Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 311:

  A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company's risk team must receive immediate notification about any delete events. Which solution will meet these requirements?

  A. Enable S3 server access logging for audit logs. Set up an Amazon Simple Notification Service (Amazon SNSJ notification for the S3 bucket. Select DeleteObject tor the event type for the alert system.

  B. Enable S3 server access logging for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance to download the access logs each day and to scan for a DeleteObject event.

  C. Use Amazon CloudWatch Logs for audit logs. Use Amazon CloudWatch alarms with an Amazon Simple Notification Service (Amazon SNS) notification for the alert system.

  D. Use Amazon CloudWatch Logs for audit logs. Launch an Amazon EC2 instance for The alert system. Run a cron job on the EC2 Instance each day to compare the list of the items with the list from the previous day. Configure the cron job to send a notification if an item is missing.

  Correct Answer: A

  To meet the requirements of logging all access attempts to the S3 bucket and receiving immediate notification about any delete events, the company can enable S3 server access logging and set up an Amazon Simple Notification Service (Amazon SNS) notification for the S3 bucket. The S3 server access logs will record all access attempts to the bucket, including delete events, and the SNS notification can be configured to send an alert when a DeleteObject event occurs.

• Question 312:

  A SysOps administrator is responsible for a large fleet of Amazon EC2 instances and must know whether any instances will be affected by upcoming hardware maintenance. Which option would provide this information with the LEAST administrative overhead?

  A. Deploy a third-party monitoring solution to provide real-time EC2 instance monitoring

  B. List any instances with failed system status checks using the AWS Management Console

  C. Monitor AWS CloudTrail for Stopinstances API calls

  D. Review the AWS Personal Health Dashboard

  Correct Answer: D

  By reviewing the AWS Personal Health Dashboard, the SysOps administrator can quickly and easily identify any instances that will be affected by upcoming hardware maintenance. This information can then be used to take action to mitigate the impact of the maintenance, such as by moving instances to a different Availability Zone.

  https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html

• Question 313:

  An organization is running multiple applications for their customers. Each application is deployed by running a base AWS CloudFormation template that configures a new VPC. All applications are run in the same AWS account and AWS Region. A SysOps administrator has noticed that when trying to deploy the same AWS CloudFormation stack, it fails to deploy.

  What is likely to be the problem?

  A. The Amazon Machine image used is not available in that region.

  B. The AWS CloudFormation template needs to be updated to the latest version.

  C. The VPC configuration parameters have changed and must be updated in the template.

  D. The account has reached the default limit for VPCs allowed.

  Correct Answer: D

• Question 314:

  A SysOps administrator needs to delete an AWS CloudFormation stack that is no longer in use. The CloudFormation stack is in the DELETE_FAILED state. The SysOps administrator has validated the permissions that are required to delete the Cloud Formation stack.

  A. The configured timeout to delete the stack was too low for the delete operation to complete.

  B. The stack contains nested stacks that must be manually deleted fast.

  C. The stack was deployed with the -disable rollback option.

  D. There are additional resources associated with a security group in the stack

  E. There are Amazon S3 buckets that still contain objects in the stack.

  Correct Answer: BE

  B. One possible cause of the DELETE_FAILED state is that the stack contains nested stacks, and the deletion of the parent stack cannot proceed until the nested stacks are manually deleted first. Nested stacks are separate CloudFormation stacks that are created and managed as part of the resources in the parent stack. When a parent stack is deleted, CloudFormation will attempt to delete the nested stacks, but if there are any issues, the parent stack deletion will fail.

  E. Another possible cause of the DELETE_FAILED state is that there are Amazon S3 buckets that still contain objects in the stack. If there are objects (files) present in the S3 buckets that were created as part of the CloudFormation stack, the deletion of the stack will fail. CloudFormation cannot delete the S3 buckets that have objects in them, and those buckets must be emptied or manually deleted before the stack deletion can be completed successfully.

  https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-delete-stack-fails:~:text=but%20not%20deleted-,Delete%20stack%20fails,-To%20resolve%20this

• Question 315:

  A data storage company provides a service that gives users the ability to upload and download files as needed. The files are stored in Amazon S3 Standard and must be immediately retrievable for 1 year. Users access files frequently during

  the first 30 days after the files are stored. Users rarely access files after 30 days.

  The company's SysOps administrator must use S3 Lifecycle policies to implement a solution that maintains object availability and minimizes cost.

  Which solution will meet these requirements?

  A. Move objects to S3 Glacier after 30 days.

  B. Move objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.

  C. Move objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

  D. Move objects to S3 Standard-Infrequent Access (S3 Standard-IA) immediately.

  Correct Answer: C

  https://aws.amazon.com/s3/storage-classes/

• Question 316:

  A SysOps administrator must configure a resilient tier of Amazon EC2 instances for a high performance computing (HPC) application. The HPC application requires minimum latency between nodes. Which actions should the SysOps administrator take to meet these requirements? (Select TWO.)

  A. Create an Amazon Elastic File System (Amazon EPS) file system Mount the file system to the EC2 instances by using user data

  B. Create a Multi-AZ Network Load Balancer in front of the EC2 instances

  C. Place the EC2 instances in an Auto Scaling group within a single subnet

  D. Launch the EC2 instances into a cluster placement group

  E. Launch the EC2 instances into a partition placement group

  Correct Answer: CD

  Cluster – packs instances close together inside an Availability Zone. This strategy enables workloads to achieve the low-latency network performance necessary for tightly-coupled node-to-node communication that is typical of high-performance computing (HPC) applications.

  Ref link: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

• Question 317:

  A company is migrating its production file server to AWS. All data that is stored on the file server must remain accessible if an Availability Zone becomes unavailable or when system maintenance is performed. Users must be able to interact with the file server through the SMB protocol. Users also must have the ability to manage file permissions by using Windows ACLs.

  Which solution will net these requirements?

  A. Create a single AWS Storage Gateway file gateway.

  B. Create an Amazon FSx for Windows File Server Multi-AZ file system.

  C. Deploy two AWS Storage Gateway file gateways across two Availability Zones. Configure an Application Load Balancer in front of the file gateways.

  D. Deploy two Amazon FSx for Windows File Server Single-AZ 2 file systems. Configure Microsoft Distributed File System Replication (DFSR).

  Correct Answer: B

  https://aws.amazon.com/fsx/windows/ https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html

• Question 318:

  A SysOps administrator must set up notifications for whenever combined billing exceeds a certain threshold for all AWS accounts within a company. The administrator has set up AWS Organizations and enabled Consolidated Billing. Which additional steps must the administrator perform to set up the billing alerts?

  A. In the payer account: Enable billing alerts in the Billing and Cost Management console; publish an Amazon SNS message when the billing alert triggers.

  B. In each account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in Amazon CloudWatch; publish an SNS message when the alarm triggers.

  C. In the payer account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in the Billing and Cost Management console to publish an SNS message when the alarm triggers.

  D. In the payer account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in Amazon CloudWatch; publish an SNS message when the alarm triggers.

  Correct Answer: D

• Question 319:

  An application runs on multiple Amazon EC2 instances in an Auto Scaling group The Auto Scaling group is configured to use the latest version of a launch template A SysOps administrator must devise a solution that centrally manages the application logs and retains the logs for no more than 90 days.

  Which solution will meet these requirements?

  A. Launch an Amazon Machine Image (AMI) that is preconfigured with the Amazon CloudWatch Logs agent to send logs to an Amazon S3 bucket Apply a 90-day S3 Lifecycle policy on the S3 bucket to expire the application logs

  B. Launch an Amazon Machine Image (AMI) that is preconfigured with the Amazon CloudWatch Logs agent to send logs to a log group Create an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule to perform an instance refresh every 90 days

  C. Update the launch template user data to install and configure the Amazon CloudWatch Logs agent to send logs to a log group Configure the retention period on the log group to be 90 days

  D. Update the launch template user data to install and configure the Amazon CloudWatch Logs agent to send logs to a log group Set the log rotation configuration of the EC2 instances to 90 days

  Correct Answer: C

• Question 320:

  An environment consists of 100 Amazon EC2 Windows instances The Amazon CloudWatch agent Is deployed and running on at EC2 instances with a baseline configuration file to capture log files There is a new requirement to capture the DHCP tog tiles that exist on 50 of the instances.

  What is the MOST operational efficient way to meet this new requirement?

  A. Create an additional CloudWatch agent configuration file to capture the DHCP logs Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file

  B. Log in to each EC2 instance with administrator rights Create a PowerShell script to push the needed baseline log files and DHCP log files to CloudWatch

  C. Run the CloudWatch agent configuration file wizard on each EC2 instance Verify that the base the log files are included and add the DHCP tog files during the wizard creation process

  D. Run the CloudWatch agent configuration file wizard on each EC2 instance and select the advanced detail level. This wifi capture the operating system log files.

  Correct Answer: A

  # Append configuration file (Linux) to running agent so metrics and logs listed in file are collected. (see: "Common scenarios with the CloudWatch agent") /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a append-config -m ec2 -s -c file:/tmp/app.json