Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 331:

  A company has a stateless application that runs on four Amazon EC2 instances. The application requires tour instances at all times to support all traffic. A SysOps administrator must design a highly available, fault-tolerant architecture that continually supports all traffic if one Availability Zone becomes unavailable.

  Which configuration meets these requirements?

  A. Deploy two Auto Scaling groups in two Availability Zones with a minimum capacity of two instances in each group.

  B. Deploy an Auto Scaling group across two Availability Zones with a minimum capacity of four instances.

  C. Deploy an Auto Scaling group across three Availability Zones with a minimum capacity of four instances.

  D. Deploy an Auto Scaling group across three Availability Zones with a minimum capacity of six instances.

  Correct Answer: C

• Question 332:

  A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network.

  What actions should the SysOps administrator take to meet these requirements?

  A. Create a VPC endpoint for the S3 bucket, and create an IAM policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.

  B. Create a VPC endpoint for the S3 bucket, and create an S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.

  C. Create a service-linked role for Amazon EC2 that allows the EC2 instances to interact directly with Amazon S3, and attach an IAM policy to the role that allows the EC2 instances full access to the S3 bucket.

  D. Create a NAT gateway in the VPC, and modify the VPC route table to route all traffic destined for Amazon S3 through the NAT gateway.

  Correct Answer: B

  While IAM policy (letter A) also can be used, it does not enforce everyone. The only option that enforces everyone is policy configured directly in the bucket S3.

• Question 333:

  A company hosts its website in the us-east-1 Region. The company is preparing to deploy its website into the eu-central-1 Region. Website visitors who are located in Europe should access the website that is hosted in eu-central-1. All other visitors access the website that is hosted in us-east-1. The company uses Amazon Route 53 to manage the website's DNS records.

  Which routing policy should a SysOps administrator apply to the Route 53 record set to meet these requirements?

  A. Geolocation routing policy

  B. Geoproximity routing policy

  C. Latency routing policy

  D. Multivalue answer routing policy

  Correct Answer: A

  geolocation "Geolocation routing lets you choose the resources that serve your traffic based on the geographic location of your users, meaning the location that DNS queries originate from. For example, you might want all queries from Europe to be routed to an ELB load balancer in the Frankfurt region."

  Could be confused with geoproximity - "Geoproximity routing lets Amazon Route 53 route traffic to your resources based on the geographic location of your users and your resources. You can also optionally choose to route more traffic or less to a given resource by specifying a value, known as a bias. A bias expands or shrinks the size of the geographic region from which traffic is routed to a resource" the use case is not needed as per question.

  https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html

• Question 334:

  A company has a stateless application that is hosted on a fleet of 10 Amazon EC2 On- Demand Instances in an Auto Scaling group. A minimum of 6 instances are needed to meet service requirements.

  Which action will maintain uptime for the application MOST cost-effectively?

  A. Use a Spot Fleet with an On-Demand capacity of 6 instances.

  B. Update the Auto Scaling group with a minimum of 6 On-Demand Instances and a maximum of 10 On-Demand Instances.

  C. Update the Auto Scaling group with a minimum of 1 On-Demand Instance and a maximum of 6 On-Demand Instances.

  D. Use a Spot Fleet with a target capacity of 6 instances.

  Correct Answer: A

• Question 335:

  A SysOps administrator is maintaining a web application using an Amazon CloudFront web distribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All services have logging enabled. The administrator needs to investigate HTTP Layer 7 status codes from the web application.

  Which log sources contain the status codes? (Choose two.)

  A. VPC Flow Logs

  B. AWS CloudTrail logs

  C. ALB access logs

  D. CloudFront access logs

  E. RDS logs

  Correct Answer: CD

  "C" because Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

  "D" because "you can configure CloudFront to create log files that contain detailed information about every user request that CloudFront receives" https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html

• Question 336:

  A company is running an application on premises and wants to use AWS for data backup All of the data must be available locally The backup application can write only to block- based storage that is compatible with the Portable Operating System Interface (POSIX).

  Which backup solution will meet these requirements?

  A. Configure the backup software to use Amazon S3 as the target for the data backups

  B. Configure the backup software to use Amazon S3 Glacier as the target for the data backups

  C. Use AWS Storage Gateway, and configure it to use gateway-cached volumes

  D. Use AWS Storage Gateway, and configure it to use gateway-stored volumes

  Correct Answer: D

  Volume Gateway provides an iSCSI target, which enables you to create block storage volumes and mount them as iSCSI devices from your on-premises or EC2 application servers. The Volume Gateway runs in either a cached or stored

  mode.

  In the cached mode, your primary data is written to S3, while retaining your frequently accessed data locally in a cache for low-latency access.

  In the stored mode, your primary data is stored locally and your entire dataset is available for low-latency access while asynchronously backed up to AWS

  https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html

• Question 337:

  A company is using an AWS KMS customer master key (CMK) with imported key material The company references the CMK by its alias in the Java application to encrypt data The CMK must be rotated every 6 months

  What is the process to rotate the key?

  A. Enable automatic key rotation for the CMK and specify a period of 6 months

  B. Create a new CMK with new imported material, and update the key alias to point to the new CMK.

  C. Delete the current key material, and import new material into the existing CMK

  D. Import a copy of the existing key material into a new CMK as a backup, and set the rotation schedule for 6 months

  Correct Answer: B

  Rotation date

  AWS KMS rotates key material one year (approximately 365 days) after rotation is enabled, and then every year (approximately 365 days) thereafter.

  Customer managed keys

  Because automatic key rotation is optional on customer managed keys and can be enabled and disabled at any time, the rotation date depends on the date that rotation was most recently enabled. That date can change many times over the

  life of the key.

  For example, if you create a customer managed key on January 1, 2022, and enable automatic key rotation on March 15, 2022, AWS KMS rotates the key material on March 15, 2023, March 15, 2024, and every 365 days thereafter.

• Question 338:

  A company is managing multiple AWS accounts in AWS Organizations The company is reviewing internal security of Its AWS environment The company's security administrator has their own AWS account and wants to review the VPC configuration of developer AWS accounts.

  Which solution will meet these requirements in the MOST secure manner?

  A. Create an IAM policy in each developer account that has read-only access related to VPC resources Assign the policy to an IAM user Share the user credentials with the security administrator

  B. Create an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions Assign the policy to an IAM user Share the user credentials with the security administrator

  C. Create an IAM policy in each developer account that has administrator access related to VPC resources Assign the policy to a cross-account IAM role Ask the security administrator to assume the role from their account

  D. Create an IAM policy m each developer account that has read-only access related to VPC resources Assign the policy to a cross-account IAM role Ask the security administrator to assume the role from their account

  Correct Answer: D

  The most secure way for the security administrator to review the VPC configuration of developer AWS accounts would be to create an IAM policy in each developer account that has read-only access related to VPC resources and assign the policy to a cross-account IAM role. The security administrator can then assume the role from their own account to review the VPC configuration. This approach avoids sharing user credentials and provides the security administrator with the necessary permissions to review the VPC configuration without granting unnecessary access.

• Question 339:

  A company runs an application on Amazon EC2 instances. The EC2 instances are in an Auto Scaling group and run behind an Application Load Balancer (ALB). The application experiences errors when total requests exceed 100 requests per second. A SysOps administrator must collect information about total requests for a 2-week period to determine when requests exceeded this threshold.

  What should the SysOps administrator do to collect this data?

  A. Use the ALB's RequestCount metric. Configure a time range of 2 weeks and a period of 1 minute. Examine the chart to determine peak traffic times and volumes.

  B. Use Amazon CloudWatch metric math to generate a sum of request counts for all the EC2 instances over a 2-week period. Sort by a 1-minute interval.

  C. Create Amazon CloudWatch custom metrics on the EC2 launch configuration templates to create aggregated request metrics across all the EC2 instances.

  D. Create an Amazon EventBridge (Amazon CloudWatch Events) rule. Configure an EC2 event matching pattern that creates a metric that is based on EC2 requests. Display the data in a graph.

  Correct Answer: A

  The ALB's RequestCount metric provides the total number of requests processed by the ALB. By configuring a time range of 2 weeks with a 1-minute period, you can collect detailed data on request counts for each minute over the 2-week period. This will allow the SysOps administrator to visualize the traffic patterns and identify peak times when the requests exceeded the threshold of 100 requests per second.

• Question 340:

  A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted.

  What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?

  A. Set up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.

  B. Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.

  C. Create an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.

  D. Use AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.

  Correct Answer: B

  If you're using AWS Organizations, check the service control policies for any statements that explicitly deny Amazon S3 access. In particular, check the service control policies for statements denying the s3:PutBucketPolicy action.

  https://aws.amazon.com/tw/premiumsupport/knowledge-center/s3-access-denied-bucket-policy/

  https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html