Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 441:

  A company's SysOps administrator has created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instance are encrypted with AWS managed keys.

  The SysOps administrator creates an Amazon Machine Image (AMI) of the custom EC2 instance and plans to share the AMI with the company's other AWS accounts. The company requires that all AMIs are encrypted with AWS Key Management Service (AWS KMS) keys and that only authorized AWS accounts can access the shared AMIs.

  Which solution will securely share the AMI with the other AWS accounts?

  A. In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms ReEncrypf, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.

  B. In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*. kms:CreateGrant, and kms;Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI. and specify the CMK. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with.

  C. In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescrlbeKey, kms:ReEncrypt\ kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI. and specify the CMK. Modify the permissions on the copied AMI to make it public.

  D. In the account where the AMI was created, modify the key policy of the AWS managed key to provide kms:DescnbeKey. kms:ReEncrypt\ kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.

  Correct Answer: B

  Things to note: you have an EC2 instance with encrypted EBS volumes with AWS managed keys (key point right here). Then, you create an AMI from this EC2 instance. This means it will be encrypted with that same AWS managed key. The requirement is simple, use KMS managed keys and only share with authorized accounts. Now the options:

  A- This starts good as you need a customer managed KMS key to be able to change the policy and add those kms actions to the other AWS accounts, however, that won't help with your AMI since it's still encrypted with the AWS managed

  key.

  C - this sounds good right up until the end, public kills it. even though they won't have the actions, you don't want to make it public.

  D - can't be D, you cannot modify the policy on a AWS managed key.

  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html

• Question 442:

  The security team is concerned because the number of AWS Identity and Access Management (IAM) policies being used in the environment is increasing. The team tasked a SysOps administrator to report on the current number of IAM policies in use and the total available IAM policies.

  Which AWS service should the administrator use to check how current IAM policy usage compares to current service limits?

  A. AWS Trusted Advisor

  B. Amazon Inspector

  C. AWS Config

  D. AWS Organizations

  Correct Answer: A

  Reference: https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html#iam-policies

• Question 443:

  A company runs a web application on three Amazon EC2 instances behind an Application Load Balancer (ALB). The company notices that random periods of increased traffic cause a degradation in the application's performance. A SysOps administrator must scale the application to meet the increased traffic.

  Which solution meets these requirements?

  A. Create an Amazon CloudWatch alarm to monitor application latency and increase the size of each EC2 instance If the desired threshold is reached.

  B. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to monitor application latency and add an EC2 instance to the ALB if the desired threshold is reached.

  C. Deploy the application to an Auto Scaling group of EC2 instances with a target tracking scaling policy. Attach the ALB to the Auto Scaling group.

  D. Deploy the application to an Auto Scaling group of EC2 instances with a scheduled scaling policy. Attach the ALB to the Auto Scaling group.

  Correct Answer: C

• Question 444:

  A company runs us Infrastructure on Amazon EC2 Instances that run In an Auto Scaling group. Recently, the company promoted faulty code to the entire EC2 fleet. This faulty code caused the Auto Scaling group to scale the instances before any of the application logs could be retrieved.

  What should a SysOps administrator do to retain the application logs after instances are terminated?

  A. Configure an Auto Scaling lifecycle hook to create a snapshot of the ephemeral storage upon termination of the instances.

  B. Create a new Amazon Machine Image (AMI) that has the Amazon CloudWatch agent installed and configured to send logs to Amazon CloudWatch Logs. Update the launch template to use the new AMI.

  C. Create a new Amazon Machine Image (AMI) that has a custom script configured to send logs to AWS CloudTrail. Update the launch template to use the new AMI.

  D. Install the Amazon CloudWatch agent on the Amazon Machine Image (AMI) that is defined in the launch template. Configure the CloudWatch agent to back up the logs to ephemeral storage.

  Correct Answer: B

• Question 445:

  A SysOps administrator configures an Amazon S3 gateway endpoint in a VPC. The private subnets inside the VPC do not nave outbound internet access. A user logs in to an Amazon EC2 instance in one of the private subnets and cannot upload a file to an Amazon S3 bucket in the same AWS Region.

  Which solution will solve this problem?

  A. Update the EC2 instance role policy to allow s3:PutObjed access to the target S3 bucket.

  B. Update the EC2 security group to allow outbound traffic to 0.0.0.070 for port 80.

  C. Update the EC2 subnet route table to include the S3 prefix list destination routes to the S3 gateway endpoint.

  D. Update the S3 bucket policy to allow s3 PurObject access from the private subnet CIDR block.

  Correct Answer: C

  https://repost.aws/knowledge-center/connect-s3-vpc-endpoint#:~:text=An%20outbound%20rule%20allowing%20traffic%20to%20the%20ID%20of%20the%20prefix%20list%20associated%20with%20the%20gateway%20VPC%20endpoint.

• Question 446:

  A company needs to view a list of security groups that are open to the internet on port 3389. What should a SysOps administrator do to meet this requirement?

  A. Configure Amazon GuardDuly to scan security groups and report unrestricted access on port 3389.

  B. Configure a service control policy (SCP) to identify security groups that allow unrestricted access on port 3389

  C. Use AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.

  D. Use AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389.

  Correct Answer: D

• Question 447:

  A database is running on an Amazon RDS Mufti-AZ DB instance. A recent security audit found the database to be out of compliance because it was not encrypted. Which approach will resolve the encryption requirement?

  A. Log in to the RDS console and select the encryption box to encrypt the database

  B. Create a new encrypted Amazon EBS volume and attach it to the instance

  C. Encrypt the standby replica in the secondary Availability Zone and promote it to the primary instance.

  D. Take a snapshot of the RDS instance, copy and encrypt the snapshot and then restore to the new RDS instance

  Correct Answer: D

• Question 448:

  A SysOps administrator needs to configure a solution that will deliver digital content to a set of authorized users through Amazon CloudFront. Unauthorized users must be restricted from access.

  Which solution will meet these requirements?

  A. Store the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed URLs to access the S3 bucket through CloudFront.

  B. Store the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Restrict S3 bucket access with signed URLs in CloudFront.

  C. Store the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Enable field-level encryption.

  D. Store the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed cookies for restricted delivery of the content through CloudFront.

  Correct Answer: B

  Option B is the correct solution because it uses an origin access identity (OAI) to restrict access to the S3 bucket, ensuring that only CloudFront can access the content. Public access is blocked on the S3 bucket, preventing unauthorized users from accessing the content directly. Signed URLs can also be used to restrict access further within CloudFront. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html

• Question 449:

  A company is tunning a website on Amazon EC2 instances thai are in an Auto Scaling group When the website traffic increases, additional instances lake several minutes to become available because ot a long-running user data script that installs software A SysOps administrator must decrease the time that is required (or new instances to become available.

  Which action should the SysOps administrator take to meet this requirement?

  A. Reduce the scaling thresholds so that instances are added before traffic increases

  B. Purchase Reserved Instances to cover 100% of the maximum capacity of the Auto Scaling group

  C. Update the Auto Scaling group to launch instances that have a storage optimized instance type

  D. Use EC2 Image Builder to prepare an Amazon Machine Image (AMI) that has pre- installed software

  Correct Answer: D

  automated way to update your image. Have a pipeline to update your image. When you boot from your AMI updates = scrits are already pre-installed, so no need to complete boot scripts in boot process. https://aws.amazon.com/image-builder/

• Question 450:

  A company needs to deploy a new workload on AWS. The company must encrypt all data at rest and must rotate the encryption keys once each year. The workload uses an Amazon RDS for MySQL Multi-AZ database for data storage. Which configuration approach will meet these requirements?

  A. Enable Transparent Data Encryption (TDE) in the MySQL configuration file. Manually rotate the key every 12 months.

  B. Enable RDS encryption on the database at creation time by using the AWS managed key for Amazon RDS.

  C. Create a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable RDS encryption on the database at creation time by using the KMS key.

  D. Create a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the RDS DB instance.

  Correct Answer: C

  This configuration approach will meet the requirement of encrypting all data at rest and rotating the encryption keys once each year. By creating a new AWS KMS customer managed key and enabling automatic key rotation, the encryption keys will be rotated automatically every year. By enabling RDS encryption on the database at creation time using the KMS key, all data stored in the RDS for MySQL Multi-AZ database will be encrypted at rest. This approach provide more control over key management and rotation and provide additional security benefits.