Amazon Amazon Certifications SOA-C02 Questions & Answers

• Question 61:

  A user is connected to an Amazon EC2 instance in a private subnet. The user is unable to access the internet from the instance by using the following curl command: curl http:/www.example.com.

  A SysOps administrator reviews the VPC configuration and learns the following information:

  1.

  The private subnet has a route to a NAT gateway for CIDR 0.0.0.0/0

  2.

  The outbound security group for the EC2 instance contains one rule: outbound for port 443 to CIDR 0.0.0.0/0

  3.

  The inbound security group for the EC2 instance allows ports 22 and 443 from the user's IP address.

  4.

  The inbound network ACL for the subnet allows port 22 and port range 1024-65535 from CIDR 0.0.0.0/0

  Which action will allow the user to complete the curl request successfully?

  A. Add an additional inbound network ACL rule for port 80 to CIDR 0.0.0.0/0.

  B. Add an additional inbound security group rule for port 80 to CIDR 0.0.0.0/0.

  C. Add an additional outbound security group rule for port 80 to CIDR 0.0.0.0/0.

  D. Add an additional outbound security group rule for port 80 to the user's IP address.

  Correct Answer: C

• Question 62:

  A SysOps administrator launches an Amazon EC2 instance in a private subnet of a VPC. When the SysOps administrator attempts a curl command from the command line of the EC2 instance, the SysOps administrator cannot connect to https:www.example.com.

  What should the SysOps administrator do to resolve this issue?

  A. Ensure that there is an outbound security group for port 443 to 0.0.0.0/0.

  B. Ensure that there is an inbound security group for port 443 from 0.0.0.0/0.

  C. Ensure that there is an outbound network ACL for ephemeral ports 1024-66535 to 0.0.0.0/0.

  D. Ensure that there is an outbound network ACL for port 80 to 0.0.0.0/0.

  Correct Answer: A

  Inbound security group rules control the inbound traffic to an EC2 instance.

  Since the SysOps administrator is attempting a curl command from the EC2 instance to access a website on port 443 (HTTPS), an inbound security group rule needs to be added to allow incoming traffic on port 443. Option B suggests adding

  an inbound security group rule for port 443 from 0.0.0.0/0, which allows traffic from any IP address to access the EC2 instance on port 443. This will enable the SysOps administrator to establish an outbound connection from the EC2 instance

  to www.example.com on port 443 and access the website successfully. Therefore, by adding an inbound security group rule for port 443 from 0.0.0.0/0, the SysOps administrator can resolve the issue and establish a connection to https://

  www.example.com.

• Question 63:

  A company is experiencing issues with legacy software running on Amazon EC2 instances. Errors occur when the total CPU utilization on the EC2 instances exceeds 80%. A short-term solution is required while the software is being rewritten. A SysOps administrator is tasked with creating a solution to restart the instances when the CPU utilization rises above 80%.

  Which solution meets these requirements with the LEAST operational overhead?

  A. Write a script that monitors the CPU utilization of the EC2 instances and reboots the instances when utilization exceeds 80%. Run the script as a cron job.

  B. Add an Amazon CloudWatch alarm for CPU utilization and configure the alarm action to reboot the EC2 instances.

  C. Create an Amazon EventBridge rule using the predefined patterns for CPU utilization of the EC2 instances. When utilization exceeds 80%, invoke an AWS Lambda function to restart the instances.

  D. Add an Amazon CloudWatch alarm for CPU utilization and configure an AWS Systems Manager Automation runbook to reboot the EC2 instances when utilization exceeds 80%.

  Correct Answer: B

  https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/UsingAlarmActions.html "For Whenever this alarm, choose State is ALARM. For Take this action, choose Reboot this instance."

• Question 64:

  A SysOps administrator needs to implement a backup strategy for Amazon EC2 resources and Amazon RDS resources. The backup strategy must meet the following retention requirements:

  1.

  Daily backups: must be kept for 6 days

  2.

  Weekly backups: must be kept for 4 weeks:

  3.

  Monthly backups: must be kept for 11 months

  4.

  Yearly backups: must be kept for 7 years

  Which backup strategy will meet these requirements with the LEAST administrative effort?

  A. Use Amazon Data Lifecycle Manager to create an Amazon Elastic Block Store (Amazon EBS) snapshot policy. Create tags on each resource that needs to be backed up. Create multiple schedules according to the requirements within the policy. Set the appropriate frequency and retention period.

  B. Use AWS Backup to create a new backup plan for each retention requirement with a backup frequency of daily, weekly, monthly, or yearly. Set the retention period to match the requirement. Create tags on each resource that needs to be backed up. Set up resource assignment by using the tags.

  C. Create an AWS Lambda function. Program the Lambda function to use native tooling to take backups of file systems in Amazon EC2 and to make copies of databases in Amazon RDS. Create an Amazon EventBridge rule to invoke the Lambda function.

  D. Use Amazon Data Lifecycle Manager to create an Amazon Elastic Block Store (Amazon EBS) snapshot policy. Create tags on each resource that needs to be backed up. Set up resource assignment by using the tags. Create multiple schedules according to the requirements within the policy. Set the appropriate frequency and retention period. In Amazon RDS, activate automated backups on the required DB instances.

  Correct Answer: B

  Has to be AWS Backup since "EBS snapshot" isn't mentioned in requirements.

  "Use Amazon Data Lifecycle Manager when you want to automate the creation, retention, and deletion of EBS snapshots. Use AWS Backup to manage and monitor backups across the AWS services you use, including EBS volumes, from a

  single plac"

  https://aws.amazon.com/backup/faqs/

• Question 65:

  A company's SysOps administrator manages a fleet of Windows Amazon EC2 instances that run in a single AWS account. The instances have a tag that includes a key of "OS" and a value of "Windows." The company uses AWS Systems Manager to patch the instances.

  The company has installed the Amazon CloudWatch agent on the instances, but the configuration is inconsistent. The SysOps administrator needs to reconfigure every instance to use the same predefined CloudWatch configuration.

  Which combination of steps will meet these requirements? (Choose two.)

  A. Store the CloudWatch agent configuration file in an Amazon S3 bucket.

  B. Store the contents of the CloudWatch agent configuration file in Systems Manager OpsCenter.

  C. Store the contents of the CloudWatch agent configuration file in Systems Manager Parameter Store.

  D. Create a Systems Manager State Manager association to run the AmazonCloudWatch-ManageAgent Systems Manager Run Command document. Select Systems Manager as an optional configuration source. Target the instances based on tag values.

  E. Create a Systems Manager State Manager association to run the AmazonCloudWatch-ManageAgent Systems Manager Run Command document. Configure the document to use the S3 bucket location as the configuration source. Target the instances based on tag value.

  Correct Answer: CD

• Question 66:

  A company decides to stop non-production Amazon EC2 instances during the EC2 instances. The company's IT manager must receive notification in near real time whenever an EC2 instance that has an environment type tag value of non-production is started during the night.

  Which solution will meet this requirement with the MOST operational efficiency?

  A. Configure an AWS Lambda function with an SMTP client library. Subscribe the Lambda function to the AWS Health Dashboard to receive notification whenever an EC2 instance is in the running state. Configure the Lambda function to use Amazon Pinpoint to send email notifications to the IT manager. Deploy a second Lambda function to throttle calls from the first Lambda function during the daytime.

  B. Deploy an AWS Lambda function that queries the Amazon EC2 API to determine the state of each EC2 instance. Use the EC2 instance scheduler to configure the Lambda function to run every minute during the night and to send an email notification to the IT manager for each non-production EC2 instance that is in the running state.

  C. Create an Amazon EventBridge rule that includes the EC2 Instance State-change Notification event type. Filter the event to capture only the running state. Create an AWS Lambda function as a target of the rule. Configure the Lambda function to check the current time and the EC2 instances' tags to determine the environment type. Create an Amazon Simple Notification Service (Amazon SNS) topic as a target of the Lambda function for notifications. Subscribe the IT manager's email address to the SNS topic.

  D. Store the EC2 instance metadata, including the environment type, in an Amazon DynamoDB table. Deploy a custom application to an EC2 instance. Configure the custom application to poll the DynamoDB data every minute during the night and to query the Amazon EC2 API to determine the state of each instance. Additionally, configure the custom application to send an email notification to the IT manager for each non-production EC2 instance that is in the running state.

  Correct Answer: C

• Question 67:

  A company wants to track its expenditures for Amazon EC2 and Amazon RDS within AWS. The company decides to implement more rigorous tagging requirements for resources in its AWS accounts. A SysOps administrator needs to identify all noncompliant resources.

  What is the MOST operationally efficient solution that meets this requirement?

  A. Create a rule in Amazon EventBridge that invokes a custom AWS Lambda function that will evaluate all created or updated resources for the specified tags.

  B. Create a rule in AWS Config that invokes a custom AWS Lambda function that will evaluate all resources for the specified tags.

  C. Create a rule in AWS Config with the required-tags managed rule to evaluate all resources for the specified tags.

  D. Create a rule in Amazon EventBridge with a managed rule to evaluate all created or updated resources for the specified tags.

  Correct Answer: C

  required-tags "Checks if your resources have the tags that you specify. For example, you can check whether your Amazon EC2 instances have the CostCenter tag." https://docs.aws.amazon.com/config/latest/developerguide/requiredtags.html

• Question 68:

  A company creates a new Amazon FSx for Windows File Server file system. To help manage costs, the company configures the storage capacity for the file system with minimal room for growth.

  The company creates an Amazon Simple Notification Service (Amazon SNS) topic in the same AWS account whore the file system resides. The company subscribes a SysOps administrator's email address to the SNS topic. The SysOps administrator needs to receive email notification when the file system has less than 100 GB of space available.

  Which combination of steps should the SysOps administrator take to meet this requirement? (Choose two.)

  A. Create an Amazon EventBridge rule for when the FreeStorageCapacity metric is less than or equal to 100,000,000,000 bytes (100 GB).

  B. Create an Amazon CloudWatch alarm for when the FreeStorageCapacity metric is less than or equal to 100,000,000,000 bytes (100 GB).

  C. Create an AWS Lambda function that will run when the Amazon CloudWatch alarm enters ALARM state. Configure the Lambda function to publish to the SNS topic.

  D. Configure the Amazon EventBridge rule's alarm action to publish to the SNS topic when the rule enters ALARM state.

  E. Configure the Amazon CloudWatch alarm action to publish to the SNS topic when the alarm enters ALARM state.

  Correct Answer: BE

  The following are the steps involved in creating an Amazon CloudWatch alarm and configuring it to publish to an Amazon SNS topic:

  Go to the Amazon CloudWatch console.

  In the navigation pane, choose Alarms.

  Choose Create alarm.

  In the Alarm details section, do the following:

  For Metric, choose Amazon FSx for Windows File Server.

  For Namespace, choose FSxWindowsFileServer.

  For Metric name, choose FreeStorageCapacity.

  For Statistic, choose Average.

  For Threshold, enter 100,000,000,000.

  For Evaluation period, choose 1 minute.

  For Alarm actions, choose Add action and then choose SNS topic.

  In the Select an SNS topic dialog box, choose the SNS topic that you created for the SysOps administrator.

  Choose Create alarm.

  Once the alarm is created, it will start monitoring the FreeStorageCapacity metric for the Amazon FSx for Windows File Server file system. If the metric falls below the threshold that you specified, the alarm will enter ALARM state and publish

  a notification to the SNS topic. The SysOps administrator will then receive an email notification that the file system is running low on space.

• Question 69:

  A SysOps administrator manages an AWS account where developers run CPU-intensive tasks on Amazon EC2 instances. The tasks can take several days to finish running and sometimes need to be repeated several times. The developers often forget to terminate the instances when the tasks are complete.

  The SysOps administrator needs to implement a solution to monitor EC2 CPU utilization and automatically terminate underutilized instances.

  Which solution will meet these requirements?

  A. Configure an Amazon GuardDuty finding that is based on EC2 CPU utilization. Associate an AWS Lambda function with the GuardDuty finding to terminate any instances that are identified as idle.

  B. Configure an Amazon Simple Notification Service (Amazon SNS) topic to receive EC2 utilization messages from the AWS Health Dashboard. Create an AWS Lambda function. Subscribe the Lambda function to the SNS topic. Use the ec2.stop_instances operation to terminate idle instances.

  C. Configure a Low Utilization Amazon EC2 Instances check in AWS Trusted Advisor to publish status changes to an Amazon Simple Notification Service (Amazon SNS) topic. Create an AWS Lambda function. Subscribe the Lambda function to the SNS topic. Use the ec2.stop_instances operation to terminate idle instances.

  D. Configure an Amazon EventBridge rule for the Low Utilization Amazon EC2 Instances check in AWS Trusted Advisor. Select the EC2 Terminatelnstances API call as the target.

  Correct Answer: D

• Question 70:

  A company has several business units that want to use Amazon EC2. The company wants to require all business units to provision their EC2 instances by using only approved EC2 instance configurations.

  What should a SysOps administrator do to implement this requirement?

  A. Create an EC2 instance launch configuration. Allow the business units to launch EC2 instances by specifying this launch configuration in the AWS Management Console.

  B. Develop an IAM policy that limits the business units to provision EC2 instances only. Instruct the business units to launch instances by using an AWS CloudFormation template.

  C. Publish a product and launch constraint role for EC2 instances by using AWS Service Catalog. Allow the business units to perform actions in AWS Service Catalog only.

  D. Share an AWS CloudFormation template with the business units. Instruct the business units to pass a role to AWS CloudFormation to allow the service to manage EC2 instances.

  Correct Answer: C