Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 41:

  A company runs a web application that users access using the name www example com. The company manages the domain name example.com using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application through CloudFront.

  What is the MOST cost-effective way to achieve this?

  A. Create a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL.

  B. Create an ALIAS record in Amazon Route 53 that points to the CioudFront distribution URL.

  C. Create an A record in Amazon Route 53 that points to the public IP address of the web application,

  D. Create a PTR record in Amazon Route 53 that points to the public IP address of the web application.

  Correct Answer: B

  apex zone= ALias

• Question 42:

  A company has set up an IPsec tunnel between its AWS environment and its on-premises data center. The tunnel is reporting as UP, but the Amazon EC2 instances are not able to ping any on-premises resources. What should a SysOps administrator do to resolve this issue?

  A. Create a new inbound rule on the EC2 instances' security groups to allow ICMP traffic from the on-premises CIDR.

  B. Create a peering connection between the IPsec tunnel and the subnet of the EC2 instances.

  C. Enable route propagation for the virtual private gateway in the route table that is assigned to the subnet of the EC2 instances.

  D. Modify the VPC's DHCP options set. Add the IPsec tunnel to the VPN section.

  Correct Answer: C

  C: Enabling route propagation for the virtual private gateway in the route table associated with the subnet of the EC2 instances will allow the VPC route table to learn and propagate the routes for the on-premises network. This ensures that the EC2 instances know how to reach the on-premises resources through the IPsec tunnel.

• Question 43:

  A SysOps administrator is configuring Amazon CloudWatch alarms. A particular is constantly in the ALARM state. What could be the reason for this issue?

  A. Alarms continue to evaluate metrics against configured thresholds, even after they are triggered.

  B. After alarms are triggered, they remain in the ALARM state until they are manually disabled.

  C. After an alarm is triggered and an action is performed, the application logic must reset the alarm to its normal state.

  D. The alarm is not receiving appropriate metrics.

  Correct Answer: A

  For any period of one minute or longer, an alarm is evaluated every minute and the evaluation is based on the window of time defined by the Period and Evaluation Periods. For example, if the Period is 5 minutes (300 seconds) and Evaluation Periods is 1, then at the end of minute 5 the alarm evaluates based on data from minutes 1 to 5. Then at the end of minute 6, the alarm is evaluated based on the data from minutes 2 to 6.

• Question 44:

  A company's security policy states that connecting to Amazon EC2 instances is not permitted through SSH and ROP. If access is required, authorized staff can connect to instances by using AWS Systems Manager Session Manager.

  Users report that they are unable to connect to one specific Amazon EC2 instance that is running Ubuntu and has AWS Systems Manager Agent (SSM Agent) pre-installed. These users are able to use Session Manager to connect to other

  instances in the same subnet, and they are in an IAM group that has Session Manager permission for all instances.

  What should a SysOps administrator do to resolve this issue?

  A. Add an inbound rule for port 22 in the security group associated with the Ubuntu instance.

  B. Assign the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile for the Ubuntu instance.

  C. Configure the SSM Agent to log in with a user name of "ubuntu".

  D. Generate a new key pair, configure Session Manager to use this new key pair, and provide the private key to the users.

  Correct Answer: B

  By assigning the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile associated with the Ubuntu instance, you grant the necessary permissions for the instance to communicate with AWS Systems Manager. This policy includes the required permissions for Session Manager to establish connections to EC2 instances.

• Question 45:

  A company has an application that runs behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon Route 53 record set contains an alias record for app.anycompany.com that references the ALB in us-west-2 and uses a simple routing policy. The application is experiencing an increase in users from other locations in the world. These users are experiencing high latency.

  Most of the new users are close to the ap-southeast-2 Region. The company deploys a copy of the application to ap-southeast-2. A SysOps administrator must implement a solution that automatically routes requests to the lowest latency endpoint for users without changing the URL.

  Which solution will meet these requirements?

  A. Add a new value to the existing alias record for app.anycompany.com with the DNS name of the new ALB in ap-southeast-2.

  B. Change the existing alias record to use a geolocation routing policy. Create two geolocation records, one record that references each ALSelect the location that is closest to each Region.

  C. Change the existing alias record to use a latency routing policy. Create two latency records, one record that references each ALB.

  D. Change the existing alias record to use a multivalue routing policy Add the DNS name of each ALB to the record.

  Correct Answer: C

  To automatically route requests to the lowest latency endpoint for users without changing the URL, the SysOps administrator should change the existing alias record to use a latency routing policy and create two latency records, one record that references each ALB. With a latency routing policy, Amazon Route 53 routes traffic to the endpoint with the lowest latency for the user. This will ensure that users are automatically routed to the endpoint with the lowest latency, improving their experience.

• Question 46:

  A company runs a high performance computing (HPC) application on an Amazon EC2 instance. The company needs to scale this architecture to two or more EC2 instances. The EC2 instances will need to communicate with each other at

  high speeds with low latency to support the application.

  The company wants to ensure that the network performance can support the required communication between the EC2 instances

  What should a SysOps administrator do to meet these requirements?

  A. Create a cluster placement group. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Restore the EC2 instance from the AMI into the placement group. Launch the additional EC2 instances into the placement group.

  B. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Create a launch template from the existing EC2 instance by specifying the AMI. Create an Auto Scaling group and configure the desired instance count.

  C. Create a Network Load Balancer (NLB) and a target group. Launch the new EC2 instances and register them with the target group. Register the existing EC2 instance with the target group. Pass all application traffic through the NLB.

  D. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Create additional clones of the EC2 instance from the AMI in the same Availability Zone where the existing EC2 instance is located.

  Correct Answer: A

  low latency = Cluster Placement Group

• Question 47:

  A developer creates an AWS Lambda function that runs when an object is put into an Amazon S3 bucket. The function reformats the object and places the object back into the S3 bucket. During testing, the developer notices a recursive invocation loop. The developer asks a SysOps administrator to immediately stop the recursive invocations.

  What should the SysOps administrator do to stop the loop without errors?

  A. Delete all the objects from the S3 bucket.

  B. Set the function's reserved concurrency to 0.

  C. Update the S3 bucket policy to deny access for the function.

  D. Publish a new version of the function.

  Correct Answer: B

  Monitoring applications for recursive invocation

  Whenever you have a Lambda function writing objects back to the same S3 bucket that triggered the event, it's best practice to limit the scaling in the development and testing phases. Use reserved concurrency to limit a function's scaling, for

  example. Setting the function's reserved concurrency to a lower limit prevents the function from scaling concurrently beyond that limit. It does not prevent the recursion, but limits the resources consumed as a safety mechanism.

  https://aws.amazon.com/blogs/compute/avoiding-recursive-invocation-with-amazon-s3-and-aws-lambda/

• Question 48:

  A company hosts an internet web application on Amazon EC2 instances. The company is replacing the application with a new AWS Lambda function. During a transition period, the company must route some traffic to the legacy application and some traffic to the new Lambda function. The company needs to use the URL path of request to determine the routing.

  Which solution will meet these requirements?

  A. Configure a Gateway Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.

  B. Configure a Network Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.

  C. Configure a Network Load Balancer to use a regular expression to match the URL path to direct traffic to the new Lambda function.

  D. Configure an Application Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.

  Correct Answer: D

  Application load balancer as ALB only supports targets like EC2 Instance, IP Address and Lambda

• Question 49:

  A company has a secure website running on Amazon EC2 instances behind an Application Load Balancer (ALB). An SSL certificate from AWS Certificate Manager (ACM) is used on the ALB. Users with legacy web browsers are experiencing issues with the website.

  How should the SysOps administrator resolve these issues in the MOST operationally efficient manner?

  A. Create a new SSL certificate in ACM and install the new certificate on the ALB to support legacy web browsers.

  B. Create a second ALB and install a custom SSL certificate with a different domain name on the second ALB to support legacy web browsers.

  C. Remove the ALB from the configuration and install a custom SSL certificate on each web server.

  D. Update the SSL negotiation configuration of the ALB with a security policy that contains ciphers for legacy web browsers.

  Correct Answer: D

  A client TLS negotiation error means that a TLS connection initiated by the client was unable to establish a session with the load balancer. TLS negotiation errors occur when clients try to connect to a load balancer using a protocol or cipher that the load balancer's security policy doesn't support. To establish a TLS connection, be sure that your client supports the following: One or more matching ciphers A protocol specified in the security policy

• Question 50:

  ASysOps administrator configures an application to run on Amazon EC2 instances behind an Application Load Balancer (ALB) in a simple scaling Auto Scaling group with the default settings. The Auto Scaling group is configured to use the RequestCountPerTarget metric for scaling. The SysOps administrator notices that the RequestCountPerTarget metric exceeded the specified limit twice in 180 seconds.

  How will the number of EC2 instances in this Auto Scaling group be affected in this scenario?

  A. The Auto Scaling group will launch an additional EC2 instance every time the RequestCountPerTarget metric exceeds the predefined limit.

  B. The Auto Scaling group will launch one EC2 instance and will wait for the default cooldown period before launching another instance.

  C. The Auto Scaling group will send an alert to the ALB to rebalance the traffic and not add new EC2 instances until the load is normalized.

  D. The Auto Scaling group will try to distribute the traffic among all EC2 instances before launching another instance.

  Correct Answer: B

  When the RequestCountPerTarget metric exceeds the specified limit, the Auto Scaling group will launch an additional EC2 instance to handle the increased load. However, after launching an instance, the Auto Scaling group will wait for the default cooldown period before launching another instance. The cooldown period is a configurable setting that helps ensure that the Auto Scaling group doesn't launch or terminate additional instances before the previous scaling activity takes effect.