SOA-C02 practice questions 371–380

1. Question 371 · 475 in bank

   A company has an application that uses an Amazon RDS for MariaDB Multi-AZ database. The application becomes unavailable for several minutes every time the database experiences a failover during a planned maintenance event. What should a SysOps administrator do to reduce the downtime of the application during failover?

   • ACreate an RDS for MariaDB DB cluster that has multiple writer instances. Configure the application to retry failed queries on another primary node during maintenance events.
   • BConfigure the RDS maintenance window settings to pool connections while a failover is in process.
   • CConfigure an Amazon ElastiCache write-through cache for the database. Configure the application to connect to the cache instead of directly to the database.
   • DCreate an RDS proxy that is associated with the database. Configure the application to connect to the proxy instead of directly to the database.

   Show answer

   Answer: D

   Explanation

   When failovers occur, RDS Proxy routes requests directly to the new database instance. This reduces failover times for Aurora and RDS databases by up to 66%. RDS Proxy also supports Multi-AZ with two readable standbys for typically under 35 second failovers, 2x improved write latency, added read capacity, and reduce minor version upgrade downtime to typically under 1 second. https://aws.amazon.com/rds/proxy/

   Source: Adapted from community discussion — tgv

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 372 · 475 in bank

   Select 2

   A SysOps administrator has noticed millions of LIST requests on an Amazon S3 bucket. Which services or features can the administrator use to investigate where the requests are coming from? (Choose two.)

   • AAWS CloudTrail data events
   • BAmazon EventBridge
   • CAWS Health Dashboard
   • DAmazon S3 server access logging
   • EAWS Trusted Advisor

   Show answer

   Answer: AD

   Explanation

   A. AWS CloudTrail data events: AWS CloudTrail records API activity within your AWS account, including S3 bucket access. By analyzing CloudTrail logs, the administrator can identify the source of the LIST requests. D. Amazon S3 server access logging: Enabling server access logging on the S3 bucket allows the administrator to capture detailed records for every request made to the bucket. This includes the requester's IP address, which can help identify where the requests are originating from.

   Source: Adapted from community discussion — tgv

   References

   • AWS documentation

   Next question

3. Question 373 · 475 in bank

   A SysOps administrator configures VPC flow logs to publish to Amazon CloudWatch Logs. The SysOps administrator reviews the logs in CloudWatch Logs and notices less traffic than expected. After the SysOps administrator compares the VPC flow logs to logs that were captured on premises, the SysOps administrator believes that the VPC flow logs are incomplete. Which of the following is a possible reason for the difference in traffic?

   • ACloudWatch Logs throttling has been applied.
   • BThe CloudWatch IAM role does not have a trust relationship with the VPC flow logs service.
   • CThe VPC flow log is still in the process of being created.
   • DVPC flow logs cannot capture traffic from on-premises servers to a VPC.

   Show answer

   Answer: D

   Explanation

   VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. In this case the logs cannot capture what happens on-prem.

   Source: Adapted from community discussion — tgv

   Next question

4. Question 374 · 475 in bank

   A company's SysOps administrator uses AWS IAM Identity Center (AWS Single Sign-On) to connect to an Active Directory. The SysOps administrator creates a new account that all the company's users need to access. The SysOps administrator uses the Active Directory Domain Users group for permissions to the new account because all users are already members of the group. When users try to log in, their access is denied. Which action will resolve this access issue?

   • ACreate a new group. Add users to the new group to provide access.
   • BCorrect the time on the Active Directory domain controllers.
   • CRemove the account. Re-add the account to the organization that is integrated with IAM Identity Center.
   • DCorrect the permissions on the Active Directory group so that IAM Identity Center has read access.

   Show answer

   Answer: D

   Explanation

   You need to give IAM Identity Center access to read the AD group so it can logically identify users who are members and grant them access to the new account.

   Source: Adapted from community discussion — tgv

   Next question

5. Question 375 · 475 in bank

   A SysOps administrator has an Amazon S3 website and wants to restrict access to a single Amazon CloudFront distribution. Visitors to the website should not be able to circumvent CloudFront or view the S3 website directly from the bucket. Which AWS service or feature will meet these requirements?

   • AS3 bucket ACL
   • BAWS Firewall Manager
   • CAmazon Route 53 private hosted zone
   • DOrigin access identity (OAI)

   Show answer

   Answer: D

   Explanation

   You can restrict access to a S3 bucket from a single CloudFront distribution by using a origin access identity (OAI). This way, the bucket and its object can only be accessed through that OAI.

   Source: Adapted from community discussion — tgv

   References

   • AWS documentation

   Next question

6. Question 376 · 475 in bank

   A SysOps administrator is responsible for a large fleet of Amazon EC2 instances and must know whether any instances will be affected by upcoming hardware maintenance. Which option would provide this information with the LEAST administrative overhead?

   • ADeploy a third-party monitoring solution to provide real-time EC2 instance monitoring.
   • BList any instances with failed system status checks using the AWS Management Console.
   • CMonitor AWS CloudTrail for StopInstances API calls.
   • DReview the AWS Personal Health Dashboard.

   Show answer

   Answer: D

   Explanation

   If a hardware malfunction occurs, then Amazon EC2 tags the specific hardware as faulty. Any instances that are running on the hypervisor of the faulty hardware are moved to healthy hardware. During the transition to new hardware, the Amazon EBS-backed instances are stopped and instance store-backed instances are terminated. Amazon EC2 sends a notification through email and to your Personal Health Dashboard informing you of the hardware degradation and of the upcoming instance stop or termination. https://aws.amazon.com/premiumsupport/knowledge-center/ec2-linux-degraded-hardware/

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 377 · 475 in bank

   A global company wants to allow anyone in the world to upload videos from a mobile phone. The company's mobile app uploads the videos across the public internet to an Amazon S3 bucket in the us-east-1 Region for further processing. Videos that users upload from locations that are distant from us-east-1 have slower upload speeds than videos that users upload from close to us-east-1. In many cases, the slow uploads cause users from the distant locations to cancel their uploads. Which solution will improve the upload speeds for the users from distant locations?

   • AEnable S3 Transfer Acceleration on the S3 bucket. Change the mobile app to use the S3 Transfer Acceleration endpoint for uploads.
   • BCreate an S3 access point for the S3 bucket in several AWS Regions across the world. Change the mobile app to use the S3 access point endpoint for uploads.
   • CUse S3 Select on the S3 bucket. Change the mobile app to use the S3 Select global endpoint for uploads. D. Create new public Network Load Balancers (NLBs) in several AWS Regions across the world. Specify the S3 bucket as the target of the NLBs. Change the mobile app to use the closest NLB for uploads.

   Show answer

   Answer: A

   Explanation

   You can enable S3 Transfer Acceleration if users from distant locations have slower upload speeds and redirect the mobile app to use the new endpoint.

   Source: Adapted from community discussion — tgv

   Next question

8. Question 378 · 475 in bank

   A company is using AWS Certificate Manager (ACM) to manage public SSL/TLS certificates. A SysOps administrator needs to send an email notification when a certificate has less than 14 days until expiration. Which solution will meet this requirement with the LEAST operational overhead?

   • ACreate an Amazon CloudWatch custom metric to monitor certificate expiration for all ACM certificates. Create an Amazon EventBridge rule that has an event source of aws.cloudwatch. Configure the rule to send an event to a target Amazon Simple Notification Service (Amazon SNS) topic if the DaysToExpiry metric is less than 14. Subscribe the appropriate email addresses to the SNS topic.
   • BCreate an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry metric for all ACM certificates. Configure the rule to send an event to a target Amazon Simple Notification Service (Amazon SNS) topic if DaysToExpiry is less than 14. Subscribe the appropriate email addresses to the SNS topic.
   • CCreate an Amazon CloudWatch dashboard that displays the DaysToExpiry metric for all ACM certificates. If DaysToExpiry is less than 14, send an email message to the appropriate email addresses. Send the email message by running a predefined CLI command to publish to an Amazon Simple Notification Service (Amazon SNS) topic.
   • DCreate an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry metric for all ACM certificates. Configure a target SMS identity that uses a predefined email template. Configure the rule to send an event to the target SMS identity if DaysToExpiry is less than 14.

   Show answer

   Answer: B

   Explanation

   There is no need for a CloudWatch alarm. There is an ApproachingExpiration ACM sample event in EventBridge: { "version": "0", "id": "9c95e8e4-96a4-ef3f-b739-b6aa5b193afb", "detail-type": "ACM Certificate Approaching Expiration", "source": "aws.acm", "account": "123456789012", "time": "2020-09-30T06:51:08Z", "region": "us-east-1", "resources": ["arn:aws:acm:us-east-1:123456789012:certificate/61f50cd4-45b9-4259-b049-d0a53682fa4b"], "detail": { "DaysToExpiry": 31, "CommonName": "example.com" } }

   Source: Adapted from community discussion — tgv

   Next question

9. Question 379 · 475 in bank

   A SysOps administrator created an AWS CloudFormation template that provisions an Amazon EventBridge rule that invokes an AWS Lambda function. The Lambda function is designed to write event details to an Amazon CloudWatch log group. The function has permissions to write events to Amazon CloudWatch Logs. However, the SysOps administrator discovered that the Lambda function is not running. How should the SysOps administrator resolve the problem?

   • AUpdate the CloudFormation stack to include an AWS::IAM::Role resource with the required IAM permissions for EventBridge to invoke the function. Assign the role to the EventBridge rule.
   • BUpdate the CloudFormation stack to include an AWS::IAM::Role resource with the required IAM permissions for the function. Assign the role as the function execution role.
   • CUpdate the CloudFormation stack with an AWS::Lambda::Permission resource to ensure events.amazonaws.com has permissions to invoke the function.
   • DUpdate the CloudFormation stack with an AWS::Lambda::Permission resource to ensure lambda.amazonaws.com has permissions to invoke the function.

   Show answer

   Answer: C

   Explanation

   Here the issue is that the Lambda function is not running meaning that the function cannot be invoked. Well, EventBridge should invoke the function so the CloudFormation template would need an AWS::Lambda::Permission resource which ensures that events.amazonaws.com (the service principal for EventBridge) has the necessary permissions to invoke the Lambda function.

   Source: Adapted from community discussion — tgv

   References

   • repost.aws documentation

   Next question

10. Question 380 · 475 in bank

    A company has an Amazon EC2 instance that has high CPU utilization. The EC2 instance is a t3.large instance and is running a test web application. The company discovers that the web application would operate better on a compute optimized large instance. What should a SysOps administrator do to make this change?

    • AMigrate the EC2 instance to a compute optimized instance by using AWS VM Import/Export.
    • BEnable hibernation on the EC2 instance. Change the instance type to a compute optimized instance. Disable hibernation on the EC2 instance.
    • CStop the EC2 instance. Change the instance type to a compute optimized instance. Start the EC2 instance.
    • DChange the instance type to a compute optimized instance while the EC2 instance is running.

    Show answer

    Answer: C

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 371. 475 questions available.