SOA-C02 practice questions 451–460

1. Question 451 · 475 in bank

   A company runs an application that hosts critical data for several clients. The company uses AWS CloudTrail to track user activities on various AWS resources. To meet new security requirements, the company needs to protect the CloudTrail log files from being modified, deleted, or forged. Which solution will meet these requirement?

   • AEnable CloudTrail log file integrity validation.
   • BUse Amazon S3 MFA Delete on the S3 bucket where the CloudTrail log files are stored.
   • CUse Amazon S3 Versioning to keep all versions of the CloudTrail log files.
   • DUse AWS Key Management Service (AWS KMS) security keys to secure the CloudTrail log files.

   Show answer

   Answer: A

   Explanation

   The answer is A! Enable CloudTrail log file integrity Validated log files are especially valuable in security and forensic investigations. For example, a validated log file enables you to assert positively that the log file itself has not changed, or that particular user credentials performed specific API activity. The CloudTrail log file integrity validation process also lets you know if a log file has been deleted or changed, or assert positively that no log files were delivered to your account during a given period of time. CloudTrail log file integrity validation uses industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally unfeasible to modify, delete or forge CloudTrail log files without detection. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 452 · 475 in bank

   A global company operates out of five AWS Regions. A SysOps administrator wants to identify all the company's tagged and untagged Amazon EC2 instances. The company requires the output to display the instance ID and tags. What is the MOST operationally efficient way for the SysOps administrator to meet these requirements?

   • ACreate a tag-based resource group in AWS Resource Groups.
   • BUse AWS Trusted Advisor. Export the EC2 On-Demand Instances check results from Trusted Advisor.
   • CUse Cost Explorer. Choose a service type of EC2-Instances, and group by Resource.
   • DUse Tag Editor in AWS Resource Groups. Select all Regions, and choose a resource type of AWS::EC2::Instance.

   Show answer

   Answer: D

   Explanation

   With Tag Editor, you build a query to find resources in one or more AWS Regions that are available for tagging. You can choose up to 20 individual resource types, or build a query on All resource types. Your query can include resources that already have tags, or resources that have no tags. https://docs.aws.amazon.com/ARG/latest/userguide/find-resources-to-tag.html

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation

   Next question

3. Question 453 · 475 in bank

   A company needs to upload gigabytes of files every day. The company need to achieve higher throughput and upload speeds to Amazon S3. Which action should a SysOps administrator take to meet this requirement?

   • ACreate an Amazon CloudFront distribution with the GET HTTP method allowed and the S3 bucket as an origin.
   • BCreate an Amazon ElastiCache cluster and enable caching for the S3 bucket.
   • CSet up AWS Global Accelerator and configure it with the S3 bucket.
   • DEnable S3 Transfer Acceleration and use the acceleration endpoint when uploading files.

   Show answer

   Answer: D

   Explanation

   why not C : C. AWS Global Accelerator is used to improve the availability and performance of applications for globally distributed users, but it doesn't directly impact upload speeds to S3.

   Source: Adapted from community discussion — jipark

   References

   • AWS documentation

   Next question

4. Question 454 · 475 in bank

   A company is running a serverless application on AWS Lambda. The application stores data in an Amazon RDS for MySQL DB instance. Usage has steadily increased, and recently there have been numerous "too many connections" errors when the Lambda function attempts to connect to the database. The company already has configured the database to use the maximum max_connections value that is possible. What should a SysOps administrator do to resolve these errors?

   • ACreate a read replica of the database. Use Amazon Route 53 to create a weighted DNS record that contains both databases.
   • BUse Amazon RDS Proxy to create a proxy. Update the connection string in the Lambda function.
   • CIncrease the value in the max_connect_errors parameter in the parameter group that the database uses.
   • DUpdate the Lambda function's reserved concurrency to a higher value.

   Show answer

   Answer: B

   Explanation

   Answer is B Check "Database proxy for Amazon RDS" section in the link to see how RDS proxy help Lambda handle huge connections to RDS MySQL https://aws.amazon.com/blogs/compute/using-amazon-rds-proxy-with-aws-lambda/

   Source: Adapted from community discussion — binhdt2611

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 455 · 475 in bank

   A SysOps administrator maintains the security and compliance of a company's AWS account. To ensure the company's Amazon EC2 instances are following company policy, a SysOps administrator wants to terminate any EC2 instance that do not contain a department tag. Noncompliant resources must be terminated in near-real time. Which solution will meet these requirements?

   • ACreate an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS- TerminateEC2Instance automation document to terminate noncompliant resources.
   • BCreate a new Amazon EventBridge (Amazon CloudWatch Events) rule to monitor when new EC2 instances are created. Send the event to a Simple Notification Service (Amazon SNS) topic for automatic remediation.
   • CEnsure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance's shutdown behavior to terminate.
   • DEnsure AWS Systems Manager Compliance is configured to manage the EC2 instances. Call the AWS-StopEC2Instances automation document to stop noncompliant resources.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

6. Question 456 · 475 in bank

   A company uploaded its website files to an Amazon S3 bucket that has S3 Versioning enabled. The company uses an Amazon CloudFront distribution with the S3 bucket as the origin. The company recently modified the files, but the object names remained the same. Users report that old content is still appearing on the website. How should a SysOps administrator remediate this issue?

   • ACreate a CloudFront invalidation, and add the path of the updated files.
   • BCreate a CloudFront signed URL to update each object immediately.
   • CConfigure an S3 origin access identity (OAI) to display only the updated files to users.
   • DDisable S3 Versioning on the S3 bucket so that the updated files can replace the old files.

   Show answer

   Answer: A

   Explanation

   Answer is A! .Short description By default, CloudFront caches a response from Amazon S3 for 24 hours (Default TTL of 86,400 seconds). If your request lands at an edge location that served the Amazon S3 response within 24 hours, then CloudFront uses the cached response. This happens even if you updated the content in Amazon S3. Use one of the following ways to push the updated Amazon S3 content from CloudFront: Invalidate the Amazon S3 objects. Use object versioning https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serving-outdated-content-s3/

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation

   Next question

7. Question 457 · 475 in bank

   Select 2

   A company has two VPC networks named VPC A and VPC B. The VPC A CIDR block is 10.0.0.0/16 and the VPC B CIDR block is 172.31.0.0/16. The company wants to establish a VPC peering connection named pcx-12345 between both VPCs. Which rules should appear in the route table of VPC A after configuration? (Choose two.)

   • ADestination: 10.0.0.0/16, Target: Local
   • BDestination: 172.31.0.0/16, Target: Local
   • CDestination: 10.0.0.0/16, Target: pcx-12345
   • DDestination: 172.31.0.0/16, Target: pcx-12345
   • EDestination: 10.0.0.0/16, Target: 172.31.0.0/16

   Show answer

   Answer: AD

   Explanation

   Local Route: Destination: VPC A CIDR (10.0.0.0/16) Target: Local (implicitly points to the VPC itself) Explanation: This route ensures that traffic within VPC A (between instances with IP addresses in the 10.0.0.0/16 range) stays local and doesn’t need to go through the peering connection. Route to Peer VPC B: Destination: VPC B CIDR (172.31.0.0/16) Target: VPC peering connection ID (pcx-12345) Explanation: This route directs traffic destined for VPC B (IP addresses in the 172.31.0.0/16 range) to the VPC peering connection, allowing communication between instances in VPC A and VPC B.

   Source: Adapted from community discussion — be9z

   References

   • AWS documentation

   Next question

8. Question 458 · 475 in bank

   A company analyzes sales data for its customers. Customers upload files to one of the company's Amazon S3 buckets, and a message is posted to an Amazon Simple Queue Service (Amazon SQS) queue that contains the object Amazon Resource Name (ARN). An application that runs on an Amazon EC2 instance polls the queue and processes the messages. The processing time depends on the size of the file. Customers are reporting delays in the processing of their files. A SysOps administrator decides to configure Amazon EC2 Auto Scaling as the first step. The SysOps administrator creates an Amazon Machine Image (AMI) that is based on the existing EC2 instance. The SysOps administrator also creates a launch template that references the AMI. How should the SysOps administrator configure the Auto Scaling policy to improve the response time?

   • AAdd several different instance sizes in the launch template. Create an Auto Scaling policy based on the ApproximateNumberOfMessagesVisible metric to select the size of the instance based on the number of messages in the queue.
   • BCreate an Auto Scaling policy based on the ApproximateNumberOfMessagesDelayed metric to scale the number of instances based on the number of messages in the queue that have been delayed.
   • CCreate a custom metric based on the ASGAverageCPUUtilization metric and the GroupPendingInstances metric from the Auto Scaling group. Modify the application to calculate the metric and post the metric to Amazon CloudWatch once each minute. Create an Auto Scaling policy based on this metric to scale the number of instances.
   • DCreate a custom metric based on the ApproximateNumberOfMessagesVisible metric and the number of instances in the InService state in the Auto Scaling group. Modify the application to calculate the metric and post the metric to Amazon CloudWatch once each minute. Create an Auto Scaling policy based on this metric to scale the number of instances.

   Show answer

   Answer: D

   Explanation

   The issue here is that the app is taking too long to process the files. This means that the messages are in the SQS queue, just they're not being processed fast enough. It can't be B as "ApproximateNumberOfMessagesDelayed – Returns the approximate number of messages in the queue that are delayed and not available for reading immediately" (https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueAttributes.html). This would mean that the messages are not available, which isn't the case in this question The link posted by zolthar_z clearly explains why it's D. The app takes a variable amount of time to process each message, hence the app should calculate the Backlog per instance

   Source: Adapted from community discussion — foreverlearner

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 459 · 475 in bank

   A company runs a multi-tier web application with two Amazon EC2 instances in one Availability Zone in the us-east-1 Region. A SysOps administrator must migrate one of the EC2 instances to a new Availability Zone. Which solution will accomplish this?

   • ACopy the EC2 instance to a different Availability Zone. Terminate the original instance.
   • BCreate an Amazon Machine Image (AMI) from the EC2 instance and launch it in a different Availability Zone. Terminate the original instance.
   • CMove the EC2 instance to a different Availability Zone using the AWS CLI.
   • DStop the EC2 instance, modify the Availability Zone, and start the instance.

   Show answer

   Answer: B

   Explanation

   Answer is B! It's not possible to move an existing instance to another subnet, Availability Zone, or VPC. Instead, you can manually migrate the instance by creating a new Amazon Machine Image (AMI) from the source instance. Then, launch a new instance using the new AMI in the desired subnet, Availability Zone, or VPC. Finally, you can reassign any Elastic IP addresses from the source instance to the new instance. https://aws.amazon.com/premiumsupport/knowledge-center/move-ec2-instance/

   Source: Adapted from community discussion — princajen

   References

   • AWS documentation

   Next question

10. Question 460 · 475 in bank

    A company is expanding its fleet of Amazon EC2 instances before an expected increase of traffic. When a SysOps administrator attempts to add more instances, an InstanceLimitExceeded error is returned. What should the SysOps administrator do to resolve this error?

    • AAdd an additional CIDR block to the VPC.
    • BLaunch the EC2 instances in a different Availability Zone.
    • CLaunch new EC2 instances in another VPC.
    • DUse Service Quotas to request an EC2 quota increase.

    Show answer

    Answer: D

    Explanation

    - Instance Limit Exceeded -> Over 64 vCPU - Insufficient Instance Capacity -> AWS's problem - Instance Terminates Immediately -> EBS volume limit, corrupt or no permission for decryption

    Source: Adapted from community discussion — Hisayuki

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 451. 475 questions available.