SOA-C02 practice questions 341–350

1. Question 341 · 475 in bank

   A SysOps administrator is re-architecting an application. The SysOps administrator has moved the database from a public subnet, where the database used a public endpoint, into a private subnet to restrict access from the public network. After this change, an AWS Lambda function that requires read access to the database cannot connect to the database. The SysOps administrator must resolve this issue without compromising security. Which solution meets these requirements?

   • ACreate an AWS PrivateLink interface endpoint for the Lambda function. Connect to the database using its private endpoint.
   • BConnect the Lambda function to the database VPC. Connect to the database using its private endpoint.
   • CAttach an IAM role to the Lambda function with read permissions to the database.
   • DMove the database to a public subnet. Use security groups for secure access.

   Show answer

   Answer: A

   Explanation

   PrivateLink allows you to privately access services hosted on AWS in a scalable and secure manner. By creating an interface endpoint for the Lambda function, you can establish a private connection between the Lambda function and the RDS database without exposing it to the public internet.

   Source: Adapted from community discussion — Learning4life

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 342 · 475 in bank

   Select 2

   Users are reporting consistent forced logouts from a stateful web application. The logouts occur before the expiration of a 15-minute application logout timer. The web application is hosted on Amazon EC2 instances that are in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) that has a single target group. The ALB is configured as the origin in an Amazon CloudFront distribution. Session affinity (sticky sessions) is already enabled on the ALB target group and uses duration-based cookies. The web application generates its own application cookie. Which combination of actions should a SysOps administrator take to resolve the logout problem? (Choose two.)

   • AChange to the least outstanding requests algorithm on the ALB target group.
   • BConfigure cookie forwarding in the CloudFront distribution's cache behavior settings.
   • CConfigure the duration-based cookie to be named AWSALB.
   • DConfigure the ALB to use the expiration cookie header.
   • EChange the ALB to use application-based cookies.

   Show answer

   Answer: BE

   Explanation

   As the application is generating its own cookies, we don't need the duration-based cookie generated by the load balancer. So for me its forwarding cookies and allowing application-based cookies. BE

   Source: Adapted from community discussion — Kipalom

   Next question

3. Question 343 · 475 in bank

   A company's social media application has strict data residency requirements. The company wants to use Amazon Route 53 to provide the application with DNS services. A SysOps administrator must implement a solution that routes requests to a defined list of AWS Regions. The routing must be based on the user's location. Which solution will meet these requirements?

   • AConfigure a Route 53 latency routing policy.
   • BConfigure a Route 53 multivalue answer routing policy.
   • CConfigure a Route 53 geolocation routing policy.
   • DConfigure a Route 53 IP-based routing policy.

   Show answer

   Answer: C

   Explanation

   C: Configure a Route 53 geolocation routing policy. Explanation: Route 53 geolocation routing policy, allows you to route traffic based on the geographic location of your users. With geolocation routing, you can specify different AWS Regions for different geographic locations, ensuring that users are directed to the nearest Region based on their location. This meets the company's data residency requirements by routing users to the AWS Region that aligns with their location. You can create multiple geolocation records for different geographic regions and specify the appropriate AWS Region for each. Route 53 uses the geographic location of the user's DNS resolver to determine the appropriate response to return. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy-geo.html

   Source: Adapted from community discussion — joshnort

   References

   • AWS documentation

   Next question

4. Question 344 · 475 in bank

   A SysOps administrator has created an AWS Service Catalog portfolio and has shared the portfolio with a second AWS account in the company. The second account is controlled by a different administrator. Which action will the administrator of the second account be able to perform?

   • AAdd a product from the imported portfolio to a local portfolio.
   • BAdd new products to the imported portfolio.
   • CChange the launch role for the products contained in the imported portfolio.
   • DCustomize the products in the imported portfolio.

   Show answer

   Answer: A

   Explanation

   When you share a portfolio using account-to-account sharing or AWS Organizations, you allow an AWS Service Catalog administrator of another AWS account to import your portfolio into his or her account and distribute the products to end users in that account. https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing.html

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation

   Next question

5. Question 345 · 475 in bank

   A company has a cluster of Linux Amazon EC2 Spot Instances that read many files from and write many files to attached Amazon Elastic Block Store (Amazon EBS) volumes. The EC2 instances are frequently started and stopped. As part of the process when an EC2 instance starts, an EBS volume is restored from a snapshot. EBS volumes that are restored from snapshots are experiencing initial performance that is lower than expected. The company's workload needs almost all the provisioned IOPS on the attached EBS volumes. The EC2 instances are unable to support the workload when the performance of the EBS volumes is too low. A SysOps administrator must implement a solution to ensure that the EBS volumes provide the expected performance when they are restored from snapshots. Which solution will meet these requirements?

   • AConfigure fast snapshot restore (FSR) on the snapshots that are used.
   • BRestore each snapshot onto an unencrypted EBS volume. Encrypt the EBS volume when the performance stabilizes.
   • CFormat the EBS volumes as XFS file systems before restoring the snapshots.
   • DIncrease the Linux read-ahead buffer to 1 MiB.

   Show answer

   Answer: A

   Explanation

   The issue described here is a common one with Amazon EBS volumes restored from snapshots. When an EBS volume is created from a snapshot, the data isn't fully loaded into the volume until it is accessed for the first time. This means that the initial I/O performance of the volume can be lower than expected, which can be problematic for high-performance workloads. To resolve this issue, the most suitable solution would be: A. Configure fast snapshot restore (FSR) on the snapshots that are used: Fast Snapshot Restore (FSR) immediately enables a snapshot's data to be fully realized on the volume, eliminating the need for the lazy loading of data.

   Source: Adapted from community discussion — ahmedsamosam

   References

   • AWS documentation

   Next question

6. Question 346 · 475 in bank

   A company recently deployed an application in production. The production environment currently runs on a single Amazon EC2 instance that hosts the application's web application and a MariaDB database. Company policy states that all IT production environments must be highly available. What should a SysOps administrator do to meet this requirement?

   • AMigrate the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance. Run the application on EC2 instances that are in an Auto Scaling group that extends across multiple Availability Zones. Place the EC2 instances behind a load balancer.
   • BMigrate the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance. Use AWS Application Migration Service to convert the application into an AWS Lambda function. Specify the Multi-AZ option for the Lambda function.
   • CCopy the database to a different EC2 instance in a different Availability Zone. Use AWS Backup to create Amazon Machine Images (AMIs) of the application EC2 instance and the database EC2 instance. Create an AWS Lambda function that performs health checks every minute. In case of failure, configure the Lambda function to launch a new EC2 instance from the AMIs that AWS Backup created.
   • DMigrate the database to a different EC2 instance. Place the application EC2 instance in an Auto Scaling group that extends across multiple Availability Zones. Create an Amazon Machine Image (AMI) from the database EC2 instance. Use the AMI to launch a second database EC2 instance in a different Availability Zone. Put the second database EC2 instance in the stopped state. Use the second database EC2 instance as a standby.

   Show answer

   Answer: A

   Explanation

   I'd vote A. Migrate the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance. Run the application on EC2 instances that are in an Auto Scaling group that extends across multiple Availability Zones. Place the EC2 instances behind a load balancer.

   Source: Adapted from community discussion — LemonGremlin

   Next question

7. Question 347 · 475 in bank

   A company is running workloads on premises and on AWS. A SysOps administrator needs to automate tasks across all servers on premises by using AWS services. The SysOps administrator must not install long-term credentials on the on-premises servers. What should the SysOps administrator do to meet these requirements?

   • ACreate an IAM role and instance profile that include AWS Systems Manager permissions. Attach the role to the on-premises servers.
   • BCreate a managed-instance activation in AWS Systems Manager. Install the Systems Manager Agent (SSM Agent) on the on-premises servers. Register the servers with the activation code and ID from the instance activation.
   • CCreate an AWS managed IAM policy that includes the appropriate AWS Systems Manager permissions. Download the IAM policy to the on-premises servers.
   • DCreate an IAM user and an access key. Log on to the on-premises servers and install the AWS CLI. Configure the access key in the AWS credentials file after the AWS CLI is successfully installed.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

8. Question 348 · 475 in bank

   A company has deployed an application on AWS. The application runs on a fleet of Linux Amazon EC2 instances that are in an Auto Scaling group. The Auto Scaling group is configured to use launch templates. The launch templates launch Amazon Elastic Block Store (Amazon EBS) backed EC2 instances that use General Purpose SSD (gp3) EBS volumes for primary storage. A SysOps administrator needs to implement a solution to ensure that all the EC2 instances can share the same underlying files. The solution also must ensure that the data is consistent. Which solution will meet these requirements?

   • ACreate an Amazon Elastic File System (Amazon EFS) file system. Create a new launch template version that includes user data that mounts the EFS file system. Update the Auto Scaling group to use the new launch template version to cycle in newer EC2 instances and to terminate the older EC2 instances.
   • BEnable Multi-Attach on the EBS volumes. Create a new launch template version that includes user data that mounts the EBS volume. Update the Auto Scaling group to use the new template version to cycle in newer EC2 instances and to terminate the older EC2 instances.
   • CCreate a cron job that synchronizes the data between the EBS volumes for all the EC2 instances in the Auto Scaling group. Create a lifecycle hook during instance launch to configure the cron job on all the EC2 instances. Rotate out the older EC2 instances.
   • DCreate a new launch template version that creates an Amazon Elastic File System (Amazon EFS) file system. Update the Auto Scaling group to use the new template version to cycle in newer EC2 instances and to terminate the older EC2 instances.

   Show answer

   Answer: A

   Explanation

   Please let me know why this is not A A. Create an Amazon Elastic File System (Amazon EFS) file system. Create a new launch template version that includes user data that mounts the EFS file system. Update the Auto Scaling group to use the new launch template version to cycle in newer EC2 instances and to terminate the older EC2 instances.

   Source: Adapted from community discussion — LemonGremlin

   Next question

9. Question 349 · 475 in bank

   A company has 50 AWS accounts and wants to create an identical Amazon VPC in each account. Any changes the company makes to the VPCs in the future must be implemented on every VPC. What is the MOST operationally efficient method to deploy and update the VPCs in each account?

   • ACreate an AWS CloudFormation template that defines the VPC. Sign in to the AWS Management Console under each account. Create a stack from the template.
   • BCreate a shell script that configures the VPC using the AWS CLI. Provide a list of accounts to the shell script from a text file. Create the VPC in every account in the list.
   • CCreate an AWS Lambda function that configures the VPStore the account information in Amazon DynamoDB. Grant Lambda access to the DynamoDB table. Create the VPC in every account in the list.
   • DCreate an AWS CloudFormation template that defines the VPC. Create an AWS CloudFormation StackSet based on the template. Deploy the template to all accounts using the stack set.

   Show answer

   Answer: D

   Explanation

   The MOST operationally efficient method to deploy and update identical Amazon VPCs in multiple AWS accounts is: D. Create an AWS CloudFormation template that defines the VPC. Create an AWS CloudFormation StackSet based on the template. Deploy the template to all accounts using the stack set.

   Source: Adapted from community discussion — LemonGremlin

   References

   • AWS documentation

   Next question

10. Question 350 · 475 in bank

    A company hosts a web application on an Amazon EC2 instance in a production VPC. Client connections to the application are failing. A SysOps administrator inspects the VPC flow logs and finds the following entry:

    

    What is a possible cause of these failed connections?

    • AA security group deny rule is blocking traffic on port 443.
    • BThe EC2 instance is shut down.
    • CThe network ACL is blocking HTTPS traffic.
    • DThe VPC has no internet gateway attached.

    Show answer

    Answer: C

    Explanation

    In accordingly to the document https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-accepted-rejected is reported that: "If your network ACL permits outbound ICMP traffic, the flow log displays two ACCEPT records (one for the originating ping and one for the response ping). If your security group denies inbound ICMP traffic, the flow log displays a single REJECT record, because the traffic was not permitted to reach your instance." So in our case we have a sigle REJECT record then the problem is related to security group the not permit the traffic on 443 port. For me Answer is A

    Source: Adapted from community discussion — 6022a06

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 341. 475 questions available.