Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 271:

  A company has multiple Amazon EC2 instances that run a resource-intensive application in a development environment. A SysOps administrator is implementing a solution to stop these EC2 instances when they are not in use.

  Which solution will meet this requirement?

  A. Assess AWS CloudTrail logs to verify that there is no EC2 API activity. Invoke an AWS Lambda function to stop the EC2 instances.

  B. Create an Amazon CloudWatch alarm to stop the EC2 instances when the average CPU utilization is lower than 5% for a 30-minute period.

  C. Create an Amazon CloudWatch metric to stop the EC2 instances when the VolumeReadBytes metric is lower than 500 for a 30-minute period.

  D. Use AWS Config to invoke an AWS Lambda function to stop the EC2 instances based on resource configuration changes.

  Correct Answer: B

  Option B, creating an Amazon CloudWatch alarm based on CPU utilization, is a suitable solution for stopping EC2 instances when they are not in use. Here's how it works:

  Create a CloudWatch alarm: Set up a CloudWatch alarm with the desired configuration, specifying the metric to monitor (CPU utilization) and the threshold to trigger the alarm (average CPU utilization lower than 5% for a 30-minute period).

  Define the action: Configure the alarm to stop the EC2 instances when the threshold is breached. This can be done by specifying an Amazon EC2 action to stop the instances associated with the alarm.

  By implementing this solution, the EC2 instances will be automatically stopped when their average CPU utilization falls below 5% for a continuous 30-minute period. This indicates that the instances are not being actively utilized and can be safely stopped to save costs and resources.

  https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/UsingAlarmActions.html#AddingStopActions

• Question 272:

  A company is releasing a new static website hosted on Amazon S3. The static website hosting feature was enabled on the bucket and content was uploaded: however, upon navigating to the site, the following error message is received:

  403 Forbidden - Access Denied

  What change should be made to fix this error?

  A. Add a bucket policy that grants everyone read access to the bucket.

  B. Add a bucket policy that grants everyone read access to the bucket objects.

  C. Remove the default bucket policy that denies read access to the bucket.

  D. Configure cross-origin resource sharing (CORS) on the bucket.

  Correct Answer: B

  {

  "Version": "2012-10-12",

  "Statement": {

  "Sid": "PublicReadGetObject",

  "Effect": "Allow",

  "Action": [

  "s3:GetObject"

  ],

  "Principal": "*",

  "Resouce": [

  "arn:aws:s3:::example-s3-website.com/*"

  ]

  }

  }

• Question 273:

  A company is implementing a monitoring solution that is based on machine learning. The monitoring solution consumes Amazon EventBridge (Amazon CloudWatch Events) events that are generated by Amazon EC2 Auto Scaling. The monitoring solution provides detection of anomalous behavior such as unanticipated scaling events and is configured as an EventBridge (CloudWatch Events) API destination.

  During initial testing, the company discovers that the monitoring solution is not receiving events. However, Amazon CloudWatch is showing that the EventBridge (CloudWatch Events) rule is being invoked. A SysOps administrator must implement a solution to retrieve client error details to help resolve this issue. Which solution will meet these requirements with the LEAST operational effort?

  A. Create an EventBridge (CloudWatch Events) archive for the event pattern to replay the events. Increase the logging on the monitoring solution. Use replay to invoke the monitoring solution. Examine the error details.

  B. Add an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue for the target. Process the messages in the dead-letter queue to retrieve error details.

  C. Create a second EventBridge (CloudWatch Events) rule for the same event pattern to target an AWS Lambda function. Configure the Lambda function to invoke the monitoring solution and to record the results to Amazon CloudWatch Logs. Examine the errors in the logs.

  D. Configure the EventBridge (CloudWatch Events) rule to send error messages to an Amazon Simple Notification Service (Amazon SNS) topic.

  Correct Answer: A

  You can now create an encrypted archive of the events published to an event bus. You can archive all events, or filter them using the same pattern matching syntax used by EventBridge rules. You can store events indefinitely, or set up a

  retention period after which older events are automatically removed from the archive.

  You can also replay the events stored in an archive. Events are replayed to all rules defined for the event bus (but not to managed rules created by other AWS services) or to the rules you specify. Replayed events contain an extra replay-

  name field in case you need to recognize them. When starting a replay, you define a time frame, and only events within that time frame are replayed. Currently, you can only replay events to the same event bus from which they were archived.

• Question 274:

  A company needs to take an inventory of applications that are running on multiple Amazon EC2 instances. The company has configured users and roles with the appropriate permissions for AWS Systems Manager. An updated version of Systems Manager Agent has been installed and is running on every instance. While configuring an inventory collection, a SysOps administrator discovers that not all the instances in a single subnet are managed by Systems Manager.

  What must the SysOps administrator do to fix this issue?

  A. Ensure that all the EC2 instances have the correct tags for Systems Manager access.

  B. Configure AWS Identity and Access Management Access Analyzer to determine and automatically remediate the issue.

  C. Ensure that all the EC2 instances have an instance profile with Systems Manager access.

  D. Configure Systems Manager to use an interface VPC endpoint.

  Correct Answer: C

  Ensuring that all the EC2 instances have an instance profile with Systems Manager access is the most effective way to fix this issue. Having an instance profile with Systems Manager access will allow the SysOps administrator to configure the inventory collection for all the instances in the subnet, regardless of whether or not they are managed by Systems Manager.

• Question 275:

  A company is hosting applications on Amazon EC2 instances. The company is hosting a database on an Amazon RDS for PostgreSQL DB instance. The company requires all connections to the DB instance to be encrypted. What should a SysOps administrator do to meet this requirement?

  A. Allow SSL connections to the database by using an inbound security group rule.

  B. Encrypt the database by using an AWS Key Management Service (AWS KMS) encryption key.

  C. Enforce SSL connections to the database by using a custom parameter group.

  D. Patch the database with SSL/TLS by using a custom PostgreSQL extension.

  Correct Answer: C

  https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.Gener al.SSL.htm

  Amazon RDS supports SSL/TLS encryption for connections to the database, and this can be enabled by creating a custom parameter group and setting the rds.force_ssl parameter to 1. This will ensure that all connections to the database are encrypted, protecting the data and maintaining compliance with the company's requirements.l

• Question 276:

  A company creates a new member account by using AWS Organizations. A SysOps administrator needs to add AWS Business Support to the new account. Which combination of steps must the SysOps administrator take to meet this requirement? (Select TWO.)

  A. Sign in to the new account by using 1AM credentials. Change the support plan.

  B. Sign in to the new account by using root user credentials. Change the support plan.

  C. Use the AWS Support API to change the support plan.

  D. Reset the password of the account root user.

  E. Create an IAM user that has administrator privileges in the new account.

  Correct Answer: BD

  B. Sign in to the new account using root user credentials. Change the support plan.

  The root user has full access to all AWS services and resources in the account, including the ability to modify the support plan. By signing in with the root user credentials, the SysOps administrator can access the AWS Support Center and update the support plan to AWS Business Support.

  D. Reset the password of the account root user.

  Explanation: Before signing in as the root user in the new account, the SysOps administrator should ensure they have the correct password to access the root user account. If they don't have the password, they should reset it to gain access

  to the account.

  Note: Option A (Sign in to the new account using IAM credentials and change the support plan) is incorrect because the IAM user may not have the necessary permissions to modify the support plan. The root user is required for this task.

  Option C (Use the AWS Support API to change the support plan) is incorrect because although AWS Support provides APIs, using the API alone won't fulfill the requirement without having the necessary permissions, which the root user

  typically possesses.

  Option E (Create an IAM user with administrator privileges in the new account) is incorrect because while IAM users with administrator privileges have extensive permissions within the account, they don't have access to change the support plan. The root user is required for this task. https://www.salesforcexamdumps.com/soa-c02-dumps.html#:~:text=Show%20Answer-,Question%20%23%2018,-A%20company%20creates

• Question 277:

  A company recently migrated its application to a VPC on AWS. An AWS Site-to-Site VPN connection connects the company's on-premises network to the VPC. The application retrieves customer data from another system that resides on premises. The application uses an on-premises DNS server to resolve domain records. After the migration, the application is not able to connect to the customer data because of name resolution errors. Which solution will give the application the ability to resolve the internal domain names?

  A. Launch EC2 instances in the VPC. On the EC2 instances, deploy a custom DNS forwarder that forwards all DNS requests to the on-premises DNS server. Create an Amazon Route 53 private hosted zone that uses the EC2 instances for name servers.

  B. Create an Amazon Route 53 Resolver outbound endpoint. Configure the outbound endpoint to forward DNS queries against the on-premises domain to the on-premises DNS server.

  C. Set up two AWS Direct Connect connections between the AWS environment and the on-premises network. Set up a link aggregation group (LAG) that includes the two connections. Change the VPC resolver address to point to the on-premises DNS server.

  D. Create an Amazon Route 53 public hosted zone for the on-premises domain. Configure the network ACLs to forward DNS requests against the on-premises domain to the Route 53 public hosted zone.

  Correct Answer: B

  To forward DNS queries that originate on Amazon EC2 instances in one or more VPCs to your network https://docs.aws.amazon.com/zh_tw/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html

• Question 278:

  An Amazon S3 Inventory report reveals that more than 1 million objects in an S3 bucket are not encrypted These objects must be encrypted, and all future objects must be encrypted at the time they are written. Which combination of actions should a SysOps administrator take to meet these requirements? (Select TWO )

  A. Create an AWS Config rule that runs evaluations against configuration changes to the S3 bucket When an unencrypted object is found run an AWS Systems Manager Automation document to encrypt the object in place

  B. Edit the properties of the S3 bucket to enable default server-side encryption

  C. Filter the S3 Inventory report by using S3 Select to find all objects that are not encrypted Create an S3 Batch Operations job to copy each object in place with en cryption enabled

  D. Filter the S3 Inventory report by using S3 Select to find all objects that are not encrypted Send each object name as a message to an Amazon Simple Queue Service (Amazon SQS) queue Use the SQS queue to invoke an AWS Lambda function to tag each object with a key of "Encryption" and a value of "SSE-KMS"

  E. Use S3 Event Notifications to invoke an AWS Lambda function on all new object-created events for the S3 bucket Configure the Lambda function to check whether the object is encrypted and to run an AWS Systems Manager Automation document to encrypt the object in place when an unencrypted object is found

  Correct Answer: BC

  https://aws.amazon.com/blogs/storage/encrypting-objects-with-amazon-s3-batch-operations/

• Question 279:

  An errant process is known to use an entire processor and run at 100% A SysOps administrator wants to automate restarting the instance once the problem occurs for more than 2 minutes. How can this be accomplished?

  A. Create an Amazon CloudWatch alarm for the Amazon EC2 instance with basic monitoring Enable an action to restart the instance

  B. Create a CloudWatch alarm for the EC2 instance with detailed monitoring Enable an action to restart the instance

  C. Create an AWS Lambda function to restart the EC2 instance triggered on a scheduled basis every 2 minutes

  D. Create a Lambda function to restart the EC2 instance, triggered by EC2 health checks

  Correct Answer: B

• Question 280:

  A company updates its security policy to prohibit the public exposure of any data in Amazon S3 buckets in the company's account. What should a SysOps administrator do to meet this requirement?

  A. Turn on S3 Block Public Access from the account level.

  B. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to enforce that all S3 objects are private.

  C. Use Amazon Inspector to search for S3 buckets and to automatically reset S3 ACLs if any public S3 buckets are found.

  D. Use S3 Object Lambda to examine S3 ACLs and to change any public S3 ACLs to private.

  Correct Answer: A

  S3 Block Public Access is a security feature that can be enabled at the account level to prevent public access to S3 buckets and objects. It provides four settings for blocking public access, which can be applied at the account level, the bucket

  level, or the object level. By enabling this feature at the account level, all existing and future S3 buckets and objects will be protected against public access. This meets the requirement to prohibit the public exposure of any data in S3 buckets

  in the company's account.

  https://aws.amazon.com/s3/features/block-public-access/