SOA-C02 practice questions 301–310

1. Question 301 · 475 in bank

   A company has a large on-premises tape backup solution. The company has started to use AWS Storage Gateway. The company created a Tape Gateway to replace the existing on-premises hardware. The company's backup engineer noticed that some of the backup jobs that were supposed to write to AWS failed to run because of a "Not Enough Space" error. The company does not want these failures to happen again. The company also wants to consistently have enough tape available on AWS. What is the MOST operationally efficient way for a SysOps administrator to meet these requirements?

   • ACreate an AWS Lambda function that runs on an hourly basis and checks how many tapes have available space. If the available tapes are below a certain threshold, provision more.
   • BInstall the Amazon CloudWatch agent on the on-premises system. Push the log files to a CloudWatch log group. Create an AWS Lambda function that creates more tapes when the "Not Enough Space" error appears. Create a metric filter and a metric alarm that launches the Lambda function.
   • CCreate an additional Tape Gateway with its own set of tapes. Configure Amazon Simple Notification Service (Amazon SNS) to send a notification to the backup engineer if the tapes that are associated with the primary Tape Gateway do not have available space.
   • DConfigure tape auto-create on the Tape Gateway. In the auto-create settings, configure a minimum number of tapes, an appropriate barcode prefix, and a tape pool.

   Show answer

   Answer: D

   Explanation

   https://docs.aws.amazon.com/storagegateway/latest/tgw/managing-automatic-tape-creation.html The Tape Gateway automatically creates new virtual tapes to maintain the minimum number of available tapes that you configure. It then makes these new tapes available for import by the backup application so that your backup jobs can run without interruption. Automatic tape creation removes the need for custom scripting in addition to the manual process for creating new virtual tapes.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • repost.aws documentation

   Next question

2. Question 302 · 475 in bank

   A SysOps administrator manages a company's Amazon S3 buckets. The SysOps administrator has identified 5 GB of incomplete multipart uploads in an S3 bucket in the company's AWS account. The SysOps administrator needs to reduce the number of incomplete multipart upload objects in the S3 bucket. Which solution will meet this requirement?

   • ACreate an S3 Lifecycle rule on the S3 bucket to delete expired markers or incomplete multipart uploads.
   • BRequire users that perform uploads of files into Amazon S3 to use the S3 TransferUtility.
   • CEnable S3 Versioning on the S3 bucket that contains the incomplete multipart uploads.
   • DCreate an S3 Object Lambda Access Point to delete incomplete multipart uploads.

   Show answer

   Answer: A

   Explanation

   A. Create an S3 Lifecycle rule on the S3 bucket to delete expired markers or incomplete multipart uploads. Explanation: S3 Lifecycle rules allow you to define actions that Amazon S3 should take on objects in the bucket over time. This includes transitioning objects between storage classes and deleting objects when they meet certain criteria. To reduce the number of incomplete multipart upload objects in the S3 bucket, you can create an S3 Lifecycle rule that targets incomplete multipart uploads and specifies a deletion action for them. This will help in automatically cleaning up the incomplete multipart uploads after a certain period.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation

   Next question

3. Question 303 · 475 in bank

   A SysOps administrator manages policies for many AWS member accounts in an AWS Organizations structure. Administrators on other teams have access to the account root user credentials of the member accounts. The SysOps administrator must prevent all teams, including their administrators, from using Amazon DynamoDB. The solution must not affect the ability of the teams to access other AWS services. Which solution will meet these requirements?

   • AIn all member accounts, configure IAM policies that deny access to all DynamoDB resources for all users, including the root user.
   • BCreate a service control policy (SCP) in the management account to deny all DynamoDB actions. Apply the SCP to the root of the organization
   • CIn all member accounts, configure IAM policies that deny AmazonDynamoDBFullAccess to all users, including the root user.
   • DRemove the default service control policy (SCP) in the management account. Create a replacement SCP that includes a single statement that denies all DynamoDB actions.

   Show answer

   Answer: B

   Explanation

   The answer is B as you have no idea what other SCP policies could be in place and deleting the entire SCP would be bad practice.

   Source: Adapted from community discussion — eboehm

   References

   • AWS documentation

   Next question

4. Question 304 · 475 in bank

   A company has users that deploy Amazon EC2 instances that have more disk performance capacity than is required. A SysOps administrator needs to review all Amazon Elastic Block Store (Amazon EBS) volumes that are associated with the instances and create cost optimization recommendations based on IOPS and throughput. What should the SysOps administrator do to meet these requirements in the MOST operationally efficient way?

   • AUse the monitoring graphs in the EC2 console to view metrics for EBS volumes. Review the consumed space against the provisioned space on each volume. Identify any volumes that have low utilization.
   • BStop the EC2 instances from the EC2 console. Change the EC2 instance type for Amazon EBS-optimized. Start the EC2 instances.
   • COpt in to AWS Compute Optimizer. Allow sufficient time for metrics to be gathered. Review the Compute Optimizer findings for EBS volumes.
   • DInstall the fio tool onto the EC2 instances and create a .cfg file to approximate the required workloads. Use the benchmark results to gauge whether the provisioned EBS volumes are of the most appropriate type.

   Show answer

   Answer: C

   Explanation

   To help you right-size your EBS volumes, AWS Compute Optimizer analyzes your AWS resource utilization data collected by Amazon CloudWatch from the past 14 days (paid option available for up to three months of data) to identify the optimal resource configuration. These recommendations are available for your Amazon Elastic Compute Cloud (EC2) instances, EBS volumes, AWS Auto Scaling groups, AWS Lambda functions, and AWS Fargate.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation

   Next question

5. Question 305 · 475 in bank

   A SysOps administrator has many Windows Amazon EC2 instances that need to share a file system between nodes. The SysOps administrator creates an Amazon Elastic File System (Amazon EFS) file share. After creation of the file share, the SysOps administrator is having trouble mounting the file share to the EC2 instances. Which action should the SysOps administrator take so that the EC2 instances can share the files?

   • ADelete the EFS file share. Create an Amazon FSx for Windows File Server file share for the EC2 instances.
   • BUse the correct IAM credentials to mount the EFS file share.
   • CConfigure NFSv4 support on the Windows operating system that is running on the EC2 instances.
   • DAllow the correct port for NFS through the security group and network ACL.

   Show answer

   Answer: A

   Explanation

   my badis option A File system mount on Windows instance fails A file system mount on an Amazon EC2 instance on Microsoft Windows fails. Action to take Don't use Amazon EFS with Windows EC2 instances, which isn't supported.

   Source: Adapted from community discussion — mana25

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 306 · 475 in bank

   A company has a multi-account environment. Account A has a production application that is hosted on an Amazon EC2 instance. The application needs to query data in an Amazon DynamoDB table that is hosted in Account B. A SysOps administrator needs to provide the EC2 instance in Account A with access to the DynamoDB table in Account B. What is the MOST secure solution that will meet these requirements?

   • AUpdate the IAM policy that is attached to the EC2 instance's IAM role to allow the dynamodb:Query permission on the DynamoDB table in Account B. Add a policy in Account A to allow the DynamoDB service principal to use the PassRole action to pass the role to Account B.
   • BIn Account B, create an IAM role that has permission to query the DynamoDB table. Add the EC2 instance's IAM role to the trust policy on the newly created IAM role in Account Update the IAM policy that is attached to the EC2 instance's IAM role to allow the sts:AssumeRole permission on the newly created IAM role in Account B.
   • CUpdate the IAM policy that is attached to the EC2 instance's IAM role to allow the dynamodb:Query permission on the DynamoDB table in Account B. Update the DynamoDB table's resource policy to allow the query action from the EC2 instance's IAM role.
   • DIn Account B, create a static IAM key that has the appropriate permissions to query the DynamoDB table. Embed these credentials into the credentials file on the EC2 instance. Reference the credentials every time the application needs to query the table.

   Show answer

   Answer: B

   Explanation

   This option follows the best practice of using IAM roles and cross-account roles for secure access between AWS accounts. By creating an IAM role in Account B with the necessary permissions to query the DynamoDB table and adding the EC2 instance's IAM role to the trust policy of the newly created role, you establish a secure cross-account access mechanism. The EC2 instance can then assume the role in Account B and access the DynamoDB table securely.

   Source: Adapted from community discussion — r2c3po

   References

   • AWS documentation

   Next question

7. Question 307 · 475 in bank

   A company has implemented a Kubernetes cluster on Amazon Elastic Kubernetes Service (Amazon ECS) to host a microservices-based application. The company expects application traffic to increase significantly for the next month and wants to prevent the application from crashing because of the high number of requests. Which solution will meet these requirements with the LEAST administrative overhead?

   • ACreate a second EKS cluster. Load balance the workload between the two clusters.
   • BImplement the Kubernetes Horizontal Pod Autoscaler. Set a target CPU utilization percentage.
   • CMigrate the application from Amazon EKS to Amazon EC2 for the next month. Migrate the application back to Amazon EKS when the month ends.
   • DImplement the Kubernetes Vertical Pod Autoscaler. Set a target CPU utilization percentage.

   Show answer

   Answer: B

   Explanation

   The Kubernetes Horizontal Pod Autoscaler (HPA) is designed to automatically scale the number of pods in a deployment or replica set based on observed CPU or memory utilization. In this scenario, the company wants to prevent the application from crashing due to high request traffic. The HPA can dynamically adjust the number of pods based on CPU utilization, ensuring that the application can handle increased traffic while avoiding overloading the system.

   Source: Adapted from community discussion — AWSdeveloper08

   References

   • AWS documentation

   Next question

8. Question 308 · 475 in bank

   Select 2

   A company deploys a new application to Amazon EC2 instances. The application code is stored in an AWS CodeCommit repository. The company uses an AWS CodePipeline pipeline to deploy the code to the EC2 instances through a continuous integration and continuous delivery (CI/CD) process. A SysOps administrator needs to ensure that sensitive database information is configured properly on the EC2 instances to prevent accidental leakage of credentials. Which solutions will store and retrieve the sensitive information in the MOST secure manner? (Choose two.)

   • AStore the values in AWS Secrets Manager. Update the code to retrieve these values when the application starts. Store the values as environmental variables that the application can use.
   • BStore the values in AWS Systems Manager Parameter Store as secret strings. Update the code to retrieve these values when the application starts. Store the values as environmental variables that the application can use.
   • CStore the values in an AWS Lambda function. Update the code to invoke the Lambda function when the application starts. Configure the Lambda function to inject the values as environmental variables that the application can use.
   • DStore the configuration information in a file on the EC2 instances. Ensure that the underlying drives are encrypted by AWS Key Management Service (AWS KMS). Update the application to read the file when the application starts. Store the values as environmental variables.
   • EStore the values in a text file in an Amazon S3 bucket. In the CI/CD pipeline, copy the file to the EC2 instance in an appropriate location on a disk that the application can read.

   Show answer

   Answer: AB

   Explanation

   AB: AWS Secrets Manager is specifically designed for securely storing and managing secrets such as database credentials, API keys, and other sensitive information. You can rotate and manage these secrets easily, and the application can retrieve them securely. Storing them as environmental variables is a good practice for applications to access sensitive information securely. https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html Parameter Store allows for secure storage of sensitive data such as passwords, database strings, etc., including secret strings. It also supports parameter hierarchy, versioning, and integration with AWS Identity and Access Management (IAM) for access control. Again, storing them as environmental variables provides a secure way for the application to access these secrets. https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html

   Source: Adapted from community discussion — joshnort

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 309 · 475 in bank

   A SysOps administrator configured VPC flow logs by using the default format. The SysOps administrator specified Amazon CloudWatch Logs as the destination. This solution has worked successfully for several months. However, because of additional troubleshooting requirements, the SysOps administrator needs to include the tcp-flags field on the flow logs. What should the SysOps administrator do to meet this requirement?

   • ACreate a new flow log. Include the tcp-flags field in the custom log format. Delete the original flow log.
   • BIn the CloudWatch Logs log group, modify the filter to include the tcp-flags field and the type field.
   • CIn CloudWatch Metrics, modify the metric configuration to include the tcp-flags field.
   • DModify the existing flow log. Include the tcp-flags field and the type field in the custom log format. Save the configuration.

   Show answer

   Answer: A

   Explanation

   Answer is A. tcp-flags are not included into default format. If you want to have tcp-flags, you should use custom log format. You can't modify existing flow log. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

   Source: Adapted from community discussion — Tapkar

   References

   • AWS documentation

   Next question

10. Question 310 · 475 in bank

    A company has a private Amazon S3 bucket that contains sensitive information. A SysOps administrator needs to keep logs of the IP addresses from authentication failures that result from attempts to access objects in the bucket. The logs must be stored so that they cannot be overwritten or deleted for 90 days. Which solution will meet these requirements?

    • ACreate an AWS CloudTrail trail. Configure the log files to be saved to Amazon CloudWatch Logs. Configure the log group with a retention period of 90 days.
    • BCreate an AWS CloudTrail trail. Configure the log files to be saved to a different S3 bucket. Turn on CloudTrail log file integrity validation for 90 days.
    • CTurn on access logging for the S3 bucket. Configure the access logs to be saved to Amazon CloudWatch Logs. Configure the log group with a retention period of 90 days.
    • DTurn on access logging for the S3 bucket. Configure the access logs to be saved in a second S3 bucket. Turn on S3 Object Lock on the second S3 bucket, and configure a default retention period of 90 days.

    Show answer

    Answer: D

    Explanation

    NOT A: Can't configure CloudTrail to store logs in CloudWatch Logs. CloudTrail uses S3 bucket. CloudWatch Logs is not applicable. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/get-and-view-cloudtrail-log-files.html NOT B: "Integrity validation" is only designed to detect changes or deletions of CloudTrail logs. It depends on other security measures to block this. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html NOT C: Server access logging only delivers access logs for a source bucket to a target bucket. CloudWatch log group is not applicable. https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.htm NOT D: "S3 buckets with S3 Object Lock can't be used as destination buckets for server access logs." https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html

    Source: Adapted from community discussion — Gomer

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 301. 475 questions available.