requires all EC2 instances to be deployed in private subnets. What should a SysOps administrator do to meet these requirements?

   • AAdd an internet gateway to the VPC. In the route table for the private subnets, add a route to the internet gateway.
   • BAdd aNAT gateway to a private subnet. In the route table for the private subnets, add a route to the NAT gateway.
   • CAdd a NAT gateway to public subnet. In the route table for the private subnets, add a route to the NAT gateway.
   • DAdd two internet gateways to the VPC. In the route tables for the private subnets and public subnets, add a route to each internet gateway.

   Show answer

   Answer: C

   Explanation

   The correct answer is C. Add a NAT gateway to a public subnet. In the route table for the private subnets, add a route to the NAT gateway. The application needs to be able to download updates from the internet, but it's running on EC2 instances in a private subnet. Private subnets do not have direct access to the internet. A NAT gateway allows instances in a private subnet to connect to the internet or other AWS services but prevent the internet from initiating a connection with those instances.

   Source: Adapted from community discussion — sxti

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 26 · 475 in bank

   A development team recently deployed a new version of a web application to production. After the release, penetration testing revealed a cross-site scripting vulnerability that could expose user data. Which AWS service will mitigate this issue?

   • AAWS Shield Standard
   • BAWS WAF
   • CElastic Load Balancing
   • DAmazon Cognito

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

7. Question 27 · 475 in bank

   Select 2

   A SysOps administrator must configure a resilient tier of Amazon EC2 instances for a high performance computing (HPC) application. The HPC application requires minimum latency between nodes. Which actions should the SysOps administrator take to meet these requirements? (Choose two.)

   • ACreate an Amazon Elastic File System (Amazon EFS) file system. Mount the file system to the EC2 instances by using user data.
   • BCreate a Multi-AZ Network Load Balancer in front of the EC2 instances.
   • CPlace the EC2 instances in an Auto Scaling group within a single subnet.
   • DLaunch the EC2 instances into a cluster placement group.
   • ELaunch the EC2 instances into a partition placement group.

   Show answer

   Answer: CD

   Explanation

   CD D. Amazon ALWAYS touts the "cluster placment group" as being the solution HPC workloads (low latency between nodes). However this actually precludes resilience through ELB and multi-AZ spread of instances or multiple partitions (insufficient throughput). C. The only option I see to get both resilience and HPC is to rely on auto-scaling group to re-scale for any failing nodes. Provides some protection unless the whole rack fails. No, it's not multi-AZ or multi rack, but its better than nothing given Amazons HPC recommendations.

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation

   Next question

8. Question 28 · 475 in bank

   A company’s customers are reporting increased latency while accessing static web content from Amazon S3. A SysOps administrator observed a very high rate of read operations on a particular S3 bucket. What will minimize latency by reducing load on the S3 bucket?

   • AMigrate the S3 bucket to a region that is closer to end users’ geographic locations.
   • BUse cross-region replication to replicate all of the data to another region.
   • CCreate an Amazon CloudFront distribution with the S3 bucket as the origin.
   • DUse Amazon ElastiCache to cache data being served from Amazon S3.

   Show answer

   Answer: C

   Explanation

   Clearly C Rationale: A. Might help if everyone is always coming from "regions" that adjacent (requires effort/analysis) B. Woiuld increases load during replicaton, but might help later (same caveats as previous question) C. Simplest/best because CF starts caching to every edge globally based only on actual user requests, bucket remains unchanged, and no analysis required. D. ElastiCache is for DBs, not S3

   Source: Adapted from community discussion — Gomer

   Next question

9. Question 29 · 475 in bank

   A SysOps administrator needs to develop a solution that provides email notification and inserts a record into a database every time a file is put into an Amazon S3 bucket. What is the MOST operationally efficient solution that meets these requirements?

   • ASet up an S3 event notification that targets an Amazon Simple Notification Service (Amazon SNS) topic. Create two subscriptions for the SNS topic. Use one subscription to send the email notification. Use the other subscription to invoke an AWS Lambda function that inserts the record into the database.
   • BSet up an Amazon CloudWatch alarm that enters ALARM state whenever an object is created in the S3 bucket. Configure the alarm to invoke an AWS Lambda function that sends the email notification and inserts the record into the database.
   • CCreate an AWS Lambda function to send the email notification and insert the record into the database whenever a new object is detected in the S3 bucket. Invoke the function every minute with an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule.
   • DSet up two S3 event notifications. Target a separate AWS Lambda function with each notification. Configure one function to send the email notification. Configure the other function to insert the record into the database.

   Show answer

   Answer: A

   Explanation

   You can't set up two S3 event notifications with the same Event types. But it's possible configure Lambda function, without SNS, in S3 event notifications

   Source: Adapted from community discussion — edu_anadat

   References

   • AWS documentation

   Next question

10. Question 30 · 475 in bank

    A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The instances are in an Amazon EC2 Auto Scaling group. The application is accessed with a public URL. A SysOps administrator needs to implement a monitoring solution that checks the availability of the application and follows the same routes and actions as a customer. The SysOps administrator must receive a notification if less than 95% of the monitoring runs find no errors. Which solution will meet these requirements?

    • ACreate an Amazon CloudWatch Synthetics canary with a script that follows customer routes. Schedule the canary to run on a recurring schedule. Create a CloudWatch alarm that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic when the SuccessPercent metric is less than 95%.
    • BCreate Amazon Route 53 health checks that monitor the availability of the endpoint. Create Amazon CloudWatch alarms that publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when the HealthCheckPercentageHealthy metric is less than 95%.
    • CCreate a single AWS Lambda function to check whether the endpoints are available for each customer path. Schedule the Lambda function by using Amazon EventBridge (Amazon CloudWatch Events). Configure the Lambda function to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when an endpoint returns an error.
    • DCreate an AWS Lambda function for each customer path to check whether that specific endpoint is available. Schedule the Lambda functions by using Amazon EventBridge (Amazon CloudWatch Events). Configure each Lambda function to publish a custom metric to Amazon CloudWatch for the endpoint status. Create CloudWatch alarms based on each custom metric to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when an alarm is in the ALARM state.

    Show answer

    Answer: A

    Explanation

    A for sure You can use Amazon CloudWatch Synthetics to create canaries, configurable scripts that run on a schedule, to monitor your endpoints and APIs. Canaries follow the same routes and perform the same actions as a customer, which makes it possible for you to continually verify your customer experience even when you don't have any customer traffic on your applications. By using canaries, you can discover issues before your customers do. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries.html

    Source: Adapted from community discussion — Xelnak

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 21. 475 questions available.