Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 11:

  A SysOps administrator configured VPC flow logs by using the default format. The SysOps administrator specified Amazon CloudWatch Logs as the destination. This solution has worked successfully for several months. However, because of additional troubleshooting requirements, the SysOps administrator needs to include the tcp-flags field on the flow logs.

  What should the SysOps administrator do to meet this requirement?

  A. Create a new flow log. Include the tcp-flags field in the custom log format. Delete the original flow log.

  B. In the CloudWatch Logs log group, modify the filter to include the tcp-flags field and the type field.

  C. In CloudWatch Metrics, modify the metric configuration to include the tcp-flags field.

  D. Modify the existing flow log. Include the tcp-flags field and the type field in the custom log format. Save the configuration.

  Correct Answer: A

  https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-limitations

• Question 12:

  A company hosts a web application on an Amazon EC2 instance in a production VPC. Client connections to the application are failing. A SysOps administrator inspects the VPC flow logs and finds the following entry:

  

  What is a possible cause of these failed connections?

  A. A security group deny rule is blocking traffic on port 443.

  B. The EC2 instance is shut down.

  C. The network ACL is blocking HTTPS traffic.

  D. The VPC has no internet gateway attached.

  Correct Answer: C

• Question 13:

  A company runs a worker process on three Amazon EC2 instances. The instances are in an Auto Scaling group that is configured to use a simple scaling policy. The instances process messages from an Amazon Simple Queue Service

  (Amazon SQS) queue.

  Random periods of increased messages are causing a decrease in the performance of the worker process. A SysOps administrator must scale the instances to accommodate the increased number of messages.

  Which solution will meet these requirements?

  A. Use CloudWatch to create a metric math expression to calculate the approximate age of the oldest message in the SQS queue. Create a target tracking scaling policy for the metric math expression to modify the Auto Scaling group.

  B. Use CloudWatch to create a metric math expression to calculate the approximate number of messages visible in the SQS queue for each instance. Create a target tracking scaling policy for the metric math expression to modify the Auto Scaling group.

  C. Create an Application Load Balancer (ALB). Attach the ALB to the Auto Scaling group. Create a target tracking scaling policy for the ALBRequestCountPerTarget metric to modify the Auto Scaling group.

  D. Create an Application Load Balancer (ALB). Attach the ALB to the Auto Scaling group. Create a scheduled scaling policy for the Auto Scaling group.

  Correct Answer: B

• Question 14:

  A company's VPC has an existing IPv4 configuration. The IPv4 configuration includes public subnets, private subnets, NAT gateways, default route tables, and ACLs.

  The company associates an IPv6 CIDR block with the VPC. The company adds IPv6 allocations to each existing subnet and adds routes to the route tables. The company updates the ACLs to allow all IPv6 traffic.

  Public subnets are working as expected, but private subnets are not allowing internet IPv6 connections.

  What should a SysOps administrator do to allow outbound-only connectivity for the new IPv6 subnets?

  A. Configure an egress-only internet gateway and associate it with the VPC. Create a default route in the route tables that are associated with the private subnets. Configure the default route to point to the egress-only internet gateway.

  B. Turn on IPv6 NAT on the NAT gateways. Create a default route in the route tables that are associated with the private subnets. Configure the default route to point to the NAT gateways.

  C. Configure a new IPv6-only NAT gateway. Create a default route in the route tables that are associated with the private subnets. Configure the default route to point to the IPv6-only NAT gateway.

  D. Create a default route in the route tables that are associated with the private subnets. Configure the default route to point to the existing internet gateway.

  Correct Answer: A

• Question 15:

  A company has users that deploy Amazon EC2 instances that have more disk performance capacity than is required. A SysOps administrator needs to review all Amazon Elastic Block Store (Amazon EBS) volumes that are associated with the instances and create cost optimization recommendations based on IOPS and throughput.

  What should the SysOps administrator do to meet these requirements in the MOST operationally efficient way?

  A. Use the monitoring graphs in the EC2 console to view metrics for EBS volumes. Review the consumed space against the provisioned space on each volume. Identify any volumes that have low utilization.

  B. Stop the EC2 instances from the EC2 console. Change the EC2 instance type for Amazon EBS-optimized. Start the EC2 instances.

  C. Opt in to AWS Compute Optimizer. Allow sufficient time for metrics to be gathered. Review the Compute Optimizer findings for EBS volumes.

  D. Install the fio tool onto the EC2 instances and create a .cfg file to approximate the required workloads. Use the benchmark results to gauge whether the provisioned EBS volumes are of the most appropriate type.

  Correct Answer: C

  https://aws.amazon.com/blogs/storage/cost-optimizing-amazon-ebs-volumes-using-aws-compute-optimizer/

• Question 16:

  A SysOps administrator needs to create an Amazon S3 bucket as a resource in an AWS CloudFormation template. The bucket name must be randomly generated, and the bucket must be encrypted. Other resources in the template will reference the bucket.

  Which CloudFormation resource definition should the SysOps administrator use to meet these requirements?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

• Question 17:

  A company has a multi-account environment. Account A has a production application that is hosted on an Amazon EC2 instance. The application needs to query data in an Amazon DynamoDB table that is hosted in Account B.

  A SysOps administrator needs to provide the EC2 instance in Account A with access to the DynamoDB table in Account B.

  What is the MOST secure solution that will meet these requirements?

  A. Update the IAM policy that is attached to the EC2 instance's IAM role to allow the dynamodb:Query permission on the DynamoDB table in Account B. Add a policy in Account A to allow the DynamoDB service principal to use the PassRole action to pass the role to Account B.

  B. In Account B, create an IAM role that has permission to query the DynamoDB table. Add the EC2 instance's IAM role to the trust policy on the newly created IAM role in Account Update the IAM policy that is attached to the EC2 instance's IAM role to allow the sts:AssumeRole permission on the newly created IAM role in Account B.

  C. Update the IAM policy that is attached to the EC2 instance's IAM role to allow the dynamodb:Query permission on the DynamoDB table in Account B. Update the DynamoDB table's resource policy to allow the query action from the EC2 instance's IAM role.

  D. In Account B, create a static IAM key that has the appropriate permissions to query the DynamoDB table. Embed these credentials into the credentials file on the EC2 instance. Reference the credentials every time the application needs to query the table.

  Correct Answer: B

  https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-cross-account-access-to-amazon-dynamodb.html

• Question 18:

  When the AWS Cloud infrastructure experiences an event that may impact an organization, which AWS service can be used to see which of the organization's resources are affected?

  A. AWS Service Health Dashboard

  B. AWS Trusted Advisor

  C. AWS Personal Health Dashboard

  D. AWS Systems Manager

  Correct Answer: C

  

  Reference: https://docs.aws.amazon.com/health/latest/ug/getting-started-phd.html

• Question 19:

  AnyCompany has acquired Example Corp and is attempting to consolidate the business systems of both companies. AnyCompany's IT department needs to integrate with Example Corp's IT ticketing system.

  A SysOps administrator must implement a solution that uses Amazon CloudWatch alarms for Amazon EC2 instances in AnyCompany's account to create new tickets in Example Corp's ticketing system. The ticketing system provides an HTTPS endpoint for the creation of new tickets. The ticketing system accepts messages in the following JSON format:

  

  Which approach to creating tickets from the CloudWatch alarms will meet these requirements with the LEAST development time?

  A. Create an Amazon EventBridge rule that filters appropriate events and specifies EventBridge API destinations as a target. Configure EventBridge API destinations to send events to the HTTPS endpoint. In the EventBridge rule, create an

  input transformer to convert the source to a compatible output for the ticketing system.

  B. Create an Amazon EventBridge rule that filters appropriate events and specifies an Amazon Kinesis data stream as the target. Create an AWS Lambda function to receive events from the Kinesis data stream. Configure the Lambda function to start an AWS Glue job to transform the data and forward the output to the HTTPS endpoint.

  C. Create an Amazon EventBridge rule that filters appropriate events and specifies Amazon Simple Notification Service (Amazon SNS) as a target. Configure Amazon SNS to transform the events and send the events to the HTTPS endpoint.

  D. Create an Amazon EventBridge rule that filters appropriate events and specifies an AWS Step Functions state machine as a target. Create an AWS Lambda function and an AWS Glue job in Step Functions to transform the events and send the events to the HTTPS endpoint.

  Correct Answer: C

  Option C requires the LEAST development time, it leverages Amazon SNS message to eliminate the need to write custom code or uttilize additional services like AWS Lambda or AWS Glue for data transformation. Option A would require more time because it would require custom code to change the events from CloudWatch alarms into the required JSON format. It will also would require you to configure the ticketing system to accept requests from Amazon EventBridge.

• Question 20:

  A SysOps administrator has many Windows Amazon EC2 instances that need to share a file system between nodes. The SysOps administrator creates an Amazon Elastic File System (Amazon EFS) file share. After creation of the file share, the SysOps administrator is having trouble mounting the file share to the EC2 instances.

  Which action should the SysOps administrator take so that the EC2 instances can share the files?

  A. Delete the EFS file share. Create an Amazon FSx for Windows File Server file share for the EC2 instances.

  B. Use the correct IAM credentials to mount the EFS file share.

  C. Configure NFSv4 support on the Windows operating system that is running on the EC2 instances.

  D. Allow the correct port for NFS through the security group and network ACL.

  Correct Answer: A

  https://docs.aws.amazon.com/efs/latest/ug/troubleshooting-efs-mounting.html