SOA-C02 practice questions 321–330

1. Question 321 · 475 in bank

   Select 2

   A SysOps administrator migrates NAT instances to NAT gateways. After the migration, an application that is hosted on Amazon EC2 instances in a private subnet cannot access the internet. Which of the following are possible reasons for this problem? (Choose two.)

   • AThe application is using a protocol that the NAT gateway does not support.
   • BThe NAT gateway is not in a security group.
   • CThe NAT gateway is in an unsupported Availability Zone.
   • DThe NAT gateway is not in the Available state.
   • EThe port forwarding settings do not allow access to internal services from the internet.

   Show answer

   Answer: AD

   Explanation

   A & D for now. My research suggests that either A, C or D could be correct (see quotes and URL below). However, in analyzing the wording, I think "C" might be incorrect IF the NAT Gateway creation fails due to NotAvailableInZone error. If the NAT Gateway "object" still get's created, but is just not available due to the error, then C is back in play. Not sure if question is tricky or is just bad. A: "Ensure that your connection is using a TCP, UDP, or ICMP protocol only." C: If creation of NAT Gateway generates a "NotAvailableInZone" error, the "Availability Zone is unsupported" because it is constrained from being expanded D: "Check that the NAT gateway is in the Available state." and "here may have been an error when it was created") (see: "Troubleshoot NAT gateways") https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-troubleshooting.html

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 322 · 475 in bank

   Select 3

   A company needs to monitor the disk utilization of Amazon Elastic Block Store (Amazon EBS) volumes. The EBS volumes are attached to Amazon EC2 Linux instances. A SysOps administrator must set up an Amazon CloudWatch alarm that provides an alert when disk utilization increases to more than 80%. Which combination of steps must the SysOps administrator take to meet these requirements? (Choose three.)

   • ACreate an IAM role that includes the CloudWatchAgentServerPolicy AWS managed policy. Attach the role to the instances.
   • BCreate an IAM role that includes the CloudWatchApplicationInsightsReadOnlyAccess AWS managed policy. Attach the role to the instances.
   • CInstall and start the CloudWatch agent by using AWS Systems Manager or the command line.
   • DInstall and start the CloudWatch agent by using an IAM role. Attach the CloudWatchAgentServerPolicy AWS managed policy to the role.
   • EConfigure a CloudWatch alarm to enter ALARM state when the disk_used_percent CloudWatch metric is greater than 80%.
   • FConfigure a CloudWatch alarm to enter ALARM state when the disk_used CloudWatch metric is greater than 80% or when the disk_free CloudWatch metric is less than 20%.

   Show answer

   Answer: ACE

   Explanation

   E instead of D because attaching the CloudWatchAgentServerPolicy directly to an IAM role assigned to the EC2 instances (as in option A) is more straightforward

   Source: Adapted from community discussion — dinuts

   Next question

3. Question 323 · 475 in bank

   An ecommerce company uses an Amazon ElastiCache for Redis cluster for in-memory caching of popular product queries on a shopping website. The cache eviction policy is randomly evicting keys whether or not a TTL is set. A SysOps administrator must improve the cache hit ratio without increasing costs. Which solution will meet these requirements?

   • AAdd another node to the ElastiCache cluster.
   • BIncrease the ElastiCache TTL value.
   • CChange the eviction policy to randomly evict keys that have a TTL set.
   • DChange the eviction policy to evict the least frequently used keys.

   Show answer

   Answer: D

   Explanation

   "The cache eviction policy is randomly evicting keys whether or not a TTL is set." is a sign that currently the eviction policy "allkeys-random" is in use. As we want to drop frequently used entries the answer should be "allkeys-lfu" for evicting least frequently used entries.

   Source: Adapted from community discussion — Kipalom

   References

   • AWS documentation

   Next question

4. Question 324 · 475 in bank

   A company deployed a new web application on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances run in an Auto Scaling group. Users report that they are frequently being prompted to log in. What should a SysOps administrator do to resolve this issue?

   • AConfigure an Amazon CloudFront distribution with the ALB as the origin.
   • BEnable sticky sessions (session affinity) for the target group of EC2 instances.
   • CRedeploy the EC2 instances in a spread placement group.
   • DReplace the ALB with a Network Load Balancer.

   Show answer

   Answer: B

   Explanation

   B. Enable sticky sessions (session affinity) for the target group of EC2 instances. Explanation: When users are frequently prompted to log in, it might indicate that their requests are being directed to different instances, leading to a loss of session state. Enabling sticky sessions (session affinity) ensures that requests from the same client are consistently directed to the same EC2 instance. This is important for applications that rely on maintaining session state.

   Source: Adapted from community discussion — LemonGremlin

   Next question

5. Question 325 · 475 in bank

   A company has scientists who upload large data objects to an Amazon S3 bucket. The scientists upload the objects as multipart uploads. The multipart uploads often fail because of poor end-client connectivity. The company wants to optimize storage costs that are associated with the data. A SysOps administrator must implement a solution that presents metrics for incomplete uploads. The solution also must automatically delete any incomplete uploads after 7 days. Which solution will meet these requirements?

   • AReview the Incomplete Multipart Upload Bytes metric in the S3 Storage Lens dashboard. Create an S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days.
   • BImplement S3 Intelligent-Tiering to move data into lower-cost storage classes after 7 days. Create an S3 Storage Lens policy to automatically delete any incomplete multipart uploads after 7 days.
   • CAccess the S3 console. Review the Metrics tab to check the storage that incomplete multipart uploads are consuming. Create an AWS Lambda function to delete any incomplete multipart uploads after 7 days.
   • DUse the S3 analytics storage class analysis tool to identify and measure incomplete multipart uploads. Configure an S3 bucket policy to enforce restrictions on multipart uploads to delete incomplete multipart uploads after 7 days.

   Show answer

   Answer: A

   Explanation

   Amazon S3 supports a bucket lifecycle rule that you can use to direct Amazon S3 to stop multipart uploads that aren't completed within a specified number of days after being initiated. When a multipart upload isn't completed within the specified time frame, it becomes eligible for an abort operation. Amazon S3 then stops the multipart upload and deletes the parts associated with the multipart upload. https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpu-abort-incomplete-mpu-lifecycle-config.html#

   Source: Adapted from community discussion — nharaz

   References

   • AWS documentation

   Next question

6. Question 326 · 475 in bank

   A company stores data in Amazon S3 buckets that are provisioned in three separate AWS Regions. The data is copied from the S3 buckets to the data center over the public internet using a VPN. The SysOps administrator notices that, occasionally, the transfers take longer than usual, and determines the issue is congestion within the company's ISP network. What is the MOST cost-effective approach the administrator can take to ensure consistent transfer times from S3 to the data center?

   • AEstablish an AWS Direct Connect link to each Region. Create a private virtual interface over each link.
   • BEstablish an AWS Direct Connect link to each Region. Create a public virtual interface over each link.
   • CEstablish an AWS Direct Connect link to one of the Regions. Create a private virtual interface over that link.
   • DEstablish an AWS Direct Connect link to one of the Regions. Create a public virtual interface over that link.

   Show answer

   Answer: D

   Explanation

   First lets make some things clear: 1. Private VIF provides connection to VPC in just 1 specific region. so: Since we can reach 1 bucket in region, what is going to happen to other region buckets? Eventually even if we manage to set up connections via that one VPC with other regions it would incur inter-region data transfer charges! 2.Public VIF allows you to access all AWS public services - means S3 regardless of S3 bucket's region. Transfer cost is the same for all regions. We are not charged data transfer rates for transferring data out of S3 to our Direct Connect location. I hope this makes it clear that we will be using 1 DX connection and public VIF(virtual interface) to access those 3 different region buckets bypassing internet.

   Source: Adapted from community discussion — awsamar

   References

   • AWS documentation

   Next question

7. Question 327 · 475 in bank

   A company has an Amazon EC2 instance that supports a production system. The EC2 instance is backed by an Amazon Elastic Block Store (Amazon EBS) volume. The EBS volume's drive has filled to 100% capacity, which is causing the application on the EC2 instance to experience errors. Which solution will remediate these errors in the LEAST amount of time?

   • AModify the EBS volume by adding additional drive space. Log on to the EC2 instance. Use the file system-specific commands to extend the file system.
   • BCreate a snapshot of the existing EBS volume. When the snapshot is complete, create an EBS volume of a larger size from the snapshot in the same Availability Zone as the EC2 instance. Attach the new EBS volume to the EC2 instance. Mount the file system.
   • CCreate a new EBS volume of a larger size in the same Availability Zone as the EC2 instance. Attach the EBS volume to the EC2 instance. Copy the data from the existing EBS volume to the new EBS volume.
   • DStop the EC2 instance. Change the EC2 instance to a larger instance size that includes additional drive space. Start the EC2 instance.

   Show answer

   Answer: A

   Explanation

   A: Modify the EBS volume by adding additional drive space. Log on to the EC2 instance. Use the file system-specific commands to extend the file system. This allows you to extend the existing EBS volume's capacity directly without having to create new volumes or copy data. It's the quickest because it directly addresses the issue of the filled EBS volume, extending its capacity to resolve the errors without having to create new volumes or copy data. You can resize the EBS volume while it is attached to the running EC2 instance, and then extend the file system within the EC2 instance's operating system. This method does not require downtime for the EC2 instance or data migration. https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modify-volume.html

   Source: Adapted from community discussion — joshnort

   References

   • AWS documentation

   Next question

8. Question 328 · 475 in bank

   A company has several member accounts that are in an organization in AWS Organizations. The company recently discovered that administrators have been using account root user credentials. The company must prevent the administrators from using root user credentials to perform any actions on Amazon EC2 instances. What should a SysOps administrator do to meet this requirement?

   • ACreate an identity-based IAM policy in each member account to deny actions on EC2 instances by the root user.
   • BIn the organization's management account, create a service control policy (SCP) to deny actions on EC2 instances by the root user in all member accounts.
   • CUse AWS Config to prevent any actions on EC2 instances by the root user.
   • DUse Amazon Inspector in each member account to scan for root user logins and to prevent any actions on EC2 instances by the root user.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

9. Question 329 · 475 in bank

   A company is transitioning away from applications that are hosted on Amazon EC2 instances. The company wants to implement a serverless architecture that uses Amazon S3, Amazon API Gateway, AWS Lambda, and Amazon CloudFront. As part of this transition, the company has Elastic IP addresses that are unassociated with any EC2 instances after the EC2 instances are terminated. A SysOps administrator needs to automate the process of releasing all unassociated Elastic IP addresses that remain after the EC2 instances are terminated. Which solution will meet this requirement in the MOST operationally efficient way?

   • AActivate the eip-attached AWS Config managed rule to run automatically when resource changes occur in the AWS account. Configure automatic remediation for the rule. Specify the AWS-ReleaseElasticIP AWS Systems Manager Automation runbook for remediation. Specify an appropriate role that has permission for the remediation.
   • BCreate a custom Lambda function that calls the EC2 ReleaseAddress API operation and specifies the Elastic IP address AllocationId. Invoke the Lambda function by using an Amazon EventBridge rule. Specify AWS services as the event source, All Events as the event type, and AWS Trusted Advisor as the target.
   • CCreate an Amazon EventBridge rule. Specify AWS services as the event source, Instance State-change Notification as the event type, and Amazon EC2 as the service. Invoke a Lambda function that extracts the Elastic IP address from the notification. Use AWS CloudFormation to release the address by specifying the AllocationId as an input parameter.
   • DCreate a custom Lambda function that calls the EC2 ReleaseAddress API operation and specifies the Elastic IP address AllocationId. Invoke the Lambda function by using an Amazon EventBridge rule. Specify AWS services as the event source, Instance State-change Notification as the event type, and Amazon EC2 as the service.

   Show answer

   Answer: A

   Explanation

   Option A is operationally efficient as it leverages AWS Config, which is designed for resource configuration tracking and compliance, along with Systems Manager Automation for remediation tasks. This approach is native to AWS and simplifies the process of releasing unassociated Elastic IP addresses.

   Source: Adapted from community discussion — LemonGremlin

   References

   • AWS documentation

   Next question

10. Question 330 · 475 in bank

    A company uses Amazon CloudFront to serve static content to end users. The company's marketing team recently deployed updates to 150 images on the company's website. However, the website is not displaying some of the new images. A SysOps administrator reviews the CloudFront distribution's cache settings. The default TTL for the distribution is set to 1 week (604,800 seconds). What should the SysOps administrator do to refresh the cache with the new images in the MOST operationally efficient way?

    • ACreate a new CloudFront distribution that has the same origin. Set the default TTL to 1 minute (60 seconds). Switch Amazon Route 53 DNS records to use the new distribution.
    • BInstruct the marketing team to upload the new images to a different location. When the new images are uploaded, update the website to locate the new images.
    • CIssue a CloudFront invalidation request to immediately expire the new images from the marketing team's update.
    • DUpdate the existing CloudFront distribution to reconfigure the default TTL to 1 minute (60 seconds). During submission of the new configuration, include the flag to invalidate objects in the specified path.

    Show answer

    Answer: C

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 321. 475 questions available.