SOA-C02 practice questions 51–60

1. Question 51 · 475 in bank

   A SysOps administrator recently configured Amazon S3 Cross-Region Replication on an S3 bucket. Which of the following does this feature replicate to the destination S3 bucket by default?

   • AObjects in the source S3 bucket for which the bucket owner does not have permissions
   • BObjects that are stored in S3 Glacier
   • CObjects that existed before replication was configured
   • DObject metadata

   Show answer

   Answer: D

   Explanation

   By default, Amazon S3 replicates the following: Objects created after you add a replication configuration. Unencrypted objects. Objects encrypted using customer provided keys (SSE-C), objects encrypted at rest under an Amazon S3 managed key (SSE-S3) or a KMS key stored in AWS Key Management Service (SSE-KMS). For more information, see Replicating objects created with server-side encryption (SSE-C, SSE-S3, SSE-KMS, DSSE-KMS). Object metadata from the source objects to the replicas. For information about replicating metadata from the replicas to the source objects, see Replicating metadata changes with Amazon S3 replica modification sync. Only objects in the source bucket for which the bucket owner has permissions to read objects and access control lists (ACLs).

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 52 · 475 in bank

   A company has a workload that is sending log data to Amazon CloudWatch Logs. One of the fields includes a measure of application latency. A SysOps administrator needs to monitor the p90 statistic of this field over time. What should the SysOps administrator do to meet this requirement?

   • ACreate an Amazon CloudWatch Contributor Insights rule on the log data.
   • BCreate a metric filter on the log data.
   • CCreate a subscription filter on the log data.
   • DCreate an Amazon CloudWatch Application Insights rule for the workload.

   Show answer

   Answer: B

   Explanation

   Create a metric filter on the log data. Percentile (p) indicates the relative standing of a value in a dataset. For example, p95 is the 95th percentile and means that 95 percent of the data within the period is lower than this value and 5 percent of the data is higher than this value. Percentiles help you get a better understanding of the distribution of your metric data. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html

   Source: Adapted from community discussion — noahsark

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 53 · 475 in bank

   A company wants to archive sensitive data on Amazon S3 Glacier. The company’s regulatory and compliance requirements do not allow any modifications to the data by any account. Which solution meets these requirements?

   • AAttach a vault lock policy to an S3 Glacier vault that contains the archived data. Use the lock ID to validate the vault lock policy after 24 hours.
   • BAttach a vault lock policy to an S3 Glacier vault that contains the archived data. Use the lock ID to validate the vault lock policy within 24 hours.
   • CConfigure S3 Object Lock in governance mode. Upload all files after 24 hours.
   • DConfigure S3 Object Lock in governance mode. Upload all files within 24 hours.

   Show answer

   Answer: B

   Explanation

   While the policy is in the in-progress state, you have 24 hours to validate your Vault Lock policy before the lock ID expires. To prevent your vault from exiting the in-progress state, you must complete the Vault Lock process within these 24 hours. Otherwise, your Vault Lock policy will be deleted. https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-lock.html#vault-lock-overview

   Source: Adapted from community discussion — Xelnak

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 54 · 475 in bank

   A company manages an application that uses Amazon ElastiCache for Redis with two extra-large nodes spread across two different Availability Zones. The company’s IT team discovers that the ElastiCache for Redis cluster has 75% freeable memory. The application must maintain high availability. What is the MOST cost-effective way to resize the cluster?

   • ADecrease the number of nodes in the ElastiCache for Redis cluster from 2 to 1.
   • BDeploy a new ElastiCache for Redis cluster that uses large node types. Migrate the data from the original cluster to the new cluster. After the process is complete, shut down the original cluster.
   • CDeploy a new ElastiCache for Redis cluster that uses large node types. Take a backup from the original cluster, and restore the backup in the new cluster. After the process is complete, shut down the original cluster.
   • DPerform an online resizing for the ElastiCache for Redis cluster. Change the node types from extra-large nodes to large nodes.

   Show answer

   Answer: D

   Explanation

   Scaling down Redis cache clusters (Console) Scaling down Redis cache clusters (Amazon CLI) Scaling down Redis cache clusters (ElastiCache API)

   Source: Adapted from community discussion — Christina666

   Next question

5. Question 55 · 475 in bank

   A company must migrate its applications to AWS. The company is using Chef recipes for configuration management. The company wants to continue to use the existing Chef recipes after the applications are migrated to AWS. What is the MOST operationally efficient solution that meets these requirements?

   • AUse AWS CloudFormation to create an Amazon EC2 instance, install a Chef server, and add Chef recipes.
   • BUse AWS CloudFormation to create a stack and add layers for Chef recipes.
   • CUse AWS Elastic Beanstalk with the Docker platform to upload Chef recipes.
   • DUse AWS OpsWorks to create a stack and add layers with Chef recipes.

   Show answer

   Answer: D

   Explanation

   This is probably an old/obsolete question now... AWS OpsWorks for Chef Automate is no longer accepting new customers. Existing customers will be unaffected until May 5, 2024 at which time the service will become unavailable. We recommend that existing customers migrate to Chef SaaS or an alternative solution. Source: https://docs.aws.amazon.com/opsworks/latest/userguide/welcome_opscm.html

   Source: Adapted from community discussion — fig

   References

   • AWS documentation

   Next question

6. Question 56 · 475 in bank

   A company uses AWS Organizations to manage its AWS accounts. A SysOps administrator must create a backup strategy for all Amazon EC2 instances across all the company’s AWS accounts. Which solution will meet these requirements in the MOST operationally efficient way?

   • ADeploy an AWS Lambda function to each account to run EC2 instance snapshots on a scheduled basis.
   • BCreate an AWS CloudFormation stack set in the management account to add an AutoBackup=True tag to every EC2 instance.
   • CUse AWS Backup in the management account to deploy policies for all accounts and resources.
   • DUse a service control policy (SCP) to run EC2 instance snapshots on a scheduled basis in each account.

   Show answer

   Answer: C

   Explanation

   https://aws.amazon.com/backup/features/ AWS Backup now supports cross-account backup, enabling you to securely copy your backups across your AWS accounts within your AWS organizations.

   Source: Adapted from community discussion — Xelnak

   References

   • AWS documentation

   Next question

7. Question 57 · 475 in bank

   A company recently acquired another corporation and all of that corporation's AWS accounts. A financial analyst needs the cost data from these accounts. A SysOps administrator uses Cost Explorer to generate cost and usage reports. The SysOps administrator notices that "No Tagkey" represents 20% of the monthly cost. What should the SysOps administrator do to tag the "No Tagkey" resources?

   • AAdd the accounts to AWS Organizations. Use a service control policy (SCP) to tag all the untagged resources.
   • BUse an AWS Config rule to find the untagged resources. Set the remediation action to terminate the resources.
   • CUse Cost Explorer to find and tag all the untagged resources.
   • DUse Tag Editor to find and tag all the untagged resources.

   Show answer

   Answer: D

   Explanation

   D. "You can add tags to resources when you create the resource. You can use the resource's service console or API to add, change, or remove those tags one resource at a time. To add tags to—or edit or delete tags of—multiple resources at once, use Tag Editor. With Tag Editor, you search for the resources that you want to tag, and then manage tags for the resources in your search results." https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html

   Source: Adapted from community discussion — Surferbolt

   References

   • AWS documentation

   Next question

8. Question 58 · 475 in bank

   A SysOps administrator is reviewing VPC Flow Logs to troubleshoot connectivity issues in a VPC. While reviewing the logs, the SysOps administrator notices that rejected traffic is not listed. What should the SysOps administrator do to ensure that all traffic is logged?

   • ACreate a new flow log that has a filter setting to capture all traffic.
   • BCreate a new flow log. Set the log record format to a custom format. Select the proper fields to include in the log.
   • CEdit the existing flow log. Change the filter setting to capture all traffic.
   • DEdit the existing flow log. Set the log record format to a custom format. Select the proper fields to include in the log.

   Show answer

   Answer: A

   Explanation

   Ans: A You CANNOT modify a VPC Flow Log Ref: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-limitations "After you create a flow log, you cannot change its configuration or the flow log record format. For example, you can't associate a different IAM role with the flow log, or add or remove fields in the flow log record. Instead, you can delete the flow log and create a new one with the required configuration."

   Source: Adapted from community discussion — Liongeek

   References

   • AWS documentation

   Next question

9. Question 59 · 475 in bank

   A company is expanding its use of AWS services across its portfolios. The company wants to provision AWS accounts for each team to ensure a separation of business processes for security, compliance, and billing. Account creation and bootstrapping should be completed in a scalable and efficient way so new accounts are created with a defined baseline and governance guardrails in place. A SysOps administrator needs to design a provisioning process that saves time and resources. Which action should be taken to meet these requirements?

   • AAutomate using AWS Elastic Beanstalk to provision the AWS accounts, set up infrastructure, and integrate with AWS Organizations.
   • BCreate bootstrapping scripts in AWS OpsWorks and combine them with AWS CloudFormation templates to provision accounts and infrastructure.
   • CUse AWS Config to provision accounts and deploy instances using AWS Service Catalog.
   • DUse AWS Control Tower to create a template in Account Factory and use the template to provision new accounts.

   Show answer

   Answer: D

   Explanation

   If you are hosting more than a handful of accounts, it’s beneficial to have an orchestration layer that facilitates account deployment and account governance. You can adopt AWS Control Tower as your primary way to provision accounts and infrastructure. With AWS Control Tower, you can more easily adhere to corporate standards, meet regulatory requirements, and follow best practices. AWS Control Tower enables end users on your distributed teams to provision new AWS accounts quickly, by means of configurable account templates in Account Factory. Meanwhile, your central cloud administrators can monitor that all accounts are aligned with established, company-wide compliance policies.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation

   Next question

10. Question 60 · 475 in bank

    Select 2

    A SysOps administrator noticed that the cache hit ratio for an Amazon CloudFront distribution is less than 10%. Which collection of configuration changes will increase the cache hit ratio for the distribution? (Choose two.)

    • AEnsure that only required cookies, query strings, and headers are forwarded in the Cache Behavior Settings.
    • BChange the Viewer Protocol Policy to use HTTPS only.
    • CConfigure the distribution to use presigned cookies and URLs to restrict access to the distribution.
    • DEnable automatic compression of objects in the Cache Behavior Settings.
    • EIncrease the CloudFront time to live (TTL) settings in the Cache Behavior Settings.

    Show answer

    Answer: AE

    Explanation

    A cache hit refers to the situation wherein the cache is able to successfully retrieve data and content that was saved to it, and then display it on a web page https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cache-hit-ratio.html Specifying how long CloudFront caches your objects Using Origin Shield Caching based on query string parameters Caching based on cookie values Caching based on request headers Remove Accept-Encoding header when compression is not needed Serving media content by using HTTP

    Source: Adapted from community discussion — Christina666

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 51. 475 questions available.