SOA-C02 practice questions 331–340

1. Question 331 · 475 in bank

   A SysOps administrator is responsible for a company's disaster recovery procedures. The company has a source Amazon S3 bucket in a production account, and it wants to replicate objects from the source to a destination S3 bucket in a nonproduction account. The SysOps administrator configures S3 cross-Region, cross-account replication to copy the source S3 bucket to the destination S3 bucket. When the SysOps administrator attempts to access objects in the destination S3 bucket, they receive an Access Denied error. Which solution will resolve this problem?

   • AModify the replication configuration to change object ownership to the destination S3 bucket owner.
   • BEnsure that the replication rule applies to all objects in the source S3 bucket and is not scoped to a single prefix.
   • CRetry the request when the S3 Replication Time Control (S3 RTC) has elapsed.
   • DVerify that the storage class for the replicated objects did not change between the source S3 bucket and the destination S3 bucket.

   Show answer

   Answer: A

   Explanation

   By changing the object ownership to the destination S3 bucket owner, you ensure that the destination account has the necessary permissions to access and manage the replicated objects. This helps resolve the Access Denied error.

   Source: Adapted from community discussion — LemonGremlin

   References

   • AWS documentation

   Next question

2. Question 332 · 475 in bank

   A SysOps administrator has enabled AWS CloudTrail in an AWS account. If CloudTrail is disabled, it must be re-enabled immediately. What should the SysOps administrator do to meet these requirements WITHOUT writing custom code?

   • AAdd the AWS account to AWS Organizations. Enable CloudTrail in the management account.
   • BCreate an AWS Config rule that is invoked when CloudTrail configuration changes. Apply the AWS-ConfigureCloudTrailLogging automatic remediation action.
   • CCreate an AWS Config rule that is invoked when CloudTrail configuration changes. Configure the rule to invoke an AWS Lambda function to enable CloudTrail.
   • DCreate an Amazon EventBridge (Amazon CloudWatch Event) hourly rule with a schedule pattern to run an AWS Systems Manager Automation document to enable CloudTrail.

   Show answer

   Answer: B

   Explanation

   B - "To ensure that CloudTrail remains enabled in your account, AWS Config provides the cloudtrail-enabled managed rule. If CloudTrail is turned off, the cloudtrail-enabled rule automatically re-enables it by using automatic remediation." https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-re-enable-aws-cloudtrail-by-using-a-custom-remediation-rule-in-aws-config.html

   Source: Adapted from community discussion — Finger41

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 333 · 475 in bank

   A company runs an application on an Amazon EC2 instance. A SysOps administrator creates an Auto Scaling group and an Application Load Balancer (ALB) to handle an increase in demand. However, the EC2 instances are failing the health check. What should the SysOps administrator do to troubleshoot this issue?

   • AVerify that the Auto Scaling group is configured to use all AWS Regions.
   • BVerify that the application is running on the protocol and the port that the listener is expecting.
   • CVerify the listener priority in the ALB. Change the priority if necessary.
   • DVerify the maximum number of instances in the Auto Scaling group. Change the number if necessary.

   Show answer

   Answer: B

   Explanation

   Vote B! Target.FailedHealthChecks Verify that the target is listening for traffic on the health check port. You can use the ss command on Linux targets to verify which ports your server is listening on. For Windows targets, you can use the netstat command. https://aws.amazon.com/premiumsupport/knowledge-center/elb-fix-failing-health-checks-alb/

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation

   Next question

4. Question 334 · 475 in bank

   A company is running Amazon RDS for PostgreSQL Multi-AZ DB clusters. The company uses an AWS CloudFormation template to create the databases individually with a default size of 100 GB. The company creates the databases every Monday and deletes the databases every Friday. Occasionally, the databases run low on disk space and initiate an Amazon CloudWatch alarm. A SysOps administrator must prevent the databases from running low on disk space in the future. Which solution will meet these requirements with the FEWEST changes to the application?

   • AModify the CloudFormation template to use Amazon Aurora PostgreSQL as the DB engine.
   • BModify the CloudFormation template to use Amazon DynamoDB as the database. Activate storage auto scaling during creation of the tables.
   • CModify the Cloud Formation template to activate storage auto scaling on the existing DB instances.
   • DCreate a CloudWatch alarm to monitor DB instance storage space. Configure the alarm to invoke the VACUUM command.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

5. Question 335 · 475 in bank

   A SysOps administrator wants to share a copy of a production database with a migration account. The production database is hosted on an Amazon RDS DB instance and is encrypted at rest with an AWS Key Management Service (AWS KMS) key that has an alias of production-rds-key. What must the SysOps administrator do to meet these requirements with the LEAST administrative overhead?

   • ATake a snapshot of the RDS DB instance in the production account. Amend the KMS key policy of the production-rds-key KMS key to give access to the migration account's root user. Share the snapshot with the migration account.
   • BCreate an RDS read replica in the migration account. Configure the KMS key policy to replicate the production-rds-key KMS key to the migration account.
   • CTake a snapshot of the RDS DB instance in the production account. Share the snapshot with the migration account. In the migration account, create a new KMS key that has an identical alias.
   • DUse native database toolsets to export the RDS DB instance to Amazon S3. Create an S3 bucket and an S3 bucket policy for cross account access between the production account and the migration account. Use native database toolsets to import the database from Amazon S3 to a new RDS DB instance.

   Show answer

   Answer: A

   Explanation

   As its not possible to create a read replica in another account, I go for A. Make a snapshot, make sure the migration account kann use the KMS key and share the snapshot for decryption.

   Source: Adapted from community discussion — Kipalom

   References

   • repost.aws documentation
   • AWS documentation

   Next question

6. Question 336 · 475 in bank

   A company hosts a continuous integration and continuous delivery (CI/CD) environment on AWS. The CI/CD environment includes a Jenkins server that is hosted on an Amazon EC2 instance. A 500 GB General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volume is attached to the EC2 instance. Because of disk throughput limitations, the Jenkins server reports performance issues that are resulting in slower builds on the server. The EBS volume needs to sustain 3,000 IOPS while performing nightly build tasks. A SysOps administrator examines the server's history in Amazon CloudWatch. The BurstBalance metric has had a value of 0 during nightly builds. The SysOps administrator needs to improve the performance and meet the sustained throughput requirements. Which solution will meet these requirements MOST cost-effectively?

   • ADouble the gp2 EBS volume size from 500 GB to 1,000 GB.
   • BChange the volume type from gp2 to General Purpose SSD (gp3).
   • CChange the volume type from gp2 to Throughput Optimized HDD (st1).
   • DChange the volume type from gp2 to Provisioned IOPS SSD (io2).

   Show answer

   Answer: B

   Explanation

   B. Change the volume type from gp2 to General Purpose SSD (gp3). Explanation: The gp3 volume type is designed to provide baseline performance of 3,000 IOPS and a throughput of up to 125 MB/s. This aligns with the requirement to sustain 3,000 IOPS during nightly build tasks. gp3 volumes are a good fit for a wide range of transactional workloads and offer a more cost-effective solution compared to Provisioned IOPS SSD (io2) volumes.

   Source: Adapted from community discussion — LemonGremlin

   Next question

7. Question 337 · 475 in bank

   A company is running an application on a group of Amazon EC2 instances behind an Application Load Balancer. The EC2 instances run across three Availability Zones. The company needs to provide the customers with a maximum of two static IP addresses for their applications. How should a SysOps administrator meet these requirement?

   • AAdd AWS Global Accelerator in front of the Application Load Balancer.
   • BAdd an internal Network Load Balancer behind the Application Load Balancer.
   • CConfigure the Application Load Balancer in only two Availability Zones.
   • DCreate two Elastic IP addresses and assign them to the Application Load Balancer.

   Show answer

   Answer: A

   Explanation

   When you create an Application Load Balancer or Network Load Balancer in the AWS Management Console, you can optionally add an accelerator at the same time. Elastic Load Balancing and Global Accelerator work together to transparently add the accelerator for you. The accelerator is created in your account, with the load balancer as an endpoint. Using an accelerator provides static IP addresses and improves the availability and performance of your applications.

   Source: Adapted from community discussion — Learning4life

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 338 · 475 in bank

   A SysOps administrator receives an alert that a production Auto Scaling group has been scaled down to two Amazon EC2 instances. The Auto Scaling group was originally configured with a minimum capacity of three instances. However, the SysOps administrator confirms that the configuration now reflects a minimum capacity of two instances. Which AWS service will help identify who made the change?

   • AAWS Config
   • BAmazon Inspector
   • CAmazon Macie
   • DAmazon Cloud Watch Logs

   Show answer

   Answer: A

   Explanation

   AWS Config achieves this by calling the CloudTrail LookupEvents API. By selecting the link, AWS Config will redirect you to the CloudTrail event history. From the Amazon CloudTrail event you can get additional details including but not limited to who made changes to the resource and when. https://aws.amazon.com/blogs/mt/how-to-use-aws-config-and-cloudtrail-to-find-who-made-changes-to-a-resource/#:~:text=AWS%20Config%20achieves%20this%20by,to%20the%20resource%20and%20when.

   Source: Adapted from community discussion — nharaz

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 339 · 475 in bank

   A company wants to store sensitive financial data within Amazon S3 buckets. The company has a corporate policy that does not allow public read or write access to the buckets. A SysOps administrator must create a solution to automatically remove S3 permissions that allow public read or write access. Which AWS service should the SysOps administrator use to meet these requirements in the MOST operationally efficient manner?

   • AAWS Config
   • BAWS Security Hub
   • CAWS Trusted Advisor
   • DAmazon Inspector

   Show answer

   Answer: A

   Explanation

   AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It can be used to monitor and detect changes to S3 bucket policies that may introduce public read or write access.

   Source: Adapted from community discussion — LemonGremlin

   Next question

10. Question 340 · 475 in bank

    A SysOps administrator must create an IAM policy for a developer who needs access to specific AWS services. Based on the requirements, the SysOps administrator creates the following policy:

    

    Which actions does this policy allow? (Choose two.)

    • ACreate an AWS Storage Gateway.
    • BCreate an IAM role for an AWS Lambda function.
    • CDelete an Amazon Simple Queue Service (Amazon SQS) queue.
    • DDescribe AWS load balancers.
    • EInvoke an AWS Lambda function.

    Show answer

    Answer: E

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 331. 475 questions available.