Amazon SOA-C02 Online Practice Questions and Exam Preparation

Amazon SOA-C02 Online Questions & Answers

• Question 641:

  A SysOps administrator receives an alert from Amazon GuardDuty about suspicious network activity on an Amazon EC2 instance. The GuardDuty finding lists a new external IP address as a traffic destination. The SysOps administrator does not recognize the external IP address. The SysOps administrator must block traffic to the external IP address that GuardDuty identified.

  Which solution will meet this requirement?

  A. Create a new security group to block traffic to the external IP address. Assign the new security group to the EC2 instance.
  B. Use VPC flow logs with Amazon Athena to block traffic to the external IP address.
  C. Create a network ACL. Add an outbound deny rule for traffic to the external IP address.
  D. Create a new security group to block traffic to the external IP address. Assign the new security group to the entire VPC.
  C. Create a network ACL. Add an outbound deny rule for traffic to the external IP address.

  ---

  Explanation Explanation/Reference:https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

• Question 642:

  A global company operates out of five AWS Regions. A SysOps administrator wants to identify all the company's tagged and untagged Amazon EC2 instances.

  The company requires the output to display the instance ID and tags.

  What is the MOST operationally efficient way for the SysOps administrator to meet these requirements?

  A. Create a tag-based resource group in AWS Resource Groups.
  B. Use AWS Trusted Advisor. Export the EC2 On-Demand Instances check results from Trusted Advisor.
  C. Use Cost Explorer. Choose a service type of EC2-Instances, and group by Resource.
  D. Use Tag Editor in AWS Resource Groups. Select all Regions, and choose a resource type of AWS::EC2::Instance.
  D. Use Tag Editor in AWS Resource Groups. Select all Regions, and choose a resource type of AWS::EC2::Instance.

  ---

  With Tag Editor, you build a query to find resources in one or more AWS Regions that are available for tagging. You can choose up to 20 individual resource types, or build a query on All resource types. Your query can include resources that already have tags, or resources that have no tags. https://docs.aws.amazon.com/ARG/latest/userguide/find-resources-to-tag.html

• Question 643:

  A SysOps administrator needs to configure the Amazon Route 53 hosted zone for example.com and www.example.com to point to an Application Load Balancer (ALB). Which combination of actions should the SysOps administrator take to meet these requirements? (Choose two.)

  A. Configure an A record for example.com to point to the IP address of the ALB.
  B. Configure an A record for www.example.com to point to the IP address of the ALB.
  C. Configure an alias record for example.com to point to the CNAME of the ALB.
  D. Configure an alias record for www.example.com to point to the Route 53 example.com record.
  E. Configure a CNAME record for example.com to point to the CNAME of the ALB.
  C. Configure an alias record for example.com to point to the CNAME of the ALB.
  D. Configure an alias record for www.example.com to point to the Route 53 example.com record.

• Question 644:

  A company stores files on 50 Amazon S3 buckets in the same AWS Region. The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost.

  Which solution will meet these requirements?

  A. Create a gateway VPC endpoint for each S3 bucket. Attach the gateway VPC endpoints to each subnet inside the VPC.
  B. Create an interface VPC endpoint for each S3 bucket. Attach the interface VPC endpoints to each subnet inside the VPC.
  C. Create one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table.
  D. Create one interface VPC endpoint for all the S3 buckets. Add the interface VPC endpoint to the VPC route table.
  C. Create one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table.

  ---

  A gateway VPC endpoint allows you to connect to Amazon S3 from your VPC without requiring an internet gateway, NAT gateway, or VPN connection. It provides a private connection to Amazon S3 over your Amazon VPC using Amazon's private network. Since the company wants to connect to 50 Amazon S3 buckets securely over a private connection from its Amazon EC2 instances in the same AWS Region, creating one gateway VPC endpoint for all the S3 buckets is the most efficient and cost-effective solution. By creating one gateway VPC endpoint, you can connect to all S3 buckets in the same Region without the need to create multiple VPC endpoints for each bucket, thus reducing complexity and avoiding additional costs

• Question 645:

  A company is building a web application on AWS. The company is using Amazon CloudFront with a domain name of www.example.com. All traffic to CloudFront must be encrypted in transit. The company already has provisioned an SSL certificate for www.example.com in AWS Certificate Manager (ACM).

  Which combination of steps should a SysOps administrator take to encrypt the traffic in transit? (Choose two.)

  A. For each cache behavior in the CloudFront distribution, modify the Viewer Protocol Policy setting to redirect HTTP to HTTPS.
  B. For each cache behavior in the CloudFront distribution, modify the Viewer Protocol Policy setting to allow HTTP and HTTPS.
  C. Enter the alternate domain name (CNAME) of www.example.com for the CloudFront distribution. Select the custom SSL certificate.
  D. Configure an AWS WAF web ACL for the CloudFront distribution.
  E. Configure CloudFront Origin Shield for the CloudFront origin.
  A. For each cache behavior in the CloudFront distribution, modify the Viewer Protocol Policy setting to redirect HTTP to HTTPS.
  C. Enter the alternate domain name (CNAME) of www.example.com for the CloudFront distribution. Select the custom SSL certificate.

  ---

  Explanation Explanation/Reference:On the settings when you create a new CF distribution the second parameter is Alternate domain name (CNAME) - optional here you can add the domain name you will use to access to the CF distribution. And in the bahavior config you need to check "Redirect HTTP to HTTPS" option in the viewer protocol policy.

• Question 646:

  A company uses AWS Organizations to manage multiple AWS accounts. The company's SysOps team has been using a manual process to create and manage IAM roles. The team requires an automated solution to create and manage the necessary IAM roles for multiple AWS accounts.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Create AWS CloudFormation templates. Reuse the templates to create the necessary IAM roles in each of the AWS accounts.
  B. Use AWS Directory Service with AWS Organizations to automatically associate the necessary IAM roles with Microsoft Active Directory users.
  C. Use AWS Resource Access Manager with AWS Organizations to deploy and manage shared resources across the AWS accounts.
  D. Use AWS CloudFormation StackSets with AWS Organizations to deploy and manage IAM roles for the AWS accounts.
  D. Use AWS CloudFormation StackSets with AWS Organizations to deploy and manage IAM roles for the AWS accounts.

• Question 647:

  A software company runs a workload on Amazon EC2 instances behind an Application Load Balancer (ALB) A SysOcs administrator needs to define a custom health check for the EC2 instances. What is the MOST operationally efficient solution?

  A. Set up each EC2 Instance so that it writes its healthy/unhealthy status into a shared Amazon S3 bucket for the ALB to read
  B. Configure the health check on the ALB and ensure that the HeathCheckPath setting is correct
  C. Set up Amazon ElasticCache to track the EC2 instances as they scale in and out
  D. Configure an Amazon API Gateway health check to ensure custom checks on aw of the EC2 instances
  B. Configure the health check on the ALB and ensure that the HeathCheckPath setting is correct

• Question 648:

  The SysOps administrator needs to prevent launching EC2 instances without a specific tag in the application OU.

  A. Create an IAM group that has a policy allowing ec2:RunInstances when the CostCenter- Project tag is present. Place all IAM users in this group.
  B. Create a service control policy (SCP) that denies ec2:RunInstances when the CostCenter-Project tag is missing. Attach the SCP to the application OU.
  C. Create an IAM role with a policy that allows ec2:RunInstances when the CostCenter- Project tag is present. Attach the IAM role to users in the application OU accounts.
  D. Create a service control policy (SCP) that denies ec2:RunInstances when the CostCenter-Project tag is missing. Attach the SCP to the root OU.
  B. Create a service control policy (SCP) that denies ec2:RunInstances when the CostCenter-Project tag is missing. Attach the SCP to the application OU.

• Question 649:

  The SysOps administrator needs to resolve high disk I/O issues during the bootstrap process of Nitro-based EC2 instances in an Auto Scaling group with gp3 EBS volumes.(Select TWO):

  A. Increase the EC2 instance size.
  B. Increase the EBS volume capacity.
  C. Increase the EBS volume IOPS.
  D. Increase the EBS volume throughput.
  E. Change the instance type to an instance that is not Nitro-based.
  C. Increase the EBS volume IOPS.
  D. Increase the EBS volume throughput.

• Question 650:

  A company wants to track its AWS costs in all member accounts that are part of an organization in AWS Organizations. Managers of the member accounts want to receive a notification when the estimated costs exceed a predetermined amount each month. The managers are unable to configure a billing alarm. The IAM permissions for all users are correct.

  What could be the cause of this issue?

  A. The management/payer account does not have billing alerts turned on.
  B. The company has not configured AWS Resource Access Manager (AWS RAM) to share billing information between the member accounts and the management/payer account.
  C. Amazon GuardDuty is turned on for all the accounts.
  D. The company has not configured an AWS Config rule to monitor billing.
  A. The management/payer account does not have billing alerts turned on.