Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 201:

  A compliance learn requites all administrator passwords for Amazon RDS DB instances to be changed at least annually.

  Which solution meets this requirement in the MOST operationally efficient manner?

  A. Store the database credentials in AWS Secrets Manager. Configure automatic rotation for the secret every 365 days.

  B. Store the database credentials as a parameter In the RDS parameter group. Create a database trigger to rotate the password every 365 days.

  C. Store the database credentials in a private Amazon S3 bucket. Schedule an AWS Lambda function to generate a new set of credentials every 365 days.

  D. Store the database credentials in AWS Systems Manager Parameter Store as a secure string parameter. Configure automatic rotation for the parameter every 365 days.

  Correct Answer: A

• Question 202:

  A company has multiple AWS Site-to-Site VPN connections between a VPC and its branch offices. The company manages an Amazon Elasticsearch Service (Amazon ES) domain that is configured with public access. The Amazon ES domain has an open domain access policy. A SysOps administrator needs to ensure that Amazon ES can be accessed only from the branch offices while preserving existing data.

  Which solution will meet these requirements?

  A. Configure an identity-based access policy on Amazon ES. Add an allow statement to the policy that includes the Amazon Resource Name (ARN) for each branch office VPN connection.

  B. Configure an IP-based domain access policy on Amazon ES. Add an allow statement to the policy that includes the private IP CIDR blocks from each branch office network.

  C. Deploy a new Amazon ES domain in private subnets in a VPC, and import a snapshot from the old domain. Create a security group that allows inbound traffic from the branch office CIDR blocks.

  D. Reconfigure the Amazon ES domain in private subnets in a VPC. Create a security group that allows inbound traffic from the branch office CIDR blocks.

  Correct Answer: B

• Question 203:

  A SysOps administrator configuring AWS Client VPN to connect use's on a corporate network to AWS resources mat are running in a VPC According to compliance requirements, only traffic that is destined for the VPC can travel across the VPN tunnel.

  How should the SysOps administrator configure Client VPN to meet these requirements?

  A. Associate the Client VPN endpoint with a private subnet that has an internet route through a NAT gateway.

  B. On the Client VPN endpoint, turns on the split-tunnel option.

  C. On the Client VPN endpoint, specify DNS server IP addresses

  D. Select a private certificate to use as the identity certificate tor the VPN client.

  Correct Answer: B

  To meet the requirement of allowing only traffic that is destined for the VPC to travel across the VPN tunnel, the SysOps administrator should turn on the split-tunnel option on the Client VPN endpoint. This option allows only the traffic that is destined for the VPC to be routed through the VPN tunnel, while all other traffic continues to use the internet connection that is available on the client device.

• Question 204:

  A company is deploying a third-party unit testing solution that is delivered as an Amazon EC2 Amazon Machine Image (AMI). All system configuration data is stored in Amazon DynamoDB. The testing results are stored in Amazon S3.

  A minimum of three EC2 instances are required to operate the product. The company's testing team wants to use an additional three EC2 Instances when the Spot Instance prices are at a certain threshold. A SysOps administrator must

  Implement a highly available solution that provides this functionality.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Define an Amazon EC2 Auto Scaling group by using a launch configuration. Use the provided AMI In the launch configuration. Configure three On-Demand Instances and three Spot Instances. Configure a maximum Spot Instance price In the launch configuration.

  B. Define an Amazon EC2 Auto Scaling group by using a launch template. Use the provided AMI in the launch template. Configure three On-Demand Instances and three Spot Instances. Configure a maximum Spot Instance price In the launch template.

  C. Define two Amazon EC2 Auto Scaling groups by using launch configurations. Use the provided AMI in the launch configurations. Configure three On-Demand Instances for one Auto Scaling group. Configure three Spot Instances for the other Auto Scaling group. Configure a maximum Spot Instance price in the launch configuration for the Auto Scaling group that has Spot Instances.

  D. Define two Amazon EC2 Auto Scaling groups by using launch templates. Use the provided AMI in the launch templates. Configure three On-Demand Instances for one Auto Scaling group. Configure three Spot Instances for the other Auto Scaling group. Configure a maximum Spot Instance price in the launch template for the Auto Scaling group that has Spot Instances.

  Correct Answer: B

  Option B provides a straightforward and streamlined solution with the least operational overhead. Using an Amazon EC2 Auto Scaling group with a launch template allows you to define the desired instance configuration, including the AMI,

  instance type, and Spot Instance pricing, in a single template. By configuring both On-Demand and Spot Instances in the same Auto Scaling group, you ensure that the application will have the required number of instances (minimum of three)

  and that additional Spot Instances will be used when the Spot Instance prices meet the specified threshold.

  https://docs.aws.amazon.com/autoscaling/ec2/userguide/LaunchTemplates.html

  https://docs.aws.amazon.com/autoscaling/ec2/userguide/LaunchConfiguration.html

• Question 205:

  A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API calls using the CLI. However. users are not prompted to enter MFA tokens, and are able to run CLI commands without MFA. In an attempt to enforce MFA, the company attached an IAM policy to all users that denies API calls that have not been authenticated with MFA.

  What additional step must be taken to ensure that API calls are authenticated using MFA?

  A. Enable MFA on IAM roles, and require IAM users to use role credentials to sign API calls.

  B. Ask the IAM users to log into the AWS Management Console with MFA before making API calls using the CLI.

  C. Restrict the IAM users to use of the console, as MFA is not supported for CLI use.

  D. Require users to use temporary credentials from the get-session token command to sign API calls.

  Correct Answer: D

  The most appropriate step to ensure that API calls are authenticated using MFA is to require users to use temporary credentials from the get-session token command to sign API calls. This is because the get-session token command returns temporary security credentials consisting of an access key ID, a secret access key, and a session token that are valid only for a limited period of time. These credentials can be used to make API calls with MFA authentication.

• Question 206:

  A company uploaded its website files to an Amazon S3 bucket that has S3 Versioning enabled. The company uses an Amazon CloudFront distribution with the S3 bucket as the origin. The company recently modified the tiles, but the object names remained the same. Users report that old content is still appearing on the website.

  How should a SysOps administrator remediate this issue?

  A. Create a CloudFront invalidation, and add the path of the updated files.

  B. Create a CloudFront signed URL to update each object immediately.

  C. Configure an S3 origin access identity (OAI) to display only the updated files to users.

  D. Disable S3 Versioning on the S3 bucket so that the updated files can replace the old files.

  Correct Answer: A

  By default, CloudFront caches a response from Amazon S3 for 24 hours (Default TTL of 86,400 seconds). If your request lands at an edge location that served the Amazon S3 response within 24 hours, then CloudFront uses the cached response. This happens even if you updated the content in Amazon S3.

  Use one of the following ways to push the updated Amazon S3 content from CloudFront:

  1.

  Invalidate the Amazon S3 objects.

  2.

  Use object versioning https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serving-outdated-content-s3/

• Question 207:

  A global gaming company is preparing to launch a new game on AWS. The game runs in multiple AWS Regions on a fleet of Amazon EC2 instances. The instances are in an Auto Scaling group behind an Application Load Balancer (ALB) in each Region. The company plans to use Amazon Route 53 tor DNS services. The DNS configuration must direct users to the Region that is closest to mem and must provide automated failover.

  Which combination of steps should a SysOps administrator take to configure Route 53 to meet these requirements9 {Select TWO.)

  A. Create Amazon CloudWatch alarms that monitor the health of the ALB m each Region Configure Route 53 DNS failover by using a health check that monitors the alarms.

  B. Create Amazon CloudWatch alarms that monitor the hearth of the EC2 instances in each Region. Configure Route 53 DNS failover by using a health check that monitors the alarms.

  C. Configure Route 53 DNS failover by using a health check that monitors the private address of an EC2 instance in each Region.

  D. Configure Route 53 geoproximity routing Specify the Regions that are used for the infrastructure

  E. Configure Route 53 simple routing Specify the continent, country, and state or province that are used for the infrastructure.

  Correct Answer: AD

  Option B is not correct because monitoring the health of the EC2 instances is not sufficient to provide failover as the EC2 instances are in an Auto Scaling group and instances can be added or removed dynamically.

  Option C is not correct because monitoring the private IP address of an EC2 instance is not sufficient to determine the health of the infrastructure, as the instance may still be running but the application or service on the instance may be

  unhealthy.

  Option E is not correct because simple routing does not take into account geographic proximity, which is a requirement in this scenario.

• Question 208:

  A SysOps administrator is using Amazon EC2 instances to host an application. The SysOps administrator needs to grant permissions for the application to access an Amazon DynamoDB table. Which solution will meet this requirement?

  A. Create access keys to access the DynamoDB table. Assign the access keys to the EC2 instance profile.

  B. Create an EC2 key pair to access the DynamoDB table. Assign the key pair to the EC2 instance profile.

  C. Create an IAM user to access the DynamoDB table. Assign the IAM user to the EC2 instance profile.

  D. Create an IAM role to access the DynamoDB table. Assign the IAM role to the EC2 instance profile.

  Correct Answer: D

  Access to Amazon DynamoDB requires credentials. Those credentials must have permissions to access AWS resources, such as an Amazon DynamoDB table or an Amazon Elastic Compute Cloud (Amazon EC2) instance. The following sections provide details on how you can use AWS Identity and Access Management (IAM) and DynamoDB to help secure access to your resources.

  https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/authentication-and-access-control.html

• Question 209:

  A company uses Amazon Route 53 to manage the public DNS records for the domain example.com. The company deploys an Amazon CloudFront distribution to deliver static assets for a new corporate website. The company wants to create a subdomain that is named "static" and must route traffic for the subdomain to the CloudFront distribution.

  How should a SysOps administrator create a new record for the subdomain in Route 53?

  A. Create a CNAME record. Enter static.cloudfront.net as the record name. Enter the CloudFront distribution's public IP address as the value.

  B. Create a CNAME record. Enter static.example.com as the record name. Enter the CloudFront distribution's private IP address as the value.

  C. Create an A record. Enter static.cloudfront.net as the record name. Enter the CloudFront distribution's ID as an alias target.

  D. Create an A record. Enter static.example.com as the record name. Enter the CloudFront distribution's domain name as an alias target.

  Correct Answer: D

  https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html

• Question 210:

  A company's SysOps administrator deploys four new Amazon EC2 instances by using the standard Amazon Linux 2 Amazon Machine Image (AMI). The company needs to be able to use AWS Systems Manager to manage the instances The SysOps administrator notices that the instances do not appear in the Systems Manager console

  What must the SysOps administrator do to resolve this issue?

  A. Connect to each instance by using SSH Install Systems Manager Agent on each instance Configure Systems Manager Agent to start automatically when the instances start up

  B. Use AWS Certificate Manager (ACM) to create a TLS certificate Import the certificate into each instance Configure Systems Manager Agent to use the TLS certificate for secure communications

  C. Connect to each instance by using SSH Create an ssm-user account Add the ssm-user account to the /etcsudoers d directory

  D. Attach an IAM instance profile to the instances Ensure that the instance profile contains the AmazonSSMManagedinstanceCore policy

  Correct Answer: D