Amazon
SOA-C02 Exam
Questions

AWS Certified SysOps Administrator - Associate SOA-C02

Amazon (SOA-C02) Exam Questions And Answers page 6

Which actions will ensure that objects uploaded to an S3 bucket are encrypted?

Multiple Choice

A company must ensure that any objects uploaded to an S3 bucket are encrypted.

Which of the following actions will meet this requirement? (Choose two.)

Implement AWS Shield to protect against unencrypted objects stored in S3 buckets.

Implement Object access control list (ACL) to deny unencrypted objects from being uploaded to the S3 bucket.

Implement Amazon S3 default encryption to make sure that any object being uploaded is encrypted before it is stored.

Implement Amazon Inspector to inspect objects uploaded to the S3 bucket to make sure that they are encrypted.

Implement S3 bucket policies to deny unencrypted objects from being uploaded to the buckets.

Security and Compliance Networking and Content Delivery

How can a company create a daily Amazon Machine Image (AMI) while maintaining file system integrity?

Single Choice

A company needs to create a daily Amazon Machine Image (AMI) of an existing Amazon Linux EC2 instance that hosts the operating system, application, and database on multiple attached Amazon Elastic Block Store (Amazon EBS) volumes. File system integrity must be maintained.

Which solution will meet these requirements?

Create an AWS Lambda function to call the CreateImage API operation with the EC2 instance ID and the no-reboot parameter enabled. Create a daily scheduled Amazon EventBridge (Amazon CloudWatch Events) rule that invokes the function.

Create an AWS Lambda function to call the CreateImage API operation with the EC2 instance ID and the reboot parameter enabled. Create a daily scheduled Amazon EventBridge (Amazon CloudWatch Events) rule that invokes the function.

Use AWS Backup to create a backup plan with a backup rule that runs daily. Assign the resource ID of the EC2 instance with the no-reboot parameter enabled.

Use AWS Backup to create a backup plan with a backup rule that runs daily. Assign the resource ID of the EC2 instance with the reboot parameter enabled.

Deployment, Provisioning, and Automation Networking and Content Delivery

How to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only?

Single Choice

A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network.

What actions should the SysOps administrator take to meet these requirements?

Create a VPC endpoint for the S3 bucket, and create an IAM policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.

Create a VPC endpoint for the S3 bucket, and create an S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.

Create a service-linked role for Amazon EC2 that allows the EC2 instances to interact directly with Amazon S3, and attach an IAM policy to the role that allows the EC2 instances full access to the S3 bucket.

Create a NAT gateway in the VPC, and modify the VPC route table to route all traffic destined for Amazon S3 through the NAT gateway.

Security and Compliance Networking and Content Delivery

How can a SysOps administrator scale an application to meet increased traffic on Amazon EC2 instances behind an ALB?

Single Choice

A company runs a web application on three Amazon EC2 instances behind an Application Load Balancer (ALB). The company notices that random periods of increased traffic cause a degradation in the application s performance. A SysOps administrator must scale the application to meet the increased traffic.

Which solution meets these requirements?

Create an Amazon CloudWatch alarm to monitor application latency and increase the size of each EC2 instance if the desired threshold is reached.

Create an Amazon EventBridge (Amazon CloudWatch Events) rule to monitor application latency and add an EC2 instance to the ALB if the desired threshold is reached.

Deploy the application to an Auto Scaling group of EC2 instances with a target tracking scaling policy. Attach the ALB to the Auto Scaling group.

Deploy the application to an Auto Scaling group of EC2 instances with a scheduled scaling policy. Attach the ALB to the Auto Scaling group.

Deployment, Provisioning, and Automation Networking and Content Delivery

How can a SysOps administrator retain application logs after instances are terminated in an Auto Scaling group?

Single Choice

A company runs its infrastructure on Amazon EC2 instances that run in an Auto Scaling group. Recently, the company promoted faulty code to the entire EC2 fleet. This faulty code caused the Auto Scaling group to scale the instances before any of the application logs could be retrieved.

What should a SysOps administrator do to retain the application logs after instances are terminated?

Configure an Auto Scaling lifecycle hook to create a snapshot of the ephemeral storage upon termination of the instances.

Create a new Amazon Machine Image (AMI) that has the Amazon CloudWatch agent installed and configured to send logs to Amazon CloudWatch Logs. Update the launch template to use the new AMI.

Create a new Amazon Machine Image (AMI) that has a custom script configured to send logs to AWS CloudTrail. Update the launch template to use the new AMI.

Install the Amazon CloudWatch agent on the Amazon Machine Image (AMI) that is defined in the launch template. Configure the CloudWatch agent to back up the logs to ephemeral storage.

Monitoring and Reporting Cost and Performance Optimization

How can a SysOps administrator collect service cost information for each developer in an AWS account?

Multiple Choice

A company s IT department noticed an increase in the spend of their developer AWS account. There are over 50 developers using the account, and the finance team wants to determine the service costs incurred by each developer.

What should a SysOps administrator do to collect this information? (Choose two.)

Activate the createdBy tag in the account.

Analyze the usage with Cost Explorer.

Analyze the usage with Amazon CloudWatch dashboards.

Configure AWS Trusted Advisor to track resource usage.

Create a billing alarm in AWS Budgets.

Deployment, Provisioning, and Automation Cost and Performance Optimization

How can an Amazon EC2 instance with encrypted Amazon EBS volumes be securely shared as an AMI with other AWS accounts?

Single Choice

A company's SysOps administrator has created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instance are encrypted with AWS managed keys.

The SysOps administrator creates an Amazon Machine Image (AMI) of the custom EC2 instance and plans to share the AMI with the company's other AWS accounts. The company requires that all AMIs are encrypted with AWS Key Management Service (AWS KMS) keys and that only authorized AWS accounts can access the shared AMIs.

Which solution will securely share the AMI with the other AWS accounts?

In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.

In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the CMK. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with.

In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the CMK. Modify the permissions on the copied AMI to make it public.

In the account where the AMI was created, modify the key policy of the AWS managed key to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.

Security and Compliance Cost and Performance Optimization

How can the company enable authentication to Kibana using existing corporate credentials stored in Active Directory?

Single Choice

A company uses Amazon Elasticsearch Service (Amazon ES) to analyze sales and customer usage data. Members of the company's geographically dispersed sales team are traveling. They need to log in to Kibana by using their existing corporate credentials that are stored in Active Directory. The company has deployed Active Directory Federation Services (AD FS) to enable authentication to cloud services.

Which solution will meet these requirements?

Configure Active Directory as an authentication provider in Amazon ES. Add the Active Directory server's domain name to Amazon ES. Configure Kibana to use Amazon ES authentication.

Deploy an Amazon Cognito user pool. Configure Active Directory as an external identity provider for the user pool. Enable Amazon Cognito authentication for Kibana on Amazon ES.

Enable Active Directory user authentication in Kibana. Create an IP-based custom domain access policy in Amazon ES that includes the Active Directory server's IP address.

Establish a trust relationship with Kibana on the Active Directory server. Enable Active Directory user authentication in Kibana. Add the Active Directory server's IP address to Kibana.

Security and Compliance Networking and Content Delivery

How to create a new record for a subdomain in Amazon Route 53 to route traffic to a CloudFront distribution?

Single Choice

A company uses Amazon Route 53 to manage the public DNS records for the domain example.com. The company deploys an Amazon CloudFront distribution to deliver static assets for a new corporate website. The company wants to create a subdomain that is named "static" and must route traffic for the subdomain to the CloudFront distribution.

How should a SysOps administrator create a new record for the subdomain in Route 53?

Create a CNAME record. Enter static.cloudfront.net as the record name. Enter the CloudFront distribution's public IP address as the value.

Create a CNAME record. Enter static.example.com as the record name. Enter the CloudFront distribution's private IP address as the value.

Create an A record. Enter static.cloudfront.net as the record name. Enter the CloudFront distribution's ID as an alias target.

Create an A record. Enter static.example.com as the record name. Enter the CloudFront distribution's domain name as an alias target.

Monitoring and Reporting Networking and Content Delivery

How can a SysOps administrator remediate consistently high PercentIOLimit metric on an Amazon EFS file system?

Single Choice

A company uses an Amazon Elastic File System (Amazon EFS) file system to share files across many Linux Amazon EC2 instances. A SysOps administrator notices that the file system's PercentIOLimit metric is consistently at 100% for 15 minutes or longer. The SysOps administrator also notices that the application that reads and writes to that file system is performing poorly. They application requires high throughput and IOPS while accessing the file system.

What should the SysOps administrator do to remediate the consistently high PercentIOLimit metric?

Create a new EFS file system that uses Max I/O performance mode. Use AWS DataSync to migrate data to the new EFS file system.

Create an EFS lifecycle policy to transition future files to the Infrequent Access (IA) storage class to improve performance. Use AWS DataSync to migrate existing data to IA storage.

Modify the existing EFS file system and activate Max I/O performance mode.

Modify the existing EFS file system and activate Provisioned Throughput mode.

Monitoring and Reporting Networking and Content Delivery

Previous Questions

Next Questions

Amazon (SOA-C02) Exam Questions And Answers page 6

Which actions will ensure that objects uploaded to an S3 bucket are encrypted?

Correct Answers:

Explanation:

References:

Comments

How can a company create a daily Amazon Machine Image (AMI) while maintaining file system integrity?

Comments

How to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only?

Comments

How can a SysOps administrator scale an application to meet increased traffic on Amazon EC2 instances behind an ALB?

Comments

How can a SysOps administrator retain application logs after instances are terminated in an Auto Scaling group?

Comments

How can a SysOps administrator collect service cost information for each developer in an AWS account?

Comments

How can an Amazon EC2 instance with encrypted Amazon EBS volumes be securely shared as an AMI with other AWS accounts?

Comments

How can the company enable authentication to Kibana using existing corporate credentials stored in Active Directory?

Correct Answer:

Explanation:

References:

Comments

How to create a new record for a subdomain in Amazon Route 53 to route traffic to a CloudFront distribution?

Comments

How can a SysOps administrator remediate consistently high PercentIOLimit metric on an Amazon EFS file system?

Comments

{{ exam.shortName }}

{{ exam.longName }}