Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 421:

  A SysOps administrator needs to automate the invocation of an AWS Lambda function. The Lambda function must run at the end of each day to generate a report on data that is stored in an Amazon S3 bucket.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Create an Amazon EventBridge {Amazon CloudWatch Events) rule that has an event pattern for Amazon S3 and the Lambda function as a target.

  B. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that has a schedule and the Lambda function as a target.

  C. Create an S3 event notification to invoke the Lambda function whenever objects change in the S3 bucket.

  D. Deploy an Amazon EC2 instance with a cron job to invoke the Lambda function.

  Correct Answer: B

  S3 Event notification has nothing to do here since the lambda will be triggered based on a daily schedule not every time an object is uploaded

• Question 422:

  An application team uses an Amazon Aurora MySQL DB cluster with one Aurora Replica. The application team notices that the application read performance degrades when user connections exceed 200. The number of user connections is typically consistent around 180. with occasional sudden increases above 200 connections. The application team wants the application to automatically scale as user demand increases or decreases.

  Which solution will meet these requirements?

  A. Migrate to a new Aurora multi-master DB cluster. Modify the application database connection string.

  B. Modify the DB cluster by changing to serverless mode whenever user connections exceed 200.

  C. Create an auto scaling policy with a target metric of 195 DatabaseConnections

  D. Modify the DB cluster by increasing the Aurora Replica instance size.

  Correct Answer: C

  Aurora Auto Scaling "Policy details:" (*) "Average connections of Aurora Replicas", "Target value:" 195

• Question 423:

  Application A runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are in an Auto Scaling group and are in the same subnet that is associated with the NLB. Other applications from an on-premises environment cannot communicate with Application A on port 8080.

  To troubleshoot the issue, a SysOps administrator analyzes the flow logs. The flow logs include the following records:

  

  What is the reason for the rejected traffic?

  A. The security group of the EC2 instances has no Allow rule for the traffic from the NLB.

  B. The security group of the NLB has no Allow rule for the traffic from the on-premises environment.

  C. The ACL of the on-premises environment does not allow traffic to the AWS environment.

  D. The network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range.

  Correct Answer: D

  The example from the link exactly matches "D" (other than the question example is using HTTP/8080 web proxy port instead of link ICMP example which doesn't show ports).

  Security group and network ACL rules [...]

  -

  "An ACCEPT record for the originating ping that was allowed by both the network ACL and the security group, and therefore was allowed to reach your instance."

  -

  "A REJECT record for the response ping that the network ACL denied." [...] 203.0.113.12 172.31.16.139 0 0 1 4 336 1432917027 1432917142 ACCEPT OK [...] 172.31.16.139 203.0.113.12 0 0 1 4 336 1432917094 1432917142 REJECT OK https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-security-groups

• Question 424:

  A company is partnering with an external vendor to provide data processing services. For this integration, the vendor must host the company's data in an Amazon S3 bucket in the vendor's AWS account. The vendor is allowing the company to provide an AWS Key Management Service (AWS KMS) key to encrypt the company's data. The vendor has provided an IAM role Amazon Resource Name (ARN) to the company for this integration.

  What should a SysOps administrator do to configure this integration?

  A. Create a new KMS key. Add the vendor's IAM role ARN to the KMS key policy. Provide the new KMS key ARN to the vendor.

  B. Create a new KMS key. Create a new IAM user. Add the vendor's IAM role ARN to an inline policy that is attached to the IAM user. Provide the new IAM user ARN to the vendor.

  C. Configure encryption using the KMS managed S3 key. Add the vendor's IAM role ARN to the KMS managed S3 key policy. Provide the KMS managed S3 key ARN to the vendor.

  D. Configure encryption using the KMS managed S3 key. Create an S3 bucket. Add the vendor's IAM role ARN to the S3 bucket policy. Provide the S3 bucket ARN to the vendor.

  Correct Answer: A

  By creating a new KMS key, the SysOps administrator is ensuring that the key used to encrypt the company's data is distinct and managed separately.

  The key policy is the primary resource-based policy that controls who can access and manage the key. By adding the vendor's IAM role ARN to the KMS key policy, the SysOps administrator is giving the vendor permissions to use the key,

  while keeping the control of the key.

  By providing the ARN of the new KMS key to the vendor, the vendor will be able to use that key to encrypt the company's data stored in the S3 bucket in the vendor's account.

• Question 425:

  An errant process is known to use an entire processor and run at 100%. A SysOps administrator wants to automate restarting the instance once the problem occurs for more than 2 minutes. How can this be accomplished?

  A. Create an Amazon CloudWatch alarm for the Amazon EC2 instance with basic monitoring. Enable an action to restart the instance.

  B. Create a CloudWatch alarm for the EC2 instance with detailed monitoring. Enable an action to restart the instance.

  C. Create an AWS Lambda function to restart the EC2 instance, triggered on a scheduled basis every 2 minutes.

  D. Create a Lambda function to restart the EC2 instance, triggered by EC2 health checks.

  Correct Answer: B

• Question 426:

  A company uses AWS Organizations. A SysOps administrator wants to use AWS Compute Optimizer and AWS tag policies in the management account to govern all member accounts in the billing family. The SysOps administrator navigates to the AWS Organizations console but cannot activate tag policies through the management account.

  What could be the reason for this issue?

  A. All features have not been enabled in the organization.

  B. Consolidated billing has not been enabled.

  C. The member accounts do not have tags enabled for cost allocation.

  D. The member accounts have not manually enabled trusted access for Compute Optimizer.

  Correct Answer: A

  https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies-prereqs.html

• Question 427:

  A SysOps administrator is investigating why a user has been unable to use RDP to connect over the internet from their home computer to a bastion server running on an Amazon EC2 Windows instance.

  Which of the following are possible causes of this issue? (Choose two.)

  A. A network ACL associated with the bastion's subnet is blocking the network traffic.

  B. The instance does not have a private IP address.

  C. The route table associated with the bastion's subnet does not have a route to the internet gateway.

  D. The security group for the instance does not have an inbound rule on port 22.

  E. The security group for the instance does not have an outbound rule on port 3389.

  Correct Answer: AC

• Question 428:

  A company's SysOps administrator regularly checks the AWS Personal Health Dashboard in each of the company's accounts. The accounts are part of an organization in AWS Organizations. The company recently added 10 more accounts to the organization. The SysOps administrator must consolidate the alerts from each account's Personal Health Dashboard.

  Which solution will meet this requirement with the LEAST amount of effort?

  A. Enable organizational view in AWS Health.

  B. Configure the Personal Health Dashboard in each account to forward events to a central AWS CloudTrail log.

  C. Create an AWS Lambda function to query the AWS Health API and to write all events to an Amazon DynamoDB table.

  D. Use the AWS Health API to write events to an Amazon DynamoDB table.

  Correct Answer: A

  Enabling the organizational view in AWS Health will allow the SysOps administrator to consolidate the alerts from each account's Personal Health Dashboard. It will also provide the administrator with a single view of all the accounts in the organization, allowing them to easily monitor the health of all the accounts in the organization. Reference: [1] https://aws.amazon.com/premiumsupport/knowledge-center/organizational-view-health-dashboard/

• Question 429:

  A company runs an application on an Amazon EC2 instance A SysOps administrator creates an Auto Scaling group and an Application Load Balancer (ALB) to handle an increase in demand However, the EC2 instances are failing tie health check.

  What should the SysOps administrator do to troubleshoot this issue?

  A. Verity that the Auto Scaling group is configured to use all AWS Regions.

  B. Verily that the application is running on the protocol and the port that the listens is expecting.

  C. Verify the listener priority in the ALB Change the priority if necessary.

  D. Verify the maximum number of instances in the Auto Scaling group Change the number if necessary

  Correct Answer: B

• Question 430:

  A company's financial department needs to view the cost details of each project in an AWS account A SysOps administrator must perform the initial configuration that is required to view cost for each project in Cost Explorer

  Which solution will meet this requirement?

  A. Activate cost allocation tags Add a project tag to the appropriate resources

  B. Configure consolidated billing Create AWS Cost and Usage Reports

  C. Use AWS Budgets Create AWS Budgets reports

  D. Use cost categories to define custom groups that are based on AWS cost and usage dimensions

  Correct Answer: A

  Cost allocation tags are used to track AWS costs on a detailed level. By activating cost allocation tags and adding a project tag to the appropriate resources, the financial department will be able to view the cost details of each project in Cost

  Explorer.

  https://wa.aws.amazon.com/wat.concept.costalloctag.en.html#:~:text=You%20can%20use%20tags%20to,and%20track%20your%20AWS%20costs.