SOA-C02 practice questions 291–300

1. Question 291 · 475 in bank

   A developer creates a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The developer reviews the deployment and notices some suspicious traffic to the application. The traffic is malicious and is coming from a single public IP address. A SysOps administrator must block the public IP address. Which solution will meet this requirement?

   • ACreate a security group rule to deny all inbound traffic from the suspicious IP address. Associate the security group with the ALB.
   • BImplement Amazon Detective to monitor traffic and to block malicious activity from the internet. Configure Detective to integrate with the ALB.
   • CImplement AWS Resource Access Manager (AWS RAM) to manage traffic rules and to block malicious activity from the internet. Associate AWS RAM with the ALB.
   • DAdd the malicious IP address to an IP set in AWS WAF. Create a web ACL. Include an IP set rule with the action set to BLOCK. Associate the web ACL with the ALB.

   Show answer

   Answer: D

   Explanation

   D. Add the malicious IP address to an IP set in AWS WAF. Create a web ACL. Include an IP set rule with the action set to BLOCK. Associate the web ACL with the ALB.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 292 · 475 in bank

   A SysOps administrator is creating resources from an AWS. CloudFbrmation template that defines an Auto Scaling group of Amazon EC2 instances. The Auto Scaling group launch template provisions each EC2 instance by using a user data script. The creation of the Auto Scaling group resource is failing because of an error. The wait condition is not receiving the required number of signals. How should the SysOps administrator resolve this error?

   • ARun cfn-signal at the completion of the user data script.
   • BModify the EC2 instances’ security group to allow outgoing traffic on port 443.
   • CReduce the Auto Scaling group's DesiredCapacity value in the CloudFormation template.
   • DSet the AssociatePublicIpAddress property to True in the Auto Scaling group launch template.

   Show answer

   Answer: A

   Explanation

   https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-waitcondition.html For Amazon EC2 and Auto Scaling resources, we recommend that you use a CreationPolicy attribute instead of wait conditions. Add a CreationPolicy attribute to those resources, and use the cfn-signal helper script to signal when an instance creation process has completed successfully.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 293 · 475 in bank

   A company is trying to connect two applications. One application runs in an on-premises data center that has a hostname of host1.onprem private. The other application runs on an Amazon EC2 instance that has a hostname of host1.awscloud private. An AWS Site-to-Site VPN connection is in place between the on-premises network and AWS. The application that runs in the data center tries to connect to the application that runs on the EC2 instance, but DNS resolution fails. A SysOps administrator must implement DNS resolution between on-premises and AWS resources. Which solution allows the on-premises application to resolve the EC2 instance hostname?

   • ASet up an Amazon Route 53 inbound resolver endpoint with a forwarding rule for the onprem.private hosted zone. Associate the resolver with the VPC of the EC2 instance. Configure the on-premises DNS resolver to forward onprem.private DNS queries to the inbound resolver endpoint.
   • BSet up an Amazon Route 53 inbound resolver endpoint. Associate the resolver with the VPC of the EC2 instance. Configure the on-premises DNS resolver to forward awscloud.private DNS queries to the inbound resolver endpoint.
   • CSet up an Amazon Route 53 outbound resolver endpoint with a forwarding rule for the onprem.private hosted zone. Associate the resolver with the AWS Region of the EC2 instance. Configure the on-premises DNS resolver to forward onprem.private DNS queries to the outbound resolver endpoint.
   • DSet up an Amazon Route 53 outbound resolver endpoint. Associate the resolver with the AWS Region of the EC2 instance. Configure the on-premises DNS resolver to forward awscloud.private DNS queries to the outbound resolver endpoint.

   Show answer

   Answer: B

   Explanation

   Set up an Amazon Route 53 inbound resolver endpoint: This allows DNS resolution for private DNS namespaces in the VPC that you associate with the resolver. Associate the resolver with the VPC of the EC2 instance: By associating the resolver with the VPC of the EC2 instance that runs the application with the hostname "host1.awscloud.private", DNS queries from that VPC will be resolved by the inbound resolver. Configure the on-premises DNS resolver to forward awscloud.private DNS queries: This step is done on the on-premises DNS resolver. You need to configure it to forward DNS queries for the "awscloud.private" domain to the inbound resolver endpoint. With this configuration, when the application in the on-premises data center tries to resolve the hostname of the EC2 instance in AWS (host1.awscloud.private), the DNS query will be forwarded to the Amazon Route 53 inbound resolver, and it will be able to resolve the private hostname.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation

   Next question

4. Question 294 · 475 in bank

   A company needs to deploy instances of an application and associated infrastructure to multiple AWS Regions. The company wants to use a single AWS CloudFormation template to achieve this goal. The company uses AWS Organizations and wants to administer and run this template from a central administration account. What should a SysOps administrator do to meet these requirements?

   • ACreate a CloudFormation template that is stored in Amazon S3. Configure Cross-Region Replication (CRR) on the S3 bucket. Reference the required accounts and remote Regions in the input template parameters.
   • BIn the central administration account, create a CloudFormation primary template that loads CloudFormation nested stacks from Amazon S3 buckets in the target Regions.
   • CCreate CloudFormation nested stacks by using a primary template in the central administration account. Configure the required accounts and Regions for deployment of the nested stacks.
   • DCreate a CloudFormation stack set that includes service-managed permissions. Deploy the stack set into the required accounts and Regions from the central administration account.

   Show answer

   Answer: D

   Explanation

   D is correct Using CloudFormation stack sets with service-managed permissions is the recommended approach when you need to deploy CloudFormation stacks to multiple AWS accounts and/or regions from a central administration account. Stack sets simplify the process of deploying and managing infrastructure across multiple accounts and regions, ensuring consistency and ease of administration

   Source: Adapted from community discussion — trvtrinh

   References

   • AWS documentation

   Next question

5. Question 295 · 475 in bank

   A company's SysOps administrator manages a fleet of hundreds of Amazon EC2 instances that run Windows-based workloads and Linux-based workloads. Each EC2 instance has a tag that identifies its operating system. All the EC2 instances run AWS Systems Manager Session Manager. A zero-day vulnerability is reported, and no patches are available. The company's security team provides code for all the relevant operating systems to reduce the risk of the vulnerability. The SysOps administrator needs to implement the code on the EC2 instances and must provide a report that shows that the code has successfully run on all the instances. What should the SysOps administrator do to meet these requirements as quickly as possible?

   • AUse Systems Manager Run Command. Choose either the AWS-RunShellScript document or the AWS-RunPowerShellScript document. Configure Run Command with the code from the security team. Specify the operating system tag in the Targets parameter. Run the command. Provide the command history's evidence to the security team.
   • BCreate an AWS Lambda function that connects to the EC2 instances through Session Manager. Configure the Lambda function to identify the operating system, run the code from the security team, and return the results to an Amazon RDS DB instance. Query the DB instance for the results. Provide the results as evidence to the security team.
   • CLog on to each EC2 instance. Run the code from the security team on each EC2 instance. Copy and paste the results of each run into a single spreadsheet. Provide the spreadsheet as evidence to the security team.
   • DUpdate the launch templates of the EC2 instances to include the code from the security team in the user data. Relaunch the EC2 instances by using the updated launch templates. Retrieve the EC2 instance logs of each instance. Provide the EC2 instance logs as evidence to the security team.

   Show answer

   Answer: A

   Explanation

   Explanation: The AWS Systems Manager Run Command allows the SysOps administrator to execute commands on multiple EC2 instances simultaneously, which is crucial for managing a large fleet of instances efficiently. By using the AWS-RunShellScript or AWS-RunPowerShellScript documents, the SysOps administrator can run the code provided by the security team on both Windows-based and Linux-based instances, as required. The SysOps administrator can specify the operating system tag as a target parameter, ensuring that the code is only executed on the relevant instances, which saves time and prevents errors. AWS Systems Manager keeps a history of Run Command executions, providing an easy way to provide evidence to the security team that the code has successfully run on all instances.

   Source: Adapted from community discussion — Christina666

   Next question

6. Question 296 · 475 in bank

   A company has an application that collects notifications from thousands of alarm systems. The notifications include alarm notifications and information notifications. The information notifications include the system arming processes, disarming processes, and sensor status. All notifications are kept as messages in an Amazon Simple Queue Service (Amazon SQS) queue. Amazon EC2 instances that are in an Auto Scaling group process the messages. A SysOps administrator needs to implement a solution that prioritizes alarm notifications over information notifications. Which solution will meet these requirements?

   • AAdjust the Auto Scaling group to scale faster when a high number of messages is in the queue.
   • BUse the Amazon Simple Notification Service (Amazon SNS) fanout feature with Amazon SQS to send the notifications in parallel to all the C2 instances
   • CAdd an Amazon DynamoDB stream to accelerate the message processing
   • DCreate a queue for alarm notifications and a queue for information notifications. Update the application to collect messages from the alarm notifications queue first.

   Show answer

   Answer: D

   Explanation

   Option D is the correct solution to prioritize alarm notifications over information notifications. By creating separate queues for alarm notifications and information notifications, you can ensure that the messages are kept separate and can be processed independently. This approach allows you to prioritize the alarm notifications by having the application collect messages from the alarm notifications queue first.

   Source: Adapted from community discussion — trvtrinh

   Next question

7. Question 297 · 475 in bank

   A SysOps administrator needs to deploy an application in multiple AWS Regions. The SysOps administrator must implement a solution that routes users to the Region with the lowest latency. In case of failure, the solution must automatically route requests to a Region with a healthy instance of the application. The company needs a solution with the shortest time to failover. Which solution will meet these requirements?

   • ACreate Amazon Route 53 A records that have the same name for each endpoint. Use a latency routing policy. Associate a health check with each record.
   • BCreate Amazon Route 53 A records that have the same name for each endpoint. Use a failover routing policy. Associate a health check with each record.
   • CCreate an AWS Global Accelerator standard accelerator. Create an endpoint group for each Region. Add a listener to the accelerator. Associate the endpoint group with the listener.
   • DCreate Amazon Route 53 A records that have the same name for each endpoint. Use a geolocation routing policy. Associate a health check with each record.

   Show answer

   Answer: C

   Explanation

   AWS Global Accelerator is a service that helps to improve the availability and performance of applications by directing traffic through the AWS global network. It automatically routes traffic to the closest AWS Region based on the lowest latency for the end user. By creating an endpoint group for each AWS Region, the Global Accelerator can distribute traffic across multiple Regions. This means that users will be routed to the Region with the lowest latency, ensuring the best performance for their location. Adding a listener to the accelerator allows it to listen for incoming traffic and direct it to the appropriate endpoint group. The AWS Global Accelerator constantly monitors the health of the endpoints (applications) in each endpoint group. If an endpoint becomes unhealthy or experiences a failure, the Global Accelerator automatically reroutes traffic to a healthy instance of the application in another Region, ensuring high availability and automatic failover.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 298 · 475 in bank

   A company runs an application on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The application sometimes becomes slow and unresponsive. Amazon CloudWatch metrics show that some EC2 instances are experiencing high CPU load. A SysOps administrator needs to create a CloudWatch dashboard that can automatically display CPU metrics of all the EC2 instances. The metrics must include new instances that are launched as part of the Auto Scaling group. What should the SysOps administrator do to meet these requirements in the MOST operationally efficient way?

   • ACreate a CloudWatch dashboard. Use activity notifications from the Auto Scaling group to invoke a custom AWS Lambda function. Use the Lambda function to update the CloudWatch dashboard to monitor the CPUUtilization metric for the new instance IDs.
   • BCreate a CloudWatch dashboard. Run a custom script on each EC2 instance to stream the CPU utilization to the dashboard.
   • CUse CloudWatch metrics explorer to filter by the aws:autoscaling:groupName tag and to create a visualization for the CPUUtilization metric. Add the visualization to a CloudWatch dashboard.
   • DUse CloudWatch metrics explorer to filter by instance state and to create a visualization for the CPUUtilization metric. Add the visualization to a CloudWatch dashboard.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

9. Question 299 · 475 in bank

   A company has an encrypted Amazon S3 bucket that is hosted in the ap-southeast-2 Region. Users from the eu-west-2 Region access the S3 bucket over the internet. The users from eu-west-2 need faster transfers to and from the S3 bucket for large files. Which solution will meet these requirements?

   • AReduce the length of the S3 bucket prefixes within the S3 bucket.
   • BChange the server-side encryption on the S3 bucket from AES to RSA.
   • CCreate a new S3 bucket that has an identical name in eu-west-2. Use the new S3 bucket endpoint's domain name for access.
   • DEnable S3 Transfer Acceleration on the S3 bucket. Use the new s3-accelerate endpoint's domain name for access.

   Show answer

   Answer: D

   Explanation

   Amazon S3 Transfer Acceleration can speed up content transfers to and from Amazon S3 by as much as 50-500% for long-distance transfer of larger objects. https://aws.amazon.com/s3/transfer-acceleration/

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 300 · 475 in bank

    A SysOps administrator must create a solution that immediately notifies software developers if an AWS Lambda function experiences an error. Which solution will meet this requirement?

    • ACreate an Amazon Simple Notification Service (Amazon SNS) topic with an email subscription for each developer. Create an Amazon CloudWatch alarm by using the Errors metric and the Lambda function name as a dimension. Configure the alarm to send a notification to the SNS topic when the alarm state reaches ALARM.
    • BCreate an Amazon Simple Notification Service (Amazon SNS) topic with a mobile subscription for each developer. Create an Amazon EventBridge (Amazon CloudWatch Events) alarm by using the LambdaError as the event pattern and the SNS topic name as a resource. Configure the alarm to send a notification to the SNS topic when the alarm state reaches ALARM.
    • CVerify each developer email address in Amazon Simple Email Service (Amazon SES). Create an Amazon CloudWatch rule by using the LambdaError metric and developer email addresses as dimensions. Configure the rule to send an email through Amazon SES when the rule state reaches ALARM.
    • DVerify each developer mobile phone in Amazon Simple Email Service (Amazon SES). Create an Amazon EventBridge (Amazon CloudWatch Events) rule by using Error as the event pattern and the Lambda function name as a resource. Configure the rule to send a push notification through Amazon SES when the rule state reaches ALARM.

    Show answer

    Answer: A

    Explanation

    Not C or D as SES is used for marketing emails. Leaves us with A or B. With B AWS config, Cloudtrail or Cloudwatch can be the source no a SNS topic. A seems the best reasonable solution

    Source: Adapted from community discussion — by116549

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 291. 475 questions available.