AWS Certified SysOps Administrator – Associate475 questions across 48 pages are complete and free, with no account or card.
475 questions in this bank
Free access · progress saved on this device
A company runs a retail website on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The company must secure traffic to the website over an HTTPS connection. Which combination of actions should a SysOps administrator take to meet these requirements? (Choose two.)
Answer: BD
A company must ensure that any objects uploaded to an S3 bucket are encrypted. Which of the following actions will meet this requirement? (Choose two.)
Answer: CE
Its encrypted at the time of writing to disk. :). Ensures all objects are encrypted when data is stored in S3, if using Amazon S3 default encryption ie server side encryption. Looking at an extension of your link : https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it.
Source: Adapted from community discussion — Finger41
SIMULATION - Instructions - If the copy-paste functionality is not working in your environment, refer to the instructions file on the VM desktop and use Ctrl+C, Ctrl+V or Command-C, Command-V. Configure Amazon EventBridge to meet the following requirements. 1. Use the us-east-2 Region for all resources. 2. Unless specified below, use the default configuration settings. 3. Use your own resource naming unless a resource name is specified below. 4. Ensure all Amazon EC2 events in the default event bus are replayable for the past 45 days. 5. Create a rule named RunFunction to send the exact message {"name":"example") every 15 minutes to an existing AWS Lambda function named LogEventFunction 6. Create a rule named SpotWarning to send a notification to a new standard Amazon SNS topic named TopicEvents whenever an Amazon EC2 Spot Instance is interrupted. Do NOT create any topic subscriptions. The notification must match the following structure: Input path: {`instance`:`detail.instance-id} Input template: `The EC2 Spot Instance <instance> has been interrupted.` Important: Click the Next button to complete this lab and continue to the next lab. Once you click the Next button, you will NOT be able to return to this lab.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
High level notes based on the provided answers: #6 Step 1 Go to SNS -> Topics -> Create Topic In Type, select Standard. In Name, input TopicEvents Step 2 Go to EventBridge -> Rules. In Name, input SpotWarning In Rule Type, select Rule with an event pattern. In Sample events, input EC2 Spot Instance Interruption Warning? In Event Pattern, AWS Service, select EC2. In Event Type, select EC2 Spot Instance Interruption Warning. In Configure Target Input, select Input Transformer. Click Configure Input Transformer. In Sample events, select EC2 Spot Instance Interruption Warning? In Target Input Transformer -> Input Path, enter {“instance”:”$.detail.instance-id”} In Target Input Transformer -> Template, enter “The EC2 Spot Instance has been interrupted.”
Source: Adapted from community discussion — noahsark
A company has a stateful, long-running workload on a single xlarge general purpose Amazon EC2 On-Demand Instance Metrics show that the service is always using 80% of its available memory and 40% of its available CPU. A SysOps administrator must reduce the cost of the service without negatively affecting performance. Which change in instance type will meet these requirements?
Answer: B
Questions states - reduce the cost of the service without negatively affecting performance. Using a Spot Instance may affect performance, if it terminates with only a 2 min warning. The stats state the load is Memory intensive, so B looks to be most suitable.
Source: Adapted from community discussion — CiCa560
A company asks a SysOps administrator to ensure that AWS CloudTrail files are not tampered with after they are created. Currently, the company uses AWS Identity and Access Management (IAM) to restrict access to specific trails. The company's security team needs the ability to trace the integrity of each file. What is the MOST operationally efficient solution that meets these requirements?
Answer: D
D - "When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file. Validated log files are invaluable in security and forensic investigations" https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
Source: Adapted from community discussion — Finger41
When the AWS Cloud infrastructure experiences an event that may impact an organization, which AWS service can be used to see which of the organization's resources are affected?
Answer: C
"determine which of the business's resources are impacted" PHD can provide ResourceIDs, SHD doesn't. For every SHD there is a corresponding PHD copy but not the other way around.
Source: Adapted from community discussion — umrzyj
A company is using an AWS KMS customer master key (CMK) with imported key material. The company references the CMK by its alias in the Java application to encrypt data. The CMK must be rotated every 6 months. What is the process to rotate the key?
Answer: B
If you choose to import keys to AWS KMS or asymmetric keys or use a custom key store, you can manually rotate them by creating a new KMS key and mapping an existing key alias from the old KMS key to the new KMS key. https://aws.amazon.com/kms/faqs/
Source: Adapted from community discussion — princajen
The security team is concerned because the number of AWS Identity and Access Management (IAM) policies being used in the environment is increasing. The team tasked a SysOps administrator to report on the current number of IAM policies in use and the total available IAM policies. Which AWS service should the administrator use to check how current IAM policy usage compares to current service limits?
Answer: A
Correct Answer: A AWS Trusted Advisor provides insights into service limits and resource usage, including IAM policy limits. It offers a specific check that reports on service usage and compares it against the current service limits, allowing the administrator to see how close they are to reaching the maximum number of IAM policies. Other Options: Option B (Amazon Inspector): Amazon Inspector is a security assessment tool that focuses on identifying vulnerabilities in EC2 instances and applications, not on IAM policies or service limits. Option C (AWS Config): AWS Config tracks configuration changes to AWS resources and can monitor policy compliance, but it does not provide service limit checks. Option D (AWS Organizations): AWS Organizations is used for managing multiple AWS accounts and enabling consolidated billing, but it does not monitor service limits for IAM policies.
Source: Adapted from community discussion — gehadg
A SysOps administrator is trying to set up an Amazon Route 53 domain name to route traffic to a website hosted on Amazon S3. The domain name of the website is www.example.com and the S3 bucket name DOC-EXAMPLE-BUCKET. After the record set is set up in Route 53, the domain name www.anycompany.com does not seem to work, and the static website is not displayed in the browser. Which of the following is a cause of this?
Answer: D
Check S3 website endpoint names Make sure that the name of the resource record for your Amazon S3 website endpoint matches the name of your Amazon S3 bucket. Also, configure your bucket for website hosting. For example, if your bucket's name is AWSDOC-EXAMPLE-BUCKET, the record name must also be AWSDOC-EXAMPLE-BUCKET. https://aws.amazon.com/premiumsupport/knowledge-center/route-53-no-targets/
Source: Adapted from community discussion — princajen
A SysOps administrator has used AWS CloudFormation to deploy a serverless application into a production VPC. The application consists of an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway API. The SysOps administrator must delete the AWS CloudFormation stack without deleting the DynamoDB table. Which action should the SysOps administrator take before deleting the AWS CloudFormation stack?
Answer: A
To keep a resource when its stack is deleted, specify Retain for that resource. You can use Retain for any resource. For example, you can retain a nested stack, Amazon S3 bucket, or EC2 instance so that you can continue to use or modify those resources after you delete their stacks. Exception: The default policy is Snapshot for AWS::RDS::DBCluster resources and for AWS::RDS::DBInstance resources that don't specify the DBClusterIdentifier property.
Source: Adapted from community discussion — Christina666
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SOA-C02 practice, question 431. 475 questions available.
Version 1.0.0. How we source questions