SOA-C01 questions and answers

A user is displaying the CPU utilization, and Network in and Network out CloudWatch metrics data of a single instance on the same graph. The graph uses one Y-axis for CPU utilization and Network in and another Y-axis for Network out. Since Network in is too high, the CPU utilization data is not visible clearly on graph to the user.

How can the data be viewed better on the same graph?

A company runs an Amazon RDS MySQL DB instance. Corporate policy requires that a daily backup of the database must be copied to a separate security account.

What is the MOST cost-effective way to meet this requirement?

A security audit revealed that the security groups in a VPC have ports 22 and 3389 open to all, introducing a possible threat that instances can be stopped or configurations can be modified. A sysops administrator needs to automate remediation.

What should the sysops administrator do to meet these requirements?

In AWS, which security aspects are the customer's responsibility? (Choose four.)

A SysOps Administrator maintains several Amazon EC2 instances that do not have access to the public internet. To patch operating systems, the instances require outbound internet connectivity. For security reasons, the instances should not be reachable from the public Internet.

The Administrator deploys a NAT instance, updates the security groups, and configures the appropriate routes within the route table. However, the instances are still unable to reach the Internet.

What should be done to resolve the issue?

A company's finance department wants to receive a monthly report showing AWS resource usage by department.

Which solution should be used to meet the requirements?

A company with dozens of AWS accounts wants to ensure that governance rules are being applied across all accounts. The CIO has recommended that AWS Config rules be deployed using an AWS CloudFormation template.

How should these requirements be met?

A company is using an AWS KMS customer master key (CMK) with imported key material. The company references the CMK by its alias in the Java application to encrypt data. The CMK must be rotated every 6 months.

What is the process to rotate the key?

You have private video content in S3 that you want to serve to subscribed users on the Internet. User IDs, credentials, and subscriptions are stored in an Amazon RDS database.

Which configuration will allow you to securely serve private content to your users?

A company has received a notification in its AWS Personal Health Dashboard that one of its Amazon EBS-backed Amazon EC2 instances is on hardware that is scheduled for maintenance. The instance runs a critical production workload that must be available during normal business hours.

Which steps will ensure that the instance maintenance does not produce an outage?

A company relies on a fleet of Amazon EC2 instances to support an application. One of the EC2 instances was scheduled for hardware maintenance by AWS. An operations team did not remove the EC2 instance from the fleet in advance of the scheduled maintenance, and an unplanned outage resulted. A SysOps administrator must configure notifications to let the operations team know about scheduled maintenance in the future.

Which action should the SysOps administrator take to meet this requirement?

You have identified network throughput as a bottleneck on your m1.small EC2 instance when uploading data Into Amazon S3 In the same region.

How do you remedy this situation?

A company is deploying a legacy web application on Amazon EC2 instances behind an ELB Application Load Balancer. The application worked well in the test environment. However, in production, users report that they are prompted to log in to the system several times an hour.

Which troubleshooting step should be taken to help resolve the problem reported by users?

A SysOps Administrator has received a request to enable access logging for a Network Load Balancer and is setting up an Amazon S3 bucket to store the logs.

What are the MINIMUM requirements for the S3 bucket? (Choose two.)

Pricing is ____ consumed for EC2 instances.

A user has created a web application with Auto Scaling. The user is regularly monitoring the application and he observed that the traffic is highest on Thursday and Friday between 8 AM to 6 PM.

What is the best solution to handle scaling in this case?

A streaming services company has a three-tier web application hosted on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). When the Auto Scaling group scales in, a deregistration delay occurs and the delay is sometimes longer than the time required to terminate the EC2 instance. A SysOps administrator must ensure that the latest logs are delivered to an external system

before the EC2 instance is terminated.

Which solution will solve this problem?

A user has set the Alarm for the CPU utilization > 50%. Due to an internal process, the current CPU utilization will be 80% for 6 hours.

How can the user ensure that the CloudWatch alarm does not perform any action?

A user needs to put sensitive data in an Amazon S3 bucket that can be accessed through an S3 VPC endpoint only. The user must ensure that resources in the VPC can only access the single S3 bucket.

Which combination of actions will meet the requirements? (Choose two.)

A company must share monthly report files that are uploaded to Amazon S3 with a third party. The third-party user list is dynamic, is distributed, and changes frequently. The least amount of access must be granted to the third party. Administrative overhead must be low for the internal teams who manage the process.

How can this be accomplished while providing the LEAST amount of access to the third party?

An image processing system runs asynchronously on AWS Lambda. A SysOps administrator is configuring a Lambda function to notify developers when an image falls to process after three attempts.
The SysOps administrator has created an Amazon Simple Notification Service (Amazon SNS) topic to notify the developers.

Which additional action should the SysOps administrator take to meet this requirement?

What was the recommended use case for S3 Reduced Redundancy storage before its deprecation was planned?

A user has launched 5 instances in EC2-CLASSIC and attached 5 elastic IPs to the five different instances in the US East region. The user is creating a VPC in the same region. The user wants to assign an elastic IP to the VPC instance.

How can the user achieve this?

A user is having data generated randomly based on a certain event. The user wants to upload that data to CloudWatch. It may happen that event may not have data generated for some period due to randomness.

Which of the below mentioned options is a recommended option for this case?

Which of the following steps are required to configure SAML 2.0 for federated access to AWS? (Choose

two.)

A user has created a VPC with public and private subnets. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.1.0/24 and the public subnet uses CIDR 20.0.0.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306). The user is configuring a security group of the NAT instance.

Which of the below mentioned entries is not required for the NAT security group?

Does Amazon RDS support SSL encryption for SQL Server DB Instances?

You are attempting to connect to an instance in Amazon VPC without success. You have already verified

that the VPC has an Internet Gateway (IGW) the instance has an associated Elastic IP (EIP) and correct security group rules are in place.

Which VPC component should you evaluate next?

A user has created a VPC with public and private subnets using the VPC wizard.

Which of the below mentioned statements is not true in this scenario?

According to the shared responsibility model, for which of the following Amazon EC2 activities is AWS responsible? (Choose two.)

_________ is a fast, reliable, scalable, fully managed message queuing service.

An existing, deployed solution uses Amazon EC2 instances with Amazon EBS General Purpose SSD volumes, am Amazon RDS PostgreSQL database, an Amazon EFS file system, and static objects stored in an Amazon S3 bucket. The Security team now mandates that at-rest encryption be turned on immediately for all aspects of the application, without creating new resources and without any downtime.

To satisfy the requirements, which one of these services can the SysOps Administrator enable at-rest encryption on?

Which of the following is an incorrect statement about Amazon CloudWatch?

An application running on Amazon EC2 instances needs to write files to an Amazon S3 bucket.

What is the MOST secure way to grant the application access to the S3 bucket?

A user has configured two security groups which allow traffic as given below:
1: SecGrp1:
Inbound on port 80 for 0.0.0.0/0
Inbound on port 22 for 0.0.0.0/0

2: SecGrp2:
Inbound on port 22 for 10.10.10.1/32 If both the security groups are associated with the same instance, which of the below mentioned statements is true?

A user has created an ELB with Auto Scaling.

Which of the below mentioned offerings from ELB helps the user to stop sending new requests traffic from the load balancer to the EC2 instance when the instance is being deregistered while continuing in-flight requests?

In AWS Identity and Access Management (IAM), you can make use of the ______ APIs to grant users temporary access to your resources.

A user is trying to pre-warm a blank EBS volume attached to a Linux instance.

Which of the below mentioned steps should be performed by the user?

A group in IAM can contain many users.
Can a user belong to multiple groups?

Does AWS offer any web-based graphic user interface to access and manage EC2 instances?

A SysOps Administrator implemented the following bucket policy to allow only the corporate IP address range of 54.240.143.0/24 to access objects in an Amazon S3 bucket.

Some employees are reporting that they are able to access the S3 bucket from IP addresses outside the
corporate IP address range.

How can the Administrator address this issue?

Where is an object stored in Amazon S3?

A company hosts a multi-tier ecommerce web application on AWS, and has recently been alerted to suspicious application traffic The architecture consists of Amazon EC2 instances deployed across multiple Availability Zones behind an Application Load Balancer (ALB) After examining the server logs, a sysops administrator determines that the suspicious traffic is an attempted SQL injection attack.

What should the sysops administrator do to prevent similar attacks?

An application is being developed that will be served across a fleet of Amazon EC2 instances, which
require a consistent view of persistent data. Items stored vary in size from 1KB to 300MB; the items are
read frequently, created occasionally, and often require partial changes without conflict. The data store is not expected to grow beyond 2TB, and items will be expired according to age and content type.

Which AWS service solution meets these requirements?

A root account owner has created an S3 bucket testmycloud. The account owner wants to allow everyone to upload the objects as well as enforce that the person who uploaded the object should manage the permission of those objects.

Which is the easiest way to achieve this?

An organization is generating digital policy files which are required by the admins for verification. Once the files are verified they may not be required in the future unless there is some compliance issue.
If the organization wants to save them in a cost effective way, which is the best possible solution?

A Content Processing team has notified a SysOps Administrator that their content is sometimes taking a long time to process, whereas other times it processes quickly. The Content Processing submits messages to an Amazon Simple Queue Service (Amazon SQS) queue, which details the files that need to be processed. An Amazon EC2 instance polls the queue to determine which file to process next.

How could the Administrator maintain a fast but cost-effective processing time?

AWS IAM permissions can be assigned in two ways:

After a particularly high AWS bill, an organization wants to review the use of AWS services.

What AWS service will allow the SysOps Administrator to quickly view this information to share it, and will also forecast expenses for the current billing period?

A SysOps Administrator is notified that an Amazon EC2 instance has stopped responding. The AWS Management Console indicates that the system checks are failing.

What should the SysOps Administrator do first to resolve this issue?

An organization has configured Auto Scaling with ELB. There is a memory issue in the application which is causing CPU utilization to go above 90%. The higher CPU usage triggers an event for Auto Scaling as per the scaling policy.
If the user wants to find the root cause inside the application without triggering a scaling activity, how can he achieve this?

A SysOps Administrator is required to monitor free space on Amazon EBS volumes attached to Microsoft Windows-based Amazon EC2 instances within a company's account. The Administrator must be alerted to potential issues.

What should the Administrator do to receive email alerts before low storage space affects EC2 instance performance?

An ecommerce site is using Amazon ElastiCache with Memcached to store session state for a web application and to cache frequently used data. For the last month, users have been complaining about performance. The metric data for the Amazon EC2 instances and the Amazon RDS instance appear normal, but the eviction count metrics are high.

What should be done to address this issue and improve performance?

Spot instances are ideally designed for which purpose below?

A company is running an application on Amazon EC2 instances. The company needs to stop all development instances during non-business hours to reduce costs. The instances must be started again at trie beginning of each business day.

Which solution meets these requirements with the LEAST administrative overhead?

A user is using a small MySQL RDS DB. The user is experiencing high latency due to the Multi AZ feature.

Which of the below mentioned options may not help the user in this situation?

A user has configured an Auto Scaling group with ELB. The user has enabled detailed CloudWatch monitoring on Auto Scaling.

Which of the below mentioned statements will help the user understand the functionality better?

A company uses many Amazon Elastic Block Store (Amazon EBS) volumes. The company wants to use Amazon Data Lifecycle Manager (Amazon DLM) to manage the lifecycle of EBS snapshots that have tags of "Production" and "Compliance".

Which combination of the following are needed to turn on this feature? (Choose two.)

You need to determine what encryption operations were taken with which key in AWS KMS to ei-ther encrypt or decrypt data in the AWS CodeCommit repository.

Which of the following actions will best help you accomplish this?

A company is concerned about a security vulnerability impacting its Linux operating system.

What should the SysOps Administrator do to alleviate this concern?

A SysOps Administrator attempting to delete an Amazon S3 bucket ran the following command: aws s3
rb s3://my bucket

The command failed and bucket still exists. The administrator validated that no files existed in the bucket by running aws s3 1s s3://mybucket and getting an empty response.

Why is the Administrator unable to delete the bucket, and what must be done to accomplish this task?

A user is sending a custom metric to CloudWatch.
If the call to the CloudWatch APIs has different dimensions, but the same metric name, how will CloudWatch treat all the requests?

A SysOps Administrator must remove public IP addresses from all Amazon EC2 Instances to prevent exposure to the internet. However, many corporate applications running on those EC2 instances need to access Amazon S3 buckets. The administrator is tasked with allowing the EC2 instances to continue to access the S3 buckets.

Which solutions can be used? (Select Two).

A user has created an ELB with three instances.

How many security groups will ELB create by default?

A company needs to deploy a web application on two Amazon EC2 instances behind an Application Load Balancer (ALB). Two EC2 instances will also be deployed to host the database. The infrastructure needs to be designed across Availability Zones (AZs) for high availability and must limit public access to the instances as much as possible.

How should this be achieved within a VPC?

An AWS root account owner is trying to create a policy to access RDS.

Which of the below mentioned statements is true with respect to the above information?

A fleet of servers must send local logs to Amazon CloudWatch.

How should the servers be configured to meet this requirement?

Application developers are reporting Access Denied errors when trying to list the contents of an Amazon
S3 bucket by using the IAM user "arn:aws:iam::111111111111:user/application". The following
S3 bucket policy is in use:

How should a SysOps Administrator modify the S3 bucket policy to fix the issue?

A SysOps administrator manages an AWS CloudFormation template that provisions Amazon EC2 instances, an Elastic Load Balancer, and Amazon RDS instances. As part of an ongoing transformation project, CloudFormation stacks are being created and deleted continuously. The administrator needs to ensure that the RDS instances continue running after a stack has been deleted.

Which action should be taken to meet these requirements?

A company developed and now runs a memory-intensive application on multiple Amazon EC2 Linux instances. The memory utilization metrics of the EC2 Linux instances must be monitored every minute.

How should the SysOps Administrator publish the memory metrics? (Choose two.)

A SysOps Administrator needs to confirm that security best practices are being followed with the AWS account root user.

How should the Administrator ensure that this is done?

Which of the following programming languages is not supported by Amazon's Elastic Beanstalk?

A user has stored data on an encrypted EBS volume. The user wants to share the data with his friend's AWS account.

How can user achieve this?

A web-based application is running in AWS. The application is using a MySQL Amazon RDS database instance for persistence. The application stores transactional data and is read-heavy. The RDS instance gets busy during the peak usage, which shows the overall application response times.

The SysOps Administrator is asked to improve the read queries performance using a scalable solution.

Which options will meet these requirements? (Choose two.)

Users are struggling to connect to a single public-facing development web server using its public IP address on a unique port number of 8181. The security group is correctly configured to allow access on that port, and the network ACLs are using the default configuration.

Which log type will confirm whether users are trying to connect to the correct port?

A web application runs on Amazon EC2 instances with public IPs assigned behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon RDS Multi-AZ DB instance. The Application Load Balancer, EC2 instances, and RDS DB instance all run in separate sets of subnets. The EC2 instances can communicate with the DB instance, but cannot connect with external services.

What is the MOST likely solution?

An organization, which has the AWS account ID as 999988887777, has created 50 IAM users. All the users are added to the same group cloudacademy.

If the organization has enabled that each IAM user can login with the AWS console, which AWS login URL will the IAM users use?

A web application's performance has been degrading. Historically, the application has had highly-variable workloads, but lately, there has been a steady growth in traffic as the result of a new product launch. After reviewing several Amazon CloudWatch metrics, it is discovered that over the last two weeks the balance of CPU credits has dropped to zero several times.

Which solutions will improve performance? (Choose two.)

A company runs a web application that users access using the domain name www.example.com. The company manages the domain name using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application through CloudFront.

What is the MOST cost-effective way to achieve this?

An organization is using cost allocation tags to find the cost distribution of different departments and projects. One of the instances has two separate tags with the key/ value as "InstanceName/HR", "CostCenter/HR".

What will AWS do in this case?

When preparing for a compliance assessment of your system built inside of AWS.
what are three best-practices for you to prepare for an audit? (Choose three.)

A new application is being tested for deployment on an Amazon EC2 instance that requires greater IOPS than currently provided by the single 4TB General Purpose SSD (gp2) volume.

Which actions should be taken to provide additional Amazon EBS IOPS for the application? (Choose two.)

An organization with a large IT department has decided to migrate to AWS. With different job functions in the IT department, it is not desirable to give all users access to all AWS resources. Currently the organization handles access via LDAP group membership.

What is the BEST method to allow access using current LDAP credentials?

A company's security policy states that connecting to Amazon EC2 instances is not permitted through SSH and RDP. If access is required, authorized staff can connect to instances by using AWS Systems Manager Session Manager.

Users report that they are unable to connect to one specific Amazon EC2 instance that is running Ubuntu and has AWS Systems Manager Agent (SSM Agent) pre-installed. These users are able to use Session Manager to connect to other instances in the same subnet, and they are in an IAM group that has Session Manager permission for all instances.

What should a SysOps administrator do to resolve this issue?

Which component of an Ethernet frame is used to notify a host that traffic is coming?

A SysOps Administrator must devise a strategy for enforcing tagging of all EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes.

What action can the Administrator take to implement this for real-time enforcement?

A company is about to launch a new product and is expecting a large increase in application traffic. The application is running on Amazon EC3 is an Auto scaling group and using an Amazon RDS multi-AZ instance. The static content is stored in Amazon S3. During the load test, the time to access the application increased significantly. A SysOps administrator wants to increase the scalability of the application without compromising the durability of the architecture.

How can this goal be achieved?

A user has launched an EBS backed instance. The user started the instance at 9 AM in the morning.
Between 9 AM to 10 AM, the user is testing some script. Thus, he stopped the instance twice and restarted it. In the same hour the user rebooted the instance once.
For how many instance hours will AWS charge the user?

A sysops administrator manages an AWS CloudFormation templates that provisions Amazon EC2 instances, an Elastic Load Balancer, and Amazon RDS instances. As part of an ongoing transformation project CloudFormation stacks are being created and deleted continuously. The administrator needs to ensure that the RDS instances continue running after a stack has been deleted.

Which action should be taken to meet these requirements?

A company is running critical applications on Amazon EC2 instances. The company needs to ensure its resources are automatically recovered if they become impaired due to an underlying hardware failure.

Which service can be used to monitor and recover the EC2 instances?

A user creates an Auto Scaling group from the Amazon AWS Console and assigned a tag with a key of "environment" and a value of "Prod".
Can the user assign tags to instances launched in the Auto Scaling group, to organize and manage them?

A SysOps Administrator is managing an AWS account where Developers are authorized to launch Amazon EC2 instances to test new code. To limit costs, the Administrator must ensure that the EC2 instances in the account are terminated 24 hours after launch.

How should the Administrator meet these requirements?

A user has setup a web application on EC2. The user is generating a log of the application performance at every second. There are multiple entries for each second.
If the user wants to send that data to CloudWatch every minute, what should he do?

A user is sending the data to CloudWatch using the CloudWatch API. The user is sending data 90 minutes in the future.

What will CloudWatch do in this case?

An organization has created a Queue named "modularqueue" with SQS. The organization is not performing any operations such as SendMessage, ReceiveMessage, DeleteMessage, GetQueueAttributes, SetQueueAttributes, AddPermission, and RemovePermission on the queue.

What can happen in this scenario?

A sysops administrator is managing an application on AWS that uses Amazon EC2 instances and Amazon Aurora MySQL. The EC2 instances and Aurora instances are in two different subnets. The application

servers running in EC2 cannot connect to the Aurora database.

The EC2 subnet is 192.168.87.0/24 and has a security group named sg-123456 with the following configuration.

The Aurora subnet is 192.168.88.0/24 and has a security group named sg-abcdef with the following configuration.

Which action should the sysops administrator take to allow the EC2 instances to connect to the Aurora database?

A SysOps Administrator is troubleshooting Amazon EC2 connectivity issues to the internet. The EC2 instance is in a private subnet. Below is the route table that is applied to the subnet of the EC2 instance.

Destination - 10.2.0.0/16
Target - local
Status - Active
Propagated - No

Destination - 0.0.0.0/0
Target - nat-xxxxxxx
Status - Blackhole
Propagated - No

What has caused the connectivity issue?

A user is planning to use AWS Cloudformation.

Which of the below mentioned functionalities does not help him to correctly understand Cloudfromation?

An organization has hired an external firm to audit unauthorized changes on the company's AWS environment, the external auditor needs appropriate access.

How can this be accomplished?

____________ is a fast, flexible, fully managed pub/sub messaging service.