Amazon SOA-C02 Practice Test - Questions Answers, Page 31
List of questions
Question 301

A company has a cluster of Linux Amazon EC2 Spot Instances that read many files from and write many files to attached Amazon Elastic Block Store (Amazon EBS) volumes. The EC2 instances are frequently started and stopped. As part of the process when an EC2 instance starts, an EBS volume is restored from a snapshot.
EBS volumes that are restored from snapshots are experiencing initial performance that is lower than expected. The company's workload needs almost all the provisioned IOPS on the attached EBS volumes. The EC2 instances are unable to support the workload when the performance of the EBS volumes is too low. A SysOps administrator must implement a solution to ensure that the EBS volumes provide the expected performance when they are restored from snapshots.
Which solution will meet these requirements?
Explanation:
For EBS volumes restored from snapshots to immediately achieve the required IOPS performance, Fast Snapshot Restore (FSR) can be utilized:
Enable FSR: Fast Snapshot Restore can be enabled on specific snapshots. This feature pre-warms the EBS volume created from a snapshot to its full performance level immediately after it is provisioned.
Operational Impact: By enabling FSR, any EBS volume created from these enabled snapshots will provide the provisioned IOPS performance right from the start, eliminating the performance lag that typically occurs as the data is lazily loaded from S3.
Cost Considerations: While FSR increases costs due to the pre-warming of data, it is justified by the need for immediate high performance, especially in environments where EBS volume responsiveness is critical to application performance.
This solution directly addresses the challenge of initial performance degradation and ensures that the EBS volumes can handle the required workload immediately upon restoration from a snapshot.
Question 302

A SysOps administrator launches an Amazon EC2 instance in a private subnet of a VPC. When the SysOps administrator attempts a curl command from the command line of the EC2 instance, the SysOps administrator cannot connect to https:www.example.com.
What should the SysOps administrator do to resolve this issue?
Explanation:
To resolve the issue of the EC2 instance in a private subnet not being able to connect to external websites via HTTPS (port 443), it is necessary to adjust the security group settings:
Outbound Security Group Rules: Verify that the security group associated with the EC2 instance allows outbound traffic on port 443 to any destination (0.0.0.0/0). This rule is crucial because it enables the instance to initiate HTTPS connections to external websites.
Network ACLs: While the primary concern here is the security group, ensure also that the Network Access Control List (ACL) associated with the subnet permits outbound HTTPS traffic. However, the ACLs by default allow all outbound traffic unless specifically restricted.
Internet Connectivity: Since the instance is in a private subnet, ensure that it has a route to the internet through a NAT Gateway or NAT Instance located in a public subnet. Without this, the instance won't be able to reach external networks even if the security groups and ACLs are correctly configured.
By ensuring that the security group permits outbound HTTPS traffic, you address the most common configuration oversight that would prevent such connectivity.
Question 303

A company has several business units that want to use Amazon EC2. The company wants to require all business units to provision their EC2 instances by using only approved EC2 instance configurations.
What should a SysOps administrator do to implement this requirement?
Explanation:
To enforce the use of approved EC2 instance configurations across different business units efficiently:
AWS Service Catalog: Utilize AWS Service Catalog to manage and govern commonly deployed IT services. Create a catalog of pre-approved products (in this case, EC2 instance configurations).
Publish Products: Define and publish EC2 instance configurations as products within the Service Catalog. These products will incorporate all the necessary and approved configurations, options, and software.
Launch Constraints: Assign launch constraints to these products, ensuring that users can only launch EC2 instances as defined by the pre-approved configurations.
Control Access: Grant business units access only to the Service Catalog for provisioning EC2 instances. This ensures they use only those configurations that comply with company policies and standards.
This approach not only standardizes resource deployment but also simplifies management and enhances compliance across the organization.
Question 304

A company is supposed to receive a data file every hour in an Amazon S3 bucket. An S3 event notification invokes an AWS Lambda function each time a file arrives. The function processes the data for use by an application.
The application team notices that sometimes the file does not arrive. The application team wants to receive a notification whenever the file does not arrive.
What is the MOST operationally efficient solution that meets these requirements?
Question 305

A global company operates out of five AWS Regions. A SysOps administrator wants to identify all the company's tagged and untagged Amazon EC2 instances.
The company requires the output to display the instance ID and tags.
What is the MOST operationally efficient way for the SysOps administrator to meet these requirements?
Explanation:
To identify both tagged and untagged EC2 instances across multiple AWS Regions efficiently:
AWS Tag Editor: Tag Editor allows you to search for resources across your AWS account by tags, including both tagged and untagged resources.
Search Setup: In the Tag Editor, select all the Regions where the company operates. Specify the resource type as AWS::EC2::Instance to focus the search on EC2 instances.
View and Export Data: Execute the search to view all EC2 instances, along with their associated tags and instance IDs. This data can be exported for further analysis or reporting.
Using the Tag Editor is an operationally efficient way to quickly get a comprehensive view of resource tagging across multiple Regions, aiding in compliance and resource management tasks.
Question 306

A SysOps administrator needs to control access to groups of Amazon EC2 instances using AWS Systems Manager Session Manager. Specific tags on the EC2 instances have already been added.
Which additional actions should the administrator take to control access? (Choose two.)
Explanation:
To control access to Amazon EC2 instances using AWS Systems Manager Session Manager based on specific tags:
Attach an IAM Policy to Users or Groups: Create and attach an Identity and Access Management (IAM) policy to the IAM users or groups who need access to the EC2 instances. This policy should specify the permissions required to use Session Manager to start sessions with the instances.
Create an IAM Policy with Tag-Based Conditions: Create an IAM policy that includes a condition element to allow access to EC2 instances based on specific tags. This policy can be designed to grant the ssm:StartSession permission only for instances that match certain tags, as defined in the condition block of the IAM policy. Here is a sample condition block that could be used:
'Condition': {
'StringEquals': {
'ec2:ResourceTag/YourTagName': 'YourTagValue'
}
}
This ensures that only authorized users can initiate sessions with instances that have the specified tags, enhancing security and operational management.
By implementing these policies, you ensure that only the appropriate personnel have the controlled access required, based on the specific business needs and security guidelines.
Question 307

An application runs on Amazon EC2 instances in an Auto Scaling group. Following the deployment of a new feature on the EC2 instances, some instances were marked as unhealthy and then replaced by the Auto Scaling group. The EC2 instances terminated before a SysOps administrator could determine the cause of the health status changes. To troubleshoot this issue, the SysOps administrator wants to ensure that an AWS Lambda function is invoked in this situation.
How should the SysOps administrator meet these requirements?
Explanation:
To enable troubleshooting of EC2 instances marked as unhealthy before they are terminated by the Auto Scaling group, you can use lifecycle hooks:
Add a Lifecycle Hook: Configure a lifecycle hook in the Auto Scaling group. This hook will hold the instance in a 'wait' state either when it launches or terminates (in this case, when it's about to be terminated due to health check failure).
Integration with Amazon EventBridge (CloudWatch Events): Set up the lifecycle hook to send an event to EventBridge (formerly CloudWatch Events) when an instance is in the termination lifecycle state.
Invoke Lambda Function: Configure EventBridge to trigger an AWS Lambda function when it receives the termination lifecycle event from the Auto Scaling group. This Lambda function can then perform necessary diagnostics, logging, or data capture activities on the instance before it's terminated.
This configuration allows the SysOps administrator to perform necessary investigations on why instances were marked unhealthy before they are automatically replaced, offering a chance to diagnose and potentially correct underlying issues.
Question 308

A company hosts an internal application on Amazon EC2 On-Demand Instances behind an Application Load Balancer (ALB). The instances are in an Amazon EC2 Auto Scaling group. Employees use the application to provide product prices to potential customers. The Auto Scaling group is configured with a dynamic scaling policy and tracks average CPU utilization of the instances.
Employees have noticed that sometimes the application becomes slow or unresponsive. A SysOps administrator finds that some instances are experiencing a high CPU load. The Auto Scaling group cannot scale out because the company is reaching the EC2 instance service quota.
The SysOps administrator needs to implement a solution that provides a notification when the company reaches 70% or more of thte EC2 instance service quota.
Which solution will meet these requirements in the MOST operationally efficient manner?
Explanation:
To monitor and receive alerts when the EC2 instance service quota usage reaches 70% or more:
Service Quotas Console: Navigate to the Service Quotas console within AWS and identify the specific quota for EC2 instances.
Create a CloudWatch Alarm: Directly from the Service Quotas console, set up a CloudWatch alarm for the EC2 instance quota metric. Configure the alarm to trigger when the quota utilization reaches or exceeds 70%.
Notification Setup: Link this alarm to an Amazon SNS topic that will send a notification to relevant stakeholders or systems when the quota usage threshold is breached.
This method provides an automated, straightforward way to monitor resource limits and ensures that stakeholders are promptly notified, enabling them to take proactive measures to manage the quota and prevent service disruption.
Question 309

A company wants to track its expenditures for Amazon EC2 and Amazon RDS within AWS. The company decides to implement more rigorous tagging requirements for resources in its AWS accounts. A SysOps administrator needs to identify all noncompliant resources.
What is the MOST operationally efficient solution that meets these requirements?
Explanation:
To efficiently monitor and identify noncompliant resources in terms of tagging within AWS, using AWS Config with a managed rule for required tagging is most appropriate:
AWS Config Setup: Configure AWS Config to monitor and record configurations of AWS resources within your environment.
Managed Rule for Required Tags: Utilize the 'required-tags' managed rule in AWS Config, which checks whether your resources have the specific tags you define as mandatory. This rule can be customized to specify which tags are required and can automatically evaluate all existing and new resources in your environment.
Compliance Reporting: AWS Config provides detailed compliance reporting that helps you identify resources that do not meet the tagging requirements, facilitating easy remediation.
This approach leverages AWS Config's capabilities for continuous monitoring and evaluation without needing to write custom code or manage additional services, providing an operationally efficient solution for compliance management.
Question 310

A user is connected to an Amazon EC2 instance in a private subnet. The user is unable to access the internet from the instance by using the following curl command: curl http:/www.example.com.
A SysOps administrator reviews the VPC configuration and learns the following information:
* The private subnet has a route to a NAT gateway for CIDR 0.0.0.0/0
* The outbound security group for the EC2 instance contains one rule: outbound for port 443 to CIDR 0.0.0.0/0
* The inbound security group for the EC2 instance allows ports 22 and 443 from the user's IP address.
* The inbound network ACL for the subnet allows port 22 and port range 1024-65535 from CIDR 0.0.0.0/0
Which action will allow the user to complete the curl request successfully?
Explanation:
Since the EC2 instance is attempting to access the internet using HTTP (port 80) but is configured only to allow HTTPS (port 443) traffic, the security group needs adjustment:
Security Group Configuration: The outbound rules of the security group associated with the EC2 instance must allow traffic over HTTP. Add an outbound rule that enables port 80 to destination 0.0.0.0/0. This rule will allow the instance to send HTTP requests to any IP address on the internet.
Test Connectivity: After updating the security group, test the connectivity using the curl command again to ensure the configuration allows internet access via HTTP.
This change is necessary because the existing security group configuration does not permit outbound HTTP traffic, which is essential for accessing websites using HTTP.
Question