Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 321:

  A company wants to be alerted through email when IAM CreateUser API calls are made within its AWS account.

  Which combination of actions should a SysOps administrator take to meet this requirement? (Choose two.)

  A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the event source and IAM CreateUser as the specific API call for the event pattern.

  B. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with Amazon CloudSearch as the event source and IAM CreateUser as the specific API call for the event pattern.

  C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS IAM Access Analyzer as the event source and IAM CreateUser as the specific API call for the event pattern.

  D. Use an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email subscription.

  E. Use an Amazon Simple Email Service (Amazon SES) notification as an event target with an email subscription.

  Correct Answer: AD

  https://aws.amazon.com/blogs/security/how-to-receive-alerts-when-your-iam-configuration-changes/

• Question 322:

  A company runs its entire suite of applications on Amazon EC2 instances. The company plans to move the applications to containers and AWS Fargate. Within 6 months, the company plans to retire its EC2 instances and use only Fargate. The company has been able to estimate its future Fargate costs.

  A SysOps administrator needs to choose a purchasing option to help the company minimize costs. The SysOps administrator must maximize any discounts that are available and must ensure that there are no unused reservations.

  Which purchasing option will meet these requirements?

  A. Compute Savings Plans for 1 year with the No Upfront payment option

  B. Compute Savings Plans for 1 year with the Partial Upfront payment option

  C. EC2 Instance Savings Plans for 1 year with the All Upfront payment option

  D. EC2 Reserved Instances for 1 year with the Partial Upfront payment option

  Correct Answer: B

  Given the company's plan to move to Fargate within 6 months and retire EC2 instances, it might be more cost-efficient to choose Option A (No Upfront payment). This way, the company avoids any upfront commitment and can easily transition to Fargate without being tied to EC2 instances. Savings Plans apply to both EC2 and Fargate, making it a suitable option for the planned migration.

• Question 323:

  A company hosts a database on an Amazon RDS Multi-AZ DB instance. The database is not encrypted. The company's new security policy requires all AWS resources to be encrypted at rest and in transit.

  What should a SysOps administrator do to encrypt the database?

  A. Configure encryption on the existing DB instance.

  B. Take a snapshot of the DB instance. Encrypt the snapshot. Restore the snapshot to the same DB instance.

  C. Encrypt the standby replica in a secondary Availability Zone. Promote the standby replica to the primary DB instance.

  D. Take a snapshot of the DB instance. Copy and encrypt the snapshot. Create a new DB instance by restoring the encrypted copy.

  Correct Answer: B

• Question 324:

  An organization with a large IT department has decided to migrate to AWS With different job functions in the IT department it is not desirable to give all users access to all AWS resources Currently the organization handles access via LDAP group membership

  What is the BEST method to allow access using current LDAP credentials?

  A. Create an AWS Directory Service Simple AD Replicate the on-premises LDAP directory to Simple AD

  B. Create a Lambda function to read LDAP groups and automate the creation of IAM users

  C. Use AWS CloudFormation to create IAM roles Deploy Direct Connect to allow access to the on-premises LDAP server

  D. Federate the LDAP directory with IAM using SAML Create different IAM roles to correspond to different LDAP groups to limit permissions

  Correct Answer: D

• Question 325:

  A SysOps administrator has enabled AWS CloudTrail in an AWS account. If CloudTrail is disabled, it must be re-enabled immediately. What should the SysOps administrator do to meet these requirements WITHOUT writing custom code?

  A. Add the AWS account to AWS Organizations. Enable CloudTrail in the management account.

  B. Create an AWS Config rule that is invoked when CloudTrail configuration changes. Apply the AWS-ConfigureCloudTrailLogging automatic remediation action.

  C. Create an AWS Config rule that is invoked when CloudTrail configuration changes. Configure the rule to invoke an AWS Lambda function to enable CloudTrail.

  D. Create an Amazon EventBridge (Amazon CloudWatch Events) hourly rule with a schedule pattern to run an AWS Systems Manager Automation document to enable CloudTrail.

  Correct Answer: B

• Question 326:

  A SysOps administrator needs to track the costs of data transfer between AWS Regions. The SysOps administrator must implement a solution to send alerts to an email distribution list when transfer costs reach 75% of a specific threshold.

  What should the SysOps administrator do to meet these requirements?

  A. Create an AWS Cost and Usage Report. Analyze the results in Amazon Athena. Configure an alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when costs reach 75% of the threshold. Subscribe the email distribution list to the topic.

  B. Create an Amazon CloudWatch billing alarm to detect when costs reach 75% of the threshold. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email distribution list to the topic.

  C. Use AWS Budgets to create a cost budget for data transfer costs. Set an alert at 75% of the budgeted amount. Configure the budget to send a notification to the email distribution list when costs reach 75% of the threshold.

  D. Set up a VPC flow log. Set up a subscription filter to an AWS Lambda function to analyze data transfer. Configure the Lambda function to send a notification to the email distribution list when costs reach 75% of the threshold.

  Correct Answer: C

  Option A (Create an AWS Cost and Usage Report. Analyze the results in Amazon Athena. Configure an alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when costs reach 75% of the threshold. Subscribe the email distribution list to the topic.) is a bit complex and not directly related to tracking data transfer costs between AWS Regions. AWS Cost and Usage Reports and Amazon Athena are typically used for analyzing detailed cost and usage data, but they are not the most straightforward solution for this specific requirement.

  Option B (Create an Amazon CloudWatch billing alarm to detect when costs reach 75% of the threshold. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email distribution list to the topic.) is focused on billing alarms, which can track costs, but it may not specifically address data transfer costs between AWS Regions.

• Question 327:

  A software development company has multiple developers who work on the same product. Each developer must have their own development environment, and these development environments must be identical. Each development environment consists of Amazon EC2 instances and an Amazon RDS DB instance. The development environments should be created only when necessary, and they must be terminated each night to minimize costs.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Provide developers with access to the same AWS CloudFormation template so that they can provision their development environment when necessary. Schedule a nightly cron job on each development instance to stop all running processes to reduce CPU utilization to nearly zero.

  B. Provide developers with access to the same AWS CloudFormation template so that they can provision their development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to delete the AWS CloudFormation stacks.

  C. Provide developers with CLI commands so that they can provision their own development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to terminate all EC2 instances and the DB instance.

  D. Provide developers with CLI commands so that they can provision their own development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to cause AWS CloudFormation to delete all of the development environment resources.

  Correct Answer: B

  This solution allows each developer to easily create an identical development environment when they need it by using the CloudFormation template. AWS CloudFormation templates are a great way to version and standardize infrastructure, and can be used to create and manage a collection of related AWS resources.

  The EventBridge rule scheduled to trigger the Lambda function ensures that all resources associated with each CloudFormation stack are deleted every night, minimizing unnecessary costs.

• Question 328:

  A company hosts a web application on an Amazon EC2 instance. The web server logs are published to Amazon CloudWatch Logs. The log events have the same structure and include the HTTP response codes that are associated with the

  user requests. The company needs to monitor the number of times that the web server returns an HTTP 404 response.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Create a CloudWatch Logs metric filter that counts the number of times that the web server returns an HTTP 404 response.

  B. Create a CloudWatch Logs subscription filter that counts the number of times that the web server returns an HTTP 404 response.

  C. Create an AWS Lambda function that runs a CloudWatch Logs Insights query that counts the number of 404 codes in the log events during the past hour.

  D. Create a script that runs a CloudWatch Logs Insights query that counts the number of 404 codes in the log events during the past hour.

  Correct Answer: A

  This is the most operationally efficient solution that meets the requirements, as it will allow the company to monitor the number of times that the web server returns an HTTP 404 response in real-time. The other solutions (creating a CloudWatch Logs subscription filter, an AWS Lambda function, or a script) will require additional steps and resources to monitor the number of times that the web server returns an HTTP 404 response.

  A metric filter allows you to search for specific terms, phrases, or values in your log events, and then to create a metric based on the number of occurrences of those search terms. This allows you to create a CloudWatch Metric that can be used to create alarms and dashboards, which can be used to monitor the number of HTTP 404 responses returned by the web server.

• Question 329:

  A company runs several workloads on AWS. The company identifies five AWS Trusted Advisor service quota metrics to monitor in a specific AWS Region. The company wants to receive email notification each time resource usage exceeds 60% of one of the service quotas.

  Which solution will meet these requirements?

  A. Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of one of the service quotas.

  B. Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification each time that usage exceeds 60% of one of the service quotas.

  C. Use the AWS Service Health Dashboard to monitor each Trusted Advisor service quota metric. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification each time that usage exceeds 60% of one of the service quotas.

  D. Use the AWS Service Health Dashboard to monitor each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of one of the service quotas.

  Correct Answer: A

  Amazon CloudWatch allows you to set up alarms on various metrics, including service quota metrics from AWS Trusted Advisor. In this case, the company wants to monitor five Trusted Advisor service quota metrics in a specific AWS Region and receive email notifications when resource usage exceeds 60% of any of these quotas.

  Option D is incorrect because it mentions using the AWS Service Health Dashboard to monitor service quota metrics. While the Service Health Dashboard provides information about the overall health of AWS services, it does not provide specific monitoring capabilities for individual service quota metrics as required in this scenario.

• Question 330:

  A company stores critical data m Amazon S3 buckets. A SysOps administrator must build a solution to record all S3 API activity. Which action will meet this requirement?

  A. Configure S3 bucket metrics to record object access logs

  B. Create an AWS CloudTrail trail to log data events tor all S3 objects

  C. Enable S3 server access logging for each S3 bucket

  D. Use AWS IAM Access Analyzer for Amazon S3 to store object access logs.

  Correct Answer: B