SOA-C02 practice questions 61–70

1. Question 61 · 475 in bank

   A SysOps administrator is attempting to download patches from the internet into an instance in a private subnet. An internet gateway exists for the VPC, and a NAT gateway has been deployed on the public subnet; however, the instance has no internet connectivity. The resources deployed into the private subnet must be inaccessible directly from the public internet. Public Subnet (10.0.1.0/24) Route Table Destination Target - 10.0.0.0/16 local 0.0.0.0/0 IGW Private Subnet (10.0.2.0/24) Route Table Destination Target - 10.0.0.0/16 local What should be added to the private subnet’s route table in order to address this issue, given the information provided?

   • A0.0.0.0/0 IGW
   • B0.0.0.0/0 NAT
   • C10.0.1.0/24 IGW
   • D10.0.1.0/24 NAT

   Show answer

   Answer: B

   Explanation

   To enable instances in a private subnet to connect to the internet, you can create a NAT gateway or launch a NAT instance in a public subnet. Then add a route for the private subnet's route table that routes IPv4 internet traffic (0.0.0.0/0) to the NAT device. https://docs.aws.amazon.com/vpc/latest/userguide/route-table-options.html#route-tables-nat

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation

   Next question

2. Question 62 · 475 in bank

   A company is undergoing an external audit of its systems, which run wholly on AWS. A SysOps administrator must supply documentation of Payment Card Industry Data Security Standard (PCI DSS) compliance for the infrastructure managed by AWS. Which set of actions should the SysOps administrator take to meet this requirement?

   • ADownload the applicable reports from the AWS Artifact portal and supply these to the auditors.
   • BDownload complete copies of the AWS CloudTrail log files and supply these to the auditors.
   • CDownload complete copies of the AWS CloudWatch logs and supply these to the auditors.
   • DProvide the auditors with administrative access to the production AWS account so that the auditors can determine compliance.

   Show answer

   Answer: A

   Explanation

   Ans: A Just notice that this is correct as is regarding AWS infrastructure, but if you want to know if your resource and account configuration is compliant, you should then check AWS Security Hub

   Source: Adapted from community discussion — Liongeek

   References

   • AWS documentation

   Next question

3. Question 63 · 475 in bank

   A company has an initiative to reduce costs associated with Amazon EC2 and AWS Lambda. Which action should a SysOps administrator take to meet these requirements?

   • AAnalyze the AWS Cost and Usage Report by using Amazon Athena to identify cost savings.
   • BCreate an AWS Budgets alert to alarm when account spend reaches 80% of the budget.
   • CPurchase Reserved Instances through the Amazon EC2 console.
   • DUse AWS Compute Optimizer and take action on the provided recommendations.

   Show answer

   Answer: D

   Next question

4. Question 64 · 475 in bank

   A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6-only subnets. How should a SysOps administrator configure the VPC to meet these requirements?

   • ACreate and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
   • BCreate and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.
   • CCreate and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets.
   • DCreate and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.

   Show answer

   Answer: C

   Explanation

   Egress-only internet gateway basics IPv6 addresses are globally unique, and are therefore public by default. If you want your instance to be able to access the internet, but you want to prevent resources on the internet from initiating communication with your instance, you can use an egress-only internet gateway. To do this, create an egress-only internet gateway in your VPC, and then add a route to your route table that points all IPv6 traffic (::/0) or a specific range of IPv6 address to the egress-only internet gateway. IPv6 traffic in the subnet that's associated with the route table is routed to the egress-only internet gateway. An egress-only internet gateway is stateful: it forwards traffic from the instances in the subnet to the internet or other AWS services, and then sends the response back to the instances.

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 65 · 475 in bank

   Select 2

   A company has an existing web application that runs on two Amazon EC2 instances behind an Application Load Balancer (ALB) across two Availability Zones. The application uses an Amazon RDS Multi-AZ DB Instance. Amazon Route 53 record sets route requests for dynamic content to the load balancer and requests for static content to an Amazon S3 bucket. Site visitors are reporting extremely long loading times. Which actions should be taken to improve the performance of the website? (Choose two.)

   • AAdd Amazon CloudFront caching for static content.
   • BChange the load balancer listener from HTTPS to TCP.
   • CEnable Amazon Route 53 latency-based routing.
   • DImplement Amazon EC2 Auto Scaling for the web servers.
   • EMove the static content from Amazon S3 to the web servers.

   Show answer

   Answer: AD

   Explanation

   AD: A is obvious D If servers are working to total capacity the ASG will help to increase the performance, If is a latency issue C will not work because both are in the same region

   Source: Adapted from community discussion — zolthar_z

   References

   • AWS documentation

   Next question

6. Question 66 · 475 in bank

   A company is running an application on premises and wants to use AWS for data backup. All of the data must be available locally. The backup application can write only to block-based storage that is compatible with the Portable Operating System Interface (POSIX). Which backup solution will meet these requirements?

   • AConfigure the backup software to use Amazon S3 as the target for the data backups.
   • BConfigure the backup software to use Amazon S3 Glacier as the target for the data backups.
   • CUse AWS Storage Gateway, and configure it to use gateway-cached volumes.
   • DUse AWS Storage Gateway, and configure it to use gateway-stored volumes.

   Show answer

   Answer: D

   Explanation

   Stored volumes make your entire data available locally on the gateway, while maintaining an asynchronous copy in the S3 bucket. Cached volumes store the full volume in the S3 bucket, while only keeping the recently used data in local cache.

   Source: Adapted from community discussion — skywalker

   Next question

7. Question 67 · 475 in bank

   A global company handles a large amount of personally identifiable information (PII) through an internal web portal. The company’s application runs in a corporate data center that is connected to AWS through an AWS Direct Connect connection. The application stores the PII in Amazon S3. According to a compliance requirement, traffic from the web portal to Amazon S3 must not travel across the internet. What should a SysOps administrator do to meet the compliance requirement?

   • AProvision an interface VPC endpoint for Amazon S3. Modify the application to use the interface endpoint.
   • BConfigure AWS Network Firewall to redirect traffic to the internal S3 address.
   • CModify the application to use the S3 path-style endpoint.
   • DSet up a range of VPC network ACLs to redirect traffic to the internal S3 address.

   Show answer

   Answer: A

   Explanation

   Using the interface endpoint, applications in your on-premises data center can easily query S3 buckets over AWS Direct Connect or Site-to-Site VPN. https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/

   Source: Adapted from community discussion — Xelnak

   References

   • AWS documentation

   Next question

8. Question 68 · 475 in bank

   While setting up an AWS managed VPN connection, a SysOps administrator creates a customer gateway resource in AWS. The customer gateway device resides in a data center with a NAT gateway in front of it. What address should be used to create the customer gateway resource?

   • AThe private IP address of the customer gateway device
   • BThe MAC address of the NAT device in front of the customer gateway device
   • CThe public IP address of the customer gateway device
   • DThe public IP address of the NAT device in front of the customer gateway device

   Show answer

   Answer: D

   Explanation

   D If your customer gateway device is behind a network address translation (NAT) device, use the IP address of your NAT device. https://docs.aws.amazon.com/vpn/latest/s2svpn/cgw-options.html

   Source: Adapted from community discussion — moonwalkeryj

   References

   • AWS documentation

   Next question

9. Question 69 · 475 in bank

   A SysOps administrator notices a scale-up event for an Amazon EC2 Auto Scaling group. Amazon CloudWatch shows a spike in the RequestCount metric for the associated Application Load Balancer. The administrator would like to know the IP addresses for the source of the requests. Where can the administrator find this information?

   • AAuto Scaling logs
   • BAWS CloudTrail logs
   • CEC2 instance logs
   • DElastic Load Balancer access logs

   Show answer

   Answer: D

   Explanation

   Answer D "Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses. You can use these access logs to analyze traffic patterns and troubleshoot issues." https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

   Source: Adapted from community discussion — fazlur21

   References

   • AWS documentation

   Next question

10. Question 70 · 475 in bank

    A company’s SysOps administrator deploys a public Network Load Balancer (NLB) in front of the company’s web application. The web application does not use any Elastic IP addresses. Users must access the web application by using the company’s domain name. The SysOps administrator needs to configure Amazon Route 53 to route traffic to the NLB. Which solution will meet these requirements MOST cost-effectively?

    • ACreate a Route 53 AAAA record for the NLB.
    • BCreate a Route 53 alias record for the NLB.
    • CCreate a Route 53 CAA record for the NLB.
    • DCreate a Route 53 CNAME record for the NLB.

    Show answer

    Answer: B

    Explanation

    As a good reminder: A record = URL to IPv4 AAAA record = URL to IPv6 CNAME record = URL to URL (All the same, one url = Many URL's) Alias record = AWS service

    Source: Adapted from community discussion — BugsBunny9998666

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 61. 475 questions available.