Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 451:

  An organization created an Amazon Elastic File System (Amazon EFS) volume with a file system ID of fs-85ba4Kc. and it is actively used by 10 Amazon EC2 hosts The organization has become concerned that the file system is not encrypted.

  How can this be resolved?

  A. Enable encryption on each host's connection to the Amazon EFS volume Each connection must be recreated for encryption to take effect

  B. Enable encryption on the existing EFS volume by using the AWS Command Line Interface

  C. Enable encryption on each host's local drive Restart each host to encrypt the drive

  D. Enable encryption on a newly created volume and copy all data from the original volume Reconnect each host to the new volume

  Correct Answer: D

  https://docs.aws.amazon.com/efs/latest/ug/encryption.html Amazon EFS supports two forms of encryption for file systems, encryption of data in transit and encryption at rest. You can enable encryption of data at rest when creating an Amazon EFS file system. You can enable encryption of data in transit when you mount the file system.

• Question 452:

  A SysOps administrator is deploying a test site running on Amazon EC2 instances. The application requires both incoming and outgoing connectivity to the internet. Which combination of steps are required to provide internet connectivity to the EC2 instances? (Choose two.)

  A. Add a NAT gateway to a public subnet.

  B. Attach a private address to the elastic network interface on the EC2 instance.

  C. Attach an Elastic IP address to the internet gateway.

  D. Add an entry to the route table for the subnet that points to an internet gateway.

  E. Create an internet gateway and attach it to a VPC.

  Correct Answer: DE

  https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html

• Question 453:

  A company uses AWS Organizations to manage multiple AWS accounts. The company's SysOps team has been using a manual process to create and manage 1AM roles. The team requires an automated solution to create and manage the necessary 1AM roles for multiple AWS accounts.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Create AWS CloudFormation templates. Reuse the templates to create the necessary 1AM roles in each of the AWS accounts.

  B. Use AWS Directory Service with AWS Organizations to automatically associate the necessary 1AM roles with Microsoft Active Directory users.

  C. Use AWS Resource Access Manager with AWS Organizations to deploy and manage shared resources across the AWS accounts.

  D. Use AWS CloudFormation StackSets with AWS Organizations to deploy and manage 1AM roles for the AWS accounts.

  Correct Answer: D

• Question 454:

  A company maintains a large set of sensitive data in an Amazon S3 bucket. The company's security team asks a SyeOps administrator to help verify that all current objects in the S3 bucket are encrypted. What is the MOST operationally efficient solution that meets these requirements?

  A. Create a script that runs against the S3 bucket and outputs the status of each object.

  B. Create an S3 Inventory configuration on the S3 bucket Induce the appropriate status fields.

  C. Provide the security team with an IAM user that has read access to the S3 bucket.

  D. Use the AWS CLI to output a list of all objects in the S3 bucket.

  Correct Answer: B

  The S3 Inventory feature provides a detailed report of objects and their metadata for an S3 bucket, which includes encryption status. By creating an S3 Inventory configuration on the S3 bucket and including the appropriate status fields, the security team can efficiently verify that all current objects in the S3 bucket are encrypted.

• Question 455:

  A SysOps administrator is configuring an application on Amazon EC2 instances for a company Teams in other countries will use the application over the internet. The company requires the application endpoint to have a static pubic IP address.

  How should the SysOps administrator deploy the application to meet this requirement?

  A. Behind an Amazon API Gateway API

  B. Behind an Application Load Balancer

  C. Behind an internet-facing Network Load Balancer

  D. In an Amazon CloudFront distribution

  Correct Answer: C

• Question 456:

  A SysOps administrator is responsible for a legacy. CPU-heavy application The application can only be scaled vertically Currently, the application is deployed on a single t2 large Amazon EC2 instance The system is showing 90% CPU usage and significant performance latency after a few minutes.

  What change should be made to alleviate the performance problem?

  A. Change the Amazon EBS volume to Provisioned lOPs

  B. Upgrade to a compute-optimized instance

  C. Add additional t2.large instances to the application.

  D. Purchase Reserved Instances

  Correct Answer: B

  Since the application is CPU-heavy and can only be scaled vertically, the best option to alleviate the performance problem would be to upgrade to a compute-optimized instance. Compute-optimized instances provide a higher ratio of vCPUs to memory than other families and are optimized for compute-bound applications that benefit from high-performance processors. Upgrading to a compute-optimized instance would provide more CPU resources for the application, which should help alleviate the performance problem.

• Question 457:

  A company needs to view a list of security groups that are open to the internet on port 3389. What should a SysOps administrator do to meet this requirement?

  A. Configure Amazon GuardDuty to scan security groups and report unrestricted access on port 3389.

  B. Configure a service control policy (SCP) to identify security groups that allow unrestricted access on port 3389.

  C. Use AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.

  D. Use AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389.

  Correct Answer: D

  AWS Trusted Advisor is a service that provides best practice recommendations to help optimize your AWS environment. It can detect security-related issues, including security groups with overly permissive rules. In this case, it can help you identify security groups that are open to the internet on port 3389, which is the Remote Desktop Protocol (RDP) port.

  By using AWS Trusted Advisor, the SysOps administrator can quickly access a list of security groups that have this unrestricted access configuration. This allows them to review and take necessary actions to tighten the security settings and restrict access as needed.

• Question 458:

  A company is managing many accounts by using a single organization in AWS Organizations. The organization has all features enabled. The company wants to turn on AWS Config in all the accounts of the organization and in all AWS Regions.

  What should a Sysops administrator do to meet these requirements in the MOST operationally efficient way?

  A. Use AVVS CloudFormation StackSets to deploy stack instances that turn on AWS Config in all accounts and in all Regions.

  B. Use AWS CloudFormation StackSets to deploy stack policies that turn on AWS Config in all accounts and in all Regions.

  C. Use service control policies (SCPs) to configure AWS Config in all accounts and in all Regions.

  D. Create a script that uses the AWS CLI to turn on AWS Config in all accounts in the organization. Run the script from the organization's management account.

  Correct Answer: A

  Option A (Use AWS CloudFormation Stack Sets to deploy stack instances that turn on AWS Config in all accounts and in all Regions) is the best option for achieving the goal in a highly efficient and scalable manner. AWS CloudFormation Stack Sets allow you to deploy CloudFormation stacks across multiple accounts and Regions in a single operation. By defining a stack that enables AWS Config and using Stack Sets, you can easily enable AWS Config in all accounts and Regions within the AWS organization.

  Option B (Use AWS CloudFormation Stack Sets to deploy stack policies that turn on AWS Config in all accounts and in all Regions) is not the correct option. Stack policies are used to control what actions can be performed on a CloudFormation stack, but they are not suitable for enabling AWS Config across multiple accounts and Regions.

• Question 459:

  A SysOps administrator has created an AWS Service Catalog portfolio and has shared the portfolio with a second AWS account in the company. The second account is controlled by a different administrator. Which action will the administrator of the second account be able to perform?

  A. Add a product from the imported portfolio to a local portfolio.

  B. Add new products to the imported portfolio.

  C. Change the launch role for the products contained in the imported portfolio.

  D. Customize the products in the imported portfolio.

  Correct Answer: A

  When you share a portfolio using account-to-account sharing or AWS Organizations, you allow an AWS Service Catalog administrator of another AWS account to import your portfolio into his or her account and distribute the products to end users in that account.

  https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing.html

• Question 460:

  A company uses an AWS CloudFormation template to provision an Amazon EC2 instance and an Amazon RDS DB instance A SysOps administrator must update the template to ensure that the DB instance is created before the EC2 instance is launched

  What should the SysOps administrator do to meet this requirement?

  A. Add a wait condition to the template Update the EC2 instance user data script to send a signal after the EC2 instance is started

  B. Add the DependsOn attribute to the EC2 instance resource, and provide the logical name of the RDS resource

  C. Change the order of the resources in the template so that the RDS resource is listed before the EC2 instance resource

  D. Create multiple templates Use AWS CloudFormation StackSets to wait for one stack to complete before the second stack is created

  Correct Answer: B

  Syntax The DependsOn attribute can take a single string or list of strings. "DependsOn" : [ String, ... ] Example The following template contains an AWS::EC2::Instance resource with a DependsOn attribute that specifies myDB, an AWS::RDS::DBInstance. When CloudFormation creates this stack, it first creates myDB, then creates Ec2Instance. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html