SOA-C02 practice questions 81–90

1. Question 81 · 475 in bank

   A company has a memory-intensive application that runs on a fleet of Amazon EC2 instances behind an Elastic Load Balancer (ELB). The instances run in an Auto Scaling group. A SysOps administrator must ensure that the application can scale based on the number of users that connect to the application. Which solution will meet these requirements?

   • ACreate a scaling policy that will scale the application based on the ActiveConnectionCount Amazon CloudWatch metric that is generated from the ELB.
   • BCreate a scaling policy that will scale the application based on the mem_used Amazon CloudWatch metric that is generated from the ELB.
   • CCreate a scheduled scaling policy to increase the number of EC2 instances in the Auto Scaling group to support additional connections.
   • DCreate and deploy a script on the ELB to expose the number of connected users as a custom Amazon CloudWatch metric. Create a scaling policy that uses the metric.

   Show answer

   Answer: A

   Explanation

   the key is to publish a CloudWatch metric that tracks active connections, and configure Auto Scaling scaling policies based on that metric to dynamically scale the EC2 fleet behind the ELB as the load changes. Ans: A

   Source: Adapted from community discussion — alexiscloud

   Next question

2. Question 82 · 475 in bank

   A SysOps administrator creates a new VPC that includes a public subnet and a private subnet. The SysOps administrator successfully launches 11 Amazon EC2 instances in the private subnet. The SysOps administrator attempts to launch one more EC2 instance in the same subnet. However, the SysOps administrator receives an error message that states that not enough free IP addresses are available. What must the SysOps administrator do to deploy more EC2 instances?

   • AEdit the private subnet to change the CIDR block to /27.
   • BEdit the private subnet to extend across a second Availability Zone.
   • CAssign additional Elastic IP addresses to the private subnet.
   • DCreate a new private subnet to hold the required EC2 instances.

   Show answer

   Answer: D

   Explanation

   It's not possible to change or modify the IP address range of an existing virtual private cloud (VPC) or subnet. However, you can do one of the following: Add an additional IPv4 CIDR block as a secondary CIDR to your VPC. Create a new VPC with your preferred CIDR block and then migrate the resources from your old VPC to the new VPC (if applicable).

   Source: Adapted from community discussion — Christina666

   References

   • AWS documentation
   • repost.aws documentation

   Next question

3. Question 83 · 475 in bank

   A company needs to automatically monitor an AWS account for potential unauthorized AWS Management Console logins from multiple geographic locations. Which solution will meet this requirement?

   • AConfigure Amazon Cognito to detect any compromised IAM credentials.
   • BSet up Amazon Inspector. Scan and monitor resources for unauthorized logins.
   • CSet up AWS Config. Add the iam-policy-blacklisted-check managed rule to the account.
   • DConfigure Amazon GuardDuty to monitor the UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B finding.

   Show answer

   Answer: D

   Explanation

   GuardDuty provides findings related to unauthorized access and console logins. The "UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B" finding specifically indicates successful console logins from new or unusual locations. By configuring GuardDuty, you can receive alerts and notifications for such findings, allowing you to investigate and take appropriate action. Options A, B, and C are not directly designed for monitoring unauthorized console logins from multiple geographic locations: A. Amazon Cognito is an identity management service but is not specifically designed for monitoring AWS Management Console logins. B. Amazon Inspector is a security assessment service that identifies security vulnerabilities in your EC2 instances. While it can help with overall security posture, it is not focused on monitoring console logins. C. AWS Config can provide information about configuration changes, but the "iam-policy-blacklisted-check" managed rule is related to IAM policies and is not specifically designed for monitoring console logins from multiple locations.

   Source: Adapted from community discussion — r2c3po

   References

   • AWS documentation

   Next question

4. Question 84 · 475 in bank

   Select 2

   A company has an Amazon RDS DB instance. The company wants to implement a caching service while maintaining high availability. Which combination of actions will meet these requirements? (Choose two.)

   • AAdd Auto Discovery to the data store.
   • BCreate an Amazon ElastiCache for Memcached data store.
   • CCreate an Amazon ElastiCache for Redis data store.
   • DEnable Multi-AZ for the data store.
   • EEnable Multi-threading for the data store.

   Show answer

   Answer: CD

   Explanation

   Answer is definitely CD. Memcached does not support multi-az deployments which is required for HA as stated in the question. Performance was not necessarily in the question, hence, multi-threading is not required. CD for sure

   Source: Adapted from community discussion — henro4niger

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 85 · 475 in bank

   A company monitors its account activity using AWS CloudTrail, and is concerned that some log files are being tampered with after the logs have been delivered to the account’s Amazon S3 bucket. Moving forward, how can the SysOps administrator confirm that the log files have not been modified after being delivered to the S3 bucket?

   • AStream the CloudTrail logs to Amazon CloudWatch Logs to store logs at a secondary location.
   • BEnable log file integrity validation and use digest files to verify the hash value of the log file.
   • CReplicate the S3 log bucket across regions, and encrypt log files with S3 managed keys.
   • DEnable S3 server access logging to track requests made to the log bucket for security audits.

   Show answer

   Answer: B

   Explanation

   Option B is the correct choice: To confirm that CloudTrail log files have not been modified after being delivered to an S3 bucket, you can enable log file integrity validation. When log file integrity validation is enabled, AWS CloudTrail generates digest files that contain the hash values of the delivered log files. These hash values are then used to verify the integrity of the log files. # B. Enable log file integrity validation and use digest files to verify the hash value of the log file: Log file integrity validation helps ensure that log files stored in the S3 bucket have not been tampered with. It adds an additional layer of security by providing a way to verify the integrity of the log files using hash values stored in digest files.

   Source: Adapted from community discussion — r2c3po

   References

   • AWS documentation

   Next question

6. Question 86 · 475 in bank

   A SysOps administrator is reviewing AWS Trusted Advisor warnings and encounters a warning for an S3 bucket policy that has open access permissions. While discussing the issue with the bucket owner, the administrator realizes the S3 bucket is an origin for an Amazon CloudFront web distribution. Which action should the administrator take to ensure that users access objects in Amazon S3 by using only CloudFront URLs?

   • AEncrypt the S3 bucket content with Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
   • BCreate an origin access identity and grant it permissions to read objects in the S3 bucket.
   • CAssign an IAM user to the CloudFront distribution and grant the user permissions in the S3 bucket policy.
   • DAssign an IAM role to the CloudFront distribution and grant the role permissions in the S3 bucket policy.

   Show answer

   Answer: B

   Explanation

   Option B is the correct choice: #B. Create an origin access identity and grant it permissions to read objects in the S3 bucket. When using Amazon CloudFront as a content delivery network with an S3 bucket as the origin, it's a best practice to restrict direct access to the S3 bucket and require users to access objects only through CloudFront URLs. This can be achieved by creating an Origin Access Identity (OAI) and granting it permission to read objects in the S3 bucket.

   Source: Adapted from community discussion — r2c3po

   Next question

7. Question 87 · 475 in bank

   A SysOps administrator is reviewing AWS Trusted Advisor recommendations. The SysOps administrator notices that all the application servers for a finance application are listed in the Low Utilization Amazon EC2 Instances check. The application runs on three instances across three Availability Zones. The SysOps administrator must reduce the cost of running the application without affecting the application’s availability or design. Which solution will meet these requirements?

   • AReduce the number of application servers.
   • BApply rightsizing recommendations from AWS Cost Explorer to reduce the instance size.
   • CProvision an Application Load Balancer in front of the instances.
   • DScale up the instance size of the application servers.

   Show answer

   Answer: B

   Explanation

   For what it's worth, since the app servers are installed in three different AZ's, you could drop an app server in one AZ and meet the HA requirement. However, this does make some presumptions on the utilization. However, I do believe B is probably the right answer (from researching AWS documentation) "The rightsizing recommendations feature in Cost Explorer helps you identify cost-saving opportunities by downsizing or terminating instances in Amazon Elastic Compute Cloud (Amazon EC2). Rightsizing recommendations analyze your Amazon EC2 resources and usage to show opportunities for how you can lower your spending. You can see all of your underutilized Amazon EC2 instances across member accounts in a single view to immediately identify how much you can save. After you identify your recommendations, you can take action on the Amazon EC2 console." https://docs.aws.amazon.com/cost-management/latest/userguide/ce-rightsizing.html

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation

   Next question

8. Question 88 · 475 in bank

   A company hosts its website in the us-east-1 Region. The company is preparing to deploy its website into the eu-central-1 Region. Website visitors who are located in Europe should access the website that is hosted in eu-central-1. All other visitors access the website that is hosted in us-east-1. The company uses Amazon Route 53 to manage the website’s DNS records. Which routing policy should a SysOps administrator apply to the Route 53 record set to meet these requirements?

   • AGeolocation routing policy
   • BGeoproximity routing policy
   • CLatency routing policy
   • DMultivalue answer routing policy

   Show answer

   Answer: A

   Explanation

   Geolocation routing lets you choose the resources that serve your traffic based on the geographic location of your users, meaning the location that DNS queries originate from. For example, you might want all queries from Europe to be routed to an Elastic Load Balancing load balancer in the Frankfurt Region. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy-geo.html

   Source: Adapted from community discussion — Rabbit117

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 89 · 475 in bank

   An organization with a large IT department has decided to migrate to AWS. With different job functions in the IT department, it is not desirable to give all users access to all AWS resources. Currently the organization handles access via LDAP group membership. What is the BEST method to allow access using current LDAP credentials?

   • ACreate an AWS Directory Service Simple AD. Replicate the on-premises LDAP directory to Simple AD.
   • BCreate a Lambda function to read LDAP groups and automate the creation of IAM users.
   • CUse AWS CloudFormation to create IAM roles. Deploy Direct Connect to allow access to the on-premises LDAP server.
   • DFederate the LDAP directory with IAM using SAML. Create different IAM roles to correspond to different LDAP groups to limit permissions.

   Show answer

   Answer: D

   Explanation

   Option D is the correct choice: D. Federate the LDAP directory with IAM using SAML: By federating with IAM using SAML, you enable single sign-on (SSO) and allow users to authenticate using their existing LDAP credentials. This eliminates the need to manage separate IAM user accounts and passwords for AWS access. Different IAM roles can be created to correspond to different LDAP groups, and users can assume these roles to gain access to AWS resources. This helps in limiting permissions based on the LDAP group membership.

   Source: Adapted from community discussion — r2c3po

   References

   • AWS documentation

   Next question

10. Question 90 · 475 in bank

    A SysOps administrator configured AWS Backup to capture snapshots from a single Amazon EC2 instance that has one Amazon Elastic Block Store (Amazon EBS) volume attached. On the first snapshot, the EBS volume has 10 GiB of data. On the second snapshot, the EBS volume still contains 10 GiB of data, but 4 GiB have changed. On the third snapshot, 2 GiB of data have been added to the volume, for a total of 12 GiB. How much total storage is required to store these snapshots?

    • A12 GiB
    • B16 GiB
    • C26 GiB
    • D32 GiB

    Show answer

    Answer: B

    Explanation

    1. First Snapshot: The entire volume is captured in the first snapshot, so it requires storage equivalent to the size of the volume, which is 10 GiB. 2. Second Snapshot: Only the changed blocks since the first snapshot are stored. In this case, 4 GiB have changed, so the storage required for the second snapshot is 4 GiB. 3. Third Snapshot: Only the changed blocks since the second snapshot are stored. In this case, 2 GiB have been added, so the storage required for the third snapshot is 2 GiB. The total storage required is the sum of the storage for each snapshot: 10 GiB + 4 GiB + 2 GiB = 16 GiB So, the total storage required to store these three snapshots is 16 GiB.

    Source: Adapted from community discussion — axdevops

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 81. 475 questions available.