Skip to main content

SOA-C01 Online Exam

AWS Certified SysOps Administrator - Associate (SOA-C01)

958 questions available ยท Page 1 of 96

View study plans
Question 1 Single choice

A company's audit shows that users have been changing cost-related tags on Amazon EC2 instances after deployment. The company has an organization in AWS Organizations with many AWS accounts.

The company needs a solution to detect the EC2 instances automatically. The solution must require the

least possible operational overhead.

Which solution meets these requirements?

  1. A

    Use service control policies (SCPs) to track EC2 instances that do not have the required tags.

  2. B

    Use Amazon Inspector to run a report to identify EC2 instances that do not have the required tags.

  3. C

    Use an AWS Config rule to track EC2 instances that do not have the required tags.

  4. D

    Use AWS Well-Architected Tool (AWS WA Tool) to run a report to identify EC2 instances that do not have the required tags.

Show answer and explanation

Correct answer: A

Question 2 Single choice

A company is hosting a website on an Amazon EC2 instance that runs in a public subnet inside a VPC.
The company uses Amazon CloudWatch Logs for web server log analysis.

A SysOps administrator has installed and configured the CloudWatch Logs agent on the EC2 instance and has confirmed that the agent is running. However, logs are not showing up in CloudWatch Logs.

Which solution will resolve this issue?

  1. A

    Modify the EC2 instance security group rules to allow inbound traffic on port 80.

  2. B

    Create an IAM user that has the proper permissions for CloudWatch logs. Create an IAM instance profile, and associate it with the IAM user. Associate the instance profile with the EC2 instance.

  3. C

    Create an IAM role that has the proper permissions for CloudWatch logs. Create an IAM instance profile, and associate it with the IAM role. Associate the instance profile with the EC2 instance.

  4. D

    Modify the VPC's network ACL rules for the public subnet to allow inbound traffic on port 80.

Show answer and explanation

Correct answer: B

Question 3 Single choice

A SysOps administrator must run a script on production servers to fix an issue. The company has a policy to block all remote interactive access to production servers.

Based on this situation, how should the administrator run the script?

  1. A

    Share and use the Amazon EC2 key pairs to gain access to the servers and run the script.

  2. B

    Put the script into the user data of the instances.

  3. C

    Configure the script to run as a cron job or scheduled task on the EC2 instances.

  4. D

    Use AWS Systems Manager to run the script.

Show answer and explanation

Correct answer: C

Question 4 Single choice

A developer created a new application that uses Spot Fleet for a variety of instance families across

multiple Availability Zones.

What should the developer do to ensure that the Spot Fleet is configured for cost optimization?

  1. A

    Deploy a capacityOptimized allocation strategy for provisioning Spot Instances.

  2. B

    Ensure instance capacity by specifying the desired target capacity and how much of that capacity must be On-Demand.

  3. C

    Use the lowestPrice allocation strategy with InstancePoolsToUseCount in the Spot Fleet request.

  4. D

    Launch instances up to the Spot Fleet target capacity or the maximum acceptable payment amount.

Show answer and explanation

Correct answer: B

Question 5 Single choice

A company wants to track Amazon EC2 usage charges that are based on the value of a tag that is named Business-Unit. Company leaders instruct developers to update all EC2 resources with the tag. The developers notify the leaders that they have completed this task.

Later that week, a finance team member checks Cost Explorer. The finance team member sees EC2 costs in the different accounts but cannot find the Business-Unit tag to filter by or group by.

What is the MOST likely reason that the Business-Unit tag is absent?

  1. A

    The Business-Unit tag is not activated as a cost allocation tag in the AWS Billing and Cost Management console.

  2. B

    The Business-Unit tag is not valid because tag key names do not support dashes (-).

  3. C

    The instances have been rebooted, and the developers neglected to re-add the Business-Unit tag after the reboot.

  4. D

    The IAM user does not have permission to view the tags in Cost Explorer.

Show answer and explanation

Correct answer: A

Question 6 Single choice

A SysOps administrator is deploying a fleet of over 100 Amazon EC2 instances in an Amazon VPC. After the instances are set up and serving clients, a new DNS server needs to be added to the instances for
DNS resolution.

What is the MOST efficient way to make this change?

  1. A

    Update the DHCP options set for the Amazon VPC.

  2. B

    Use AWS OpsWorks to update the DNS server configuration for each instance.

  3. C

    Use AWS Systems Manager to update the DMS server configuration for each instance.

  4. D

    Write a script to update the DNS server configuration for each instance.

Show answer and explanation

Correct answer: A

Question 7 Single choice

A SysOps administrator is testing a new batch job. The batch job will upload 20 GB of data from Amazon

EC2 instances in a private subnet to an Amazon S3 bucket each day. After the first test is complete, a small cost is reported. The cost has the heading "NAT Gateway - Data Processed."

Which change can the SysOps administrator make to eliminate this cost for future tests?

  1. A

    Configure and use a VPC endpoint.

  2. B

    Write an S3 bucket policy to enforce encryption in transit for the uploads.

  3. C

    Configure the S3 bucket to use the S3 Intelligent-Tiering storage class.

  4. D

    Disable cross-origin resource sharing (CORS) for the S3 bucket.

Show answer and explanation

Correct answer: A

Explanation

References:
https://stackoverflow.com/questions/64121570/reduce-cost-of-nat-gateway-data-processed

Question 8 Single choice

A SysOps administrator needs a secure way to connect to AWS Key Management Service (AWS KMS) within a VPC. The SysOps administrator must ensure that connections to AWS KMS do not traverse the internet.

What is the MOST secure solution that meets these requirements?

  1. A

    Use a bastion host to connect to AWS KMS.

  2. B

    Use a NAT gateway to connect to AWS KMS.

  3. C

    Use a VPC gateway endpoint for Amazon S3 to connect to AWS KMS.

  4. D

    Use a VPC interface endpoint to connect to AWS KMS.

Show answer and explanation

Correct answer: B

Question 9 Single choice

A company is creating an application that will keep records. The application will run on Amazon EC2 instances and will use an Amazon Aurora MySQL database as its data store. To maintain compliance, the application must not retain information that is determined to be sensitive.

Which technique should a SysOps administrator use to detect if sensitive data is being stored in the application?

  1. A

    Export data from the database by using an AWS Lambda function. Store the data in Amazon S3. Use Amazon Macie to examine the stored data. Examine the report for any sensitive data that is discovered.

  2. B

    Install the Amazon GuardDuty plugin for Aurora. Configure GuardDuty to examine the database. Add the corresponding EC2 CIDR ranges to the trusted IP list in GuardDuty. Examine the report for any sensitive data that is discovered.

  3. C

    Deploy Amazon Inspector by installing the Amazon Inspector agent on all EC2 instances. Set the Amazon Inspector assessment type to HOST assessment. Include NETWORK communications with the Aurora DB cluster. Examine the report for any sensitive data that is discovered.

  4. D

    Use VPC Flow Logs to examine traffic between the EC2 instances and the Aurora DB cluster. Store the log files in Amazon S3. Use Amazon Detective to examine the extracted log files. Examine the report for any sensitive data that is discovered.

Show answer and explanation

Correct answer: A

Question 10 Multiple choice

A company uses many Amazon Elastic Block Store (Amazon EBS) volumes. The company wants to use Amazon Data Lifecycle Manager (Amazon DLM) to manage the lifecycle of EBS snapshots that have tags of "Production" and "Compliance".

Which combination of the following are needed to turn on this feature? (Choose two.)

  1. A

    A minimum storage requirement of 5 GB

  2. B

    One IAM role for Amazon DLM and another IAM role for the users

  3. C

    Encryption of the EBS volumes

  4. D

    A minimum baseline performance of 3 IOPS/GB

  5. E

    Tagging of the EBS volumes

Show answer and explanation

Correct answers: B, E