SOA-C02 practice questions 421–430

1. Question 421 · 475 in bank

   A company hosts its website on Amazon EC2 instances behind an Application Load Balancer. The company manages its DNS with Amazon Route 53, and wants to point its domain's zone apex to the website. Which type of record should be used to meet these requirements?

   • AAn AAAA record for the domain's zone apex
   • BAn A record for the domain's zone apex
   • CA CNAME record for the domain's zone apex
   • DAn alias record for the domain's zone apex

   Show answer

   Answer: D

   Explanation

   D is the correct answer. The DNS protocol does not allow you to create a CNAME record for the top node of a DNS namespace, also known as the zone apex. For example, if you register the DNS name example.com, the zone apex is example.com. You cannot create a CNAME record for example.com, but you can create CNAME records for www.example.com, newproduct.example.com, and so on. Amazon Route 53 also supports alias records, which allow you to route queries to selected AWS resources, such as CloudFront distributions and Amazon S3 buckets. Aliases are similar in some ways to the CNAME record type; however, you can create an alias for the zone apex. For more information, see Choosing between alias and non-alias records. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html#CNAMEFormat

   Source: Adapted from community discussion — Rabbit117

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 422 · 475 in bank

   Select 2

   A SysOps administrator is investigating why a user has been unable to use RDP to connect over the internet from their home computer to a bastion server running on an Amazon EC2 Windows instance. Which of the following are possible causes of this issue? (Choose two.)

   • AA network ACL associated with the bastion's subnet is blocking the network traffic.
   • BThe instance does not have a private IP address.
   • CThe route table associated with the bastion's subnet does not have a route to the internet gateway.
   • DThe security group for the instance does not have an inbound rule on port 22.
   • EThe security group for the instance does not have an outbound rule on port 3389.

   Show answer

   Answer: AC

   Explanation

   The possible causes of this issue are: A. A network ACL associated with the bastion's subnet is blocking the network traffic. C. The route table associated with the bastion's subnet does not have a route to the internet gateway. E. The security group for the instance does not have an outbound rule on port 3389.

   Source: Adapted from community discussion — MrMLB

   References

   • AWS documentation

   Next question

3. Question 423 · 475 in bank

   A SysOps administrator is examining the following AWS CloudFormation template:

   

   Why will the stack creation fail?

   • AThe Outputs section of the CloudFormation template was omitted.
   • BThe Parameters section of the CloudFormation template was omitted.
   • CThe PrivateDnsName cannot be set from a CloudFormation template.
   • DThe VPC was not specified in the CloudFormation template.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

4. Question 424 · 475 in bank

   Select 2

   A new application runs on Amazon EC2 instances and accesses data in an Amazon RDS database instance. When fully deployed in production, the application fails. The database can be queried from a console on a bastion host. When looking at the web server logs, the following error is repeated multiple times: *** Error Establishing a Database Connection Which of the following may be causes of the connectivity problems? (Choose two.)

   • AThe security group for the database does not have the appropriate egress rule from the database to the web server.
   • BThe certificate used by the web server is not trusted by the RDS instance.
   • CThe security group for the database does not have the appropriate ingress rule from the web server to the database.
   • DThe port used by the application developer does not match the port specified in the RDS configuration.
   • EThe database is still being created and is not available for connectivity.

   Show answer

   Answer: CD

   Explanation

   C. The security group for the database does not have the appropriate ingress rule from the web server to the database. D. The port used by the application developer does not match the port specified in the RDS configuration.

   Source: Adapted from community discussion — Passexam4sure_com

   Next question

5. Question 425 · 475 in bank

   A compliance team requires all administrator passwords for Amazon RDS DB instances to be changed at least annually. Which solution meets this requirement in the MOST operationally efficient manner?

   • AStore the database credentials in AWS Secrets Manager. Configure automatic rotation for the secret every 365 days.
   • BStore the database credentials as a parameter in the RDS parameter group. Create a database trigger to rotate the password every 365 days.
   • CStore the database credentials in a private Amazon S3 bucket. Schedule an AWS Lambda function to generate a new set of credentials every 365 days.
   • DStore the database credentials in AWS Systems Manager Parameter Store as a secure string parameter. Configure automatic rotation for the parameter every 365 days.

   Show answer

   Answer: A

   Explanation

   To implement password rotation lifecycles, use AWS Secrets Manager. You can rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle using Secrets Manager. For more information, see What is AWS Secrets Manager? in the AWS Secrets Manager User Guide.

   Source: Adapted from community discussion — FKZ

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 426 · 475 in bank

   A SysOps administrator is responsible for managing a fleet of Amazon EC2 instances. These EC2 instances upload build artifacts to a third-party service. The third-party service recently implemented a strict IP allow list that requires all build uploads to come from a single IP address. What change should the systems administrator make to the existing build fleet to comply with this new requirement?

   • AMove all of the EC2 instances behind a NAT gateway and provide the gateway IP address to the service.
   • BMove all of the EC2 instances behind an internet gateway and provide the gateway IP address to the service.
   • CMove all of the EC2 instances into a single Availability Zone and provide the Availability Zone IP address to the service.
   • DMove all of the EC2 instances to a peered VPC and provide the VPC IP address to the service.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

7. Question 427 · 475 in bank

   A company uses an Amazon CloudFront distribution to deliver its website. Traffic logs for the website must be centrally stored, and all data must be encrypted at rest. Which solution will meet these requirements?

   • ACreate an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with internet access and server-side encryption that uses the default AWS managed customer master key (CMK). Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination.
   • BCreate an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with VPC access and server-side encryption that uses AES-256. Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination.
   • CCreate an Amazon S3 bucket that is configured with default server-side encryption that uses AES-256. Configure CloudFront to use the S3 bucket as a log destination.
   • DCreate an Amazon S3 bucket that is configured with no default encryption. Enable encryption in the CloudFront distribution, and use the S3 bucket as a log destination.

   Show answer

   Answer: C

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 428 · 475 in bank

   An organization created an Amazon Elastic File System (Amazon EFS) volume with a file system ID of fs-85ba41fc, and it is actively used by 10 Amazon EC2 hosts. The organization has become concerned that the file system is not encrypted. How can this be resolved?

   • AEnable encryption on each host's connection to the Amazon EFS volume. Each connection must be recreated for encryption to take effect.
   • BEnable encryption on the existing EFS volume by using the AWS Command Line Interface.
   • CEnable encryption on each host's local drive. Restart each host to encrypt the drive.
   • DEnable encryption on a newly created volume and copy all data from the original volume. Reconnect each host to the new volume.

   Show answer

   Answer: D

   Explanation

   D is correct. https://docs.aws.amazon.com/efs/latest/ug/encryption.html Amazon EFS supports two forms of encryption for file systems, encryption of data in transit and encryption at rest. You can enable encryption of data at rest when creating an Amazon EFS file system. You can enable encryption of data in transit when you mount the file system.

   Source: Adapted from community discussion — jkwek

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 429 · 475 in bank

   A company uses an AWS Service Catalog portfolio to create and manage resources. A SysOps administrator must create a replica of the company's existing AWS infrastructure in a new AWS account. What is the MOST operationally efficient way to meet this requirement?

   • ACreate an AWS CloudFormation template to use the AWS Service Catalog portfolio in the new AWS account.
   • BIn the new AWS account, manually create an AWS Service Catalog portfolio that duplicates the original portfolio.
   • CRun an AWS Lambda function to create a new AWS Service Catalog portfolio based on the output of the DescribePortfolio API operation.
   • DShare the AWS Service Catalog portfolio with the new AWS account. Import the portfolio into the new AWS account.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

10. Question 430 · 475 in bank

    A SysOps administrator must manage the security of an AWS account. Recently, an IAM user's access key was mistakenly uploaded to a public code repository. The SysOps administrator must identify anything that was changed by using this access key. How should the SysOps administrator meet these requirements?

    • ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule to send all IAM events to an AWS Lambda function for analysis.
    • BQuery Amazon EC2 logs by using Amazon CloudWatch Logs Insights for all events initiated with the compromised access key within the suspected timeframe.
    • CSearch AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe.
    • DSearch VPC Flow Logs for all events initiated with the compromised access key within the suspected timeframe.

    Show answer

    Answer: C

    Explanation

    C "You can troubleshoot operational and security incidents over the past 90 days in the CloudTrail console by viewing Event history." https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html

    Source: Adapted from community discussion — kati2k22cz

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 421. 475 questions available.