Quiz IT certification exam

Question 1

A company is using an Amazon EC2 Auto Scaling group to support a workload A Sytfhe company now needs to centruito Scaling group is configured with two similar scaling policies dP) to centrally manage access to One scaling policy adds 5 instances when CPU utilization reaches 80%. The other sctrator can connect to the extemahen CPU utilization leaches 80%.

What will happen when CPU utilization reaches the 80% threshold?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Amazon EC2 Auto Scaling will add 10 instances

Answer

Amazon EC2 Auto Scaling will add 5 instances

Answer

Amazon EC2 Auto Scaling will add 15 instances.

Answer

The Auto Scaling group will not scale because of conflicting policies

Question 2

A company hosts an application on Amazon EC2 instances The instances are in an Amazon EC2 Auto Scaling group that uses a launch template The amount of application traffic changes throughout the day. Scaling events happen frequently.A SysOps administrator needs to help developers troubleshoot the application. When a scaling event removes an instance. EC2 Auto Scaling terminates the instance before the developers can log in to the instance to diagnose issues.Which solution will prevent termination of the instance so that the developers can log in to the instance?

Accepted Answer

Update the Auto Scaling group by enabling instance scale-in protection for newly launched instances.

Answer

Ensure that the Delete on termination setting is turned off in the UserData section of the launch template

Answer

Use Amazon Inspector to configure a rules package to protect the instances from termination.

Answer

Use Amazon GuardDuty to configure rules to protect the instances from termination.

Question 3

A company has many accounts in an organization in AWS Organizations The company must automate resource provisioning from the organization's management account to the member accounts.Which solution will meet this requirement?

Accepted Answer

Create an AWS CtoudFormation stack set Deploy the stack set to all member accounts.

Answer

Create an AWS CkHJdFormation change set Deploy the change set to all member accounts

Answer

Create an AWS CtoudFormation nested stack Deploy the nested stack to all member accounts.

Answer

Create an AWS Serverless Application Model (AWS SAM) template. Deploy the template to all member accounts.

Question 4

An AWS Cloud Formation template creates an Amazon RDS instance This template is used to build up development environments as needed and then delete the stack when the environment is no longer required. The RDS-persisted data must be retained for further use. even after the Cloud Format ton stack is deletedHow can this be achieved in a reliable and efficient way?

Accepted Answer

Use the Snapshot Deletion Policy in the Cloud Formation template definition of the RDS instance.

Answer

Write a script to continue backing up the RDS instance every live minutes.

Answer

Create an AWS Lambda function to take a snapshot of the RDS instance, and manually invoke the function before deleting the stack.

Answer

Create a new CloudFormallon template to perform backups of the RDS instance, and run this template before deleting the stack.

Question 5

A company wants to prohibit its developers from using a particular family of Amazon EC2 instances The company uses AWS Organizations and wants to apply the restriction across multiple accountsWhat is the MOST operationally efficient way for the company lo apply service control policies (SCPs) to meet these requirements?

Accepted Answer

Add the accounts to an organizational unit (OUf Apply the SCPs to the OU.

Answer

Add the accounts to resource groups in AWS Resource Groups. Apply the SCPs to the resource groups.

Answer

Apply the SCPs to each developer account.

Answer

Enroll the accounts with AWS Control Tower. Apply the SCPs to the AWS Control Tower management account.

Question 6

A company has an application that uses Amazon DynamoDB tables The tables are spread across AWS accounts and AWS Regions. The company uses AWS CloudFormation to deploy AWS resources.A new team at the company is deleting unused AWS resources. The team accidentally deletes several production DynamoDB tables by running an AWS Lambda function that makes a DynamoDB DeleteTable API call. The table deletions cause an application outageA SysOps administrator must implement a solution that minimizes the chance of accidental deletions of tables. The solution also must minimize data loss that results from accidental deletions.Which combination of steps will meet these requirements? (Select TWO.)

Accepted Answer

Enable deletion protection for the DynamoDB tables

Accepted Answer

Enable point-in-time recovery for (he DynamoDB tables. Restore the tables if they are accidentally deleted.

Answer

Enable termination protection for the CloudFormation stacks that deploy the DynamoDB tables.

Answer

Schedule daily backups of the DynamoDB tables. Restore the tables if they are accidentally deleted.

Answer

Export the DynamoDB tables to Amazon S3 every day. Use Import from Amazon S3 to restore data for tables that are accidentally deleted

Question 7

A company is running an application on a group of Amazon EC2 instances behind an Application Load Balancer The EC2 instances run across three Availability Zones The company needs to provide the customers with a maximum of two static IP addresses for their applicationsHow should a SysOps administrator meet these requirement?

Accepted Answer

Add AWS Global Accelerator in front of the Application Load Balancer

Answer

Add an internal Network Load Balancer behind the Application Load Balancer

Answer

Configure the Application Load Balancer in only two Availability Zones.

Answer

Create two Elastic IP addresses and assign them to the Application Load Balancer.

Question 8

A company currently runs its infrastructure within a VPC in a single Availability Zone The VPC is connected to the company's on-premises data center through an AWS Site-to-SIte VPN connection attached to a virtual pnvate gateway. The on-premises route tables route all VPC networks to the VPN connection Communication between the two environments is working correctly. A SysOps administrator created new VPC subnets within a new Availability Zone, and deployed new resources within the subnets. However, communication cannot be established between the new resources and the on-premises environment.Which steps should the SysOps administrator take to resolve the issue?

Accepted Answer

Add a route to the route tables of the new subnets that send on-premises traffic to the virtual private gateway.

Answer

Create a ticket with AWS Support to request adding Availability Zones to the Site-to-Site VPN route configuration.

Answer

Establish a new Site-to-Site VPN connection between a virtual private gateway attached to the new Availability Zone and the on-premises data center

Answer

Replace the Site-to-Site VPN connection with an AWS Direct Connect connection.

Question 9

A company deploys a new application on three Amazon EC2 instances across three Availability Zones The company uses a Network Load Balancer (NLB) to route traffic lo the EC2 instances. A SysOps administrator must implement a solution so that the EC2 instances allow traffic from only the NLB.What should the SysOps administrator do to meet these requirements with the LEAST operational overhead?

Accepted Answer

Configure the security group that is associated with the EC2 instances to allow traffic from only the security group that is associated with the NLB.

Answer

Configure the security group that is associated with the EC2 instances to allow traffic from only the elastic network interfaces that are associated with the NLB.

Answer

Create a network ACL. Associate the network ACL with the application subnets. Configure the network ACL to allow inbound traffic from only the CIDR ranges of the NLB.

Answer

Use a third-party firewall solution that is installed on a separate EC2 instance. Configure a firewall rule that allows traffic to the application's EC2 instances from only the subnets where the NLB is deployed

Question 10

A company has created an AWS CloudFormation template that consists of the AWS: EC2 Instance resource and a custom Cloud Formation resource The custom CloudFormation resource is an AWS Lambda function that attempts to run automation on the Amazon EC2 instance.During testing, the Lambda function fails because the Lambda function tries to run before the EC2 instance is launchedWhich solution will resolve this issue?

Accepted Answer

Add a DependsOn attribute to the custom resource. Specify the EC2 instance in the DependsOn attribute.

Answer

Update the custom resource's service token to point to a valid Lambda function

Answer

Update the Lambda function to use the cfn-response module to send a response to the custom resource.

Answer

Use the Fn::lf intrinsic function to check for the EC2 instance before the custom resource runs.

Question 11

A company has scientists who upload large data objects to an Amazon S3 bucket The scientists upload the objects as multipart uploads. The multipart uploads often fail because of poor end-client connectivity.The company wants to optimize storage costs that are associated with the data. A SysOps administrator must implement a solution that presents metrics for incomplete uploads. The solution also must automatically delete any incomplete uploads after 7 days.Which solution will meet these requirements?

Accepted Answer

Review the Incomplete Multipart Upload Bytes metre in the S3 Storage Lens dashboard Create an S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days.

Answer

Implement S3 Intelligent-Tiering to move data into tower-cost storage classes after 7 days. Create an S3 Storage Lens policy to automatically delete any incomplete multipart uploads after 7 days.

Answer

Access the S3 console Review the Metrics tab to check the storage that incomplete multipart uploads are consuming. Create an AWS Lambda function to delete any incomplete multipart uploads after 7 days.

Answer

Use the S3 analytics storage class analysis tool to identify and measure incomplete multipart uploads. Configure an S3 bucket policy to enforce restrictions on multipart uploads to delete incomplete multipart uploads after 7 days.

Question 12

An application uses an Amazon Aurora MySQL DB cluster that Includes one Aurora Replica The application's read performance degrades when there are more than 200 user connections. The number of user connections is approximately 180 on a consistent basis Occasionally, the number of user connections increases rapidly to more than 200A SysOps administrator must implement a solution that will scale the application automatically as user demand increases or decreases.Which solution will meet these requirements?

Accepted Answer

Create an auto scaling policy that has a target value of 195 for the DatabaseConnections metric.

Answer

Modify the DB cluster by increasing the Aurora Replica instance size.

Answer

Modify the DB cluster by changing to serverless mode whenever the number of user connections exceeds 200.

Answer

Migrate to a new Aurora DB cluster that has multiple writer instances. Modify the application's database connection string.

Question 13

A company runs a single-page web application on AWS The application uses Amazon CloudFront lo deliver static content from an Amazon S3 bucket origin The application also uses an Amazon Elastic Kubemetes Service (Amazon EKS) duster to serve API callsUsers sometimes report that the website is not operational, even when monitoring shows that the index page is reachable and that the EKS cluster is healthy. A SysOps administrator must Implement additional monitoring that can delect when the website is not operational before users report the problem.Which solution will meet these requirements?

Accepted Answer

Create an Amazon CloudWatch Synthetics heartbeat monitor canary that points to the fully qualified domain name (FQDN) of the website.

Answer

Create an Amazon CloudWatch Synthetics API canary that monitors the availability of API endpoints from the EKS cluster.

Answer

Create an Amazon CloudWatch RUM app monitor that points to the fully qualified domain name (FQDN) of the website. Configure the app monitor to collect performance telemetry and JavaScript errors

Answer

Create an Amazon CloudWatch RUM app monitor that uses the API endpoints from the EKS cluster

Question 14

A company needs to monitor the disk utilization of Amazon Elastic Block Store (Amazon EBS) volumes The EBS volumes are attached to Amazon EC2 Linux Instances A SysOps administrator must set up an Amazon CloudWatch alarm that provides an alert when disk utilization increases to more than 80%.Which combination of steps must the SysOps administrator lake lo meet these requirements? (Select THREE.)

Accepted Answer

Create an 1AM role that includes the Cloud Watch AgentServerPol icy AWS managed policy Attach me role to the instances

Accepted Answer

Install and start the CloudWatch agent by using AWS Systems Manager or the command line

Accepted Answer

Configure a CloudWatch alarm to enter ALARM state when the disk_used_percent CloudWatch metric is greater than 80%.

Answer

Create an 1AM role that includes the CloudWatchApplicationInsightsReadOnlyAccess AWS managed policy. Attach the role to the instances

Answer

Install and start the CloudWatch agent by using an 1AM role. Attach the Cloud Watch AgentServerPolicy AWS managed policy to the role.

Answer

Configure a CloudWatch alarm to enter ALARM state when the disk_used CloudWatch metric is greater than 80% or when the disk_free CloudWatch metric is less than 20%.

Question 15

A SysOps administrator is investigating a company's web application for performance problems The application runs on Amazon EC2 instances that are in an Auto Scaling group. The application receives large traffic increases at random times throughout the day. During periods of rapid traffic increases, the Auto Scaling group is not adding capacity fast enough. As a result, users are experiencing poor performance.The company wants to minimize costs without adversely affecting the user experience when web traffic surges quickly. The company needs a solution that adds more capacity to me Auto Scaling group for larger traffic increases than for smaller traffic increases.How should the SysOps administrator configure the Auto Scaling group to meet these requirements?

Accepted Answer

Create a step scaling policy with settings to make larger adjustments in capacity when the system is under heavy load.

Answer

Create a simple scaling policy with settings to make larger adjustments in capacity when the system is under heavy load

Answer

Create a target tracking scaling policy with settings to make larger adjustments in capacity when the system is under heavy load

Answer

Use Amazon EC2 Auto Scaling lifecycle hooks Adjust the Auto Scaling group's maximum number of instances after every scaling event

Question 16

A company runs an application on hundreds of Amazon EC2 instances in three Availability Zones The application calls a third-parly API over the public internet A SysOps administrator must provide the third party with a list of static IP addresses so that the third party can allow traffic from the applicationWhich solution will meet these requirements?

Accepted Answer

Add a NAT gateway in the public subnet of each Availability Zone. Make the NAT gateway the default route of all private subnets In those Availability Zones.

Answer

Allocate one Elastic IP address in each Availability Zone. Associate the Elastic IP address with all the instances in the Availability Zone

Answer

Place the instances behind a Network Load Balancer (NLB). Send the traffic to the interne! through the private IP address of the NLB

Answer

Update the main route table to send the traffic to the internet through an Elastic IP address that is assigned to each instance.

Question 17

A company runs a high performance computing (HPC) application on an Amazon EC2 instance The company needs to scale this architecture to two or more EC2 instances. The EC2 instances wilt need to communicate with each other at high speeds with low latency to support the application.The company wants to ensure that the network performance can support the required communication between the EC2 instances.What should a SysOps administrator do to meet these requirements?

Accepted Answer

Create a cluster placement group. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Restore the EC2 instance from the AMI into the placement group Launch the additional EC2 instances into the placement group

Answer

Back up the existing EC2 instance to an Amazon Machine Image (AMI). Create a launch template from the existing EC2 instance by specifying the AMI. Create an Auto Scaling group and configure the desired instance count.

Answer

Create a Network Load Balancer (NLB) and a target group. Launch the new EC2 instances and register them with the target group Register the existing EC2 instance with the target group. Pass all application traffic through the NLB.

Answer

Back up the existing EC2 Instance to an Amazon Machine Image (AMI). Create additional clones of the EC2 instance from the AMI in the same Availability Zone where the existing EC2 instance is located.

Question 18

A company is uploading important files as objects to Amazon S3 The company needs to be informed if an object is corrupted during the uploadWhat should a SysOps administrator do to meet this requirement?

Accepted Answer

Pass the Content-MD5 value as a request header during the object upload.

Answer

Pass the Content-Disposition value as a request body during the object upload.

Answer

Pass x-amz-objecWock-mode as a request header during the object upload

Answer

Pass x-amz-server-side-encryption-customer-algorithm as a request body during the object upload.

Question 19

A SysOps administrator needs to ensure that an Amazon RDS for PostgreSQL DB instance has available backups The DB instance has automated backups turned on with a backup retention period of 7 days. However, no automated backups for the DB instance have been created in the past month.What could be the cause of the lack of automated backups?

Accepted Answer

The DB instance is in the STORAGE_FULL state

Answer

The Amazon S3 bucket that stores the backups is full

Answer

The DB instance is not configured for Multi-AZ.

Answer

The backup retention period must be 30 days.

Question 20

A company has a list of pre-appf oved Amazon Machine Images (AMIs) for developers lo use to launch Amazon EC2 instances However, developers are still launching EC2 instances from unapproved AMIs.A SysOps administrator must implement a solution that automatically terminates any instances that are launched from unapproved AMIs.Which solution will meet mis requirement?

Accepted Answer

Set up an AWS Config managed rule to check if instances are running from AMIs that are on the list of pre-approved AMIs. Configure an automatic remediation action so that an AWS Systems Manager Automation runbook terminates any instances that are noncompliant with the rule

Answer

Store the list of pre-approved AMIs in an Amazon DynamoDB global table that is replicated to all AWS Regions that the developers use. Create Regional EC2 launch templates. Configure the launch templates to check AMIs against the list and to terminate any instances that are not on the list

Answer

Select the Amazon CloudWatch metric that shows all running instances and the AMIs that the instances were launched from Create a CloudWatch alarm that terminates an instance if the metric shows the use of an unapproved AMI.

Answer

Create a custom Amazon Inspector finding to compare a running instance's AMI against the list of pre-approved AMIs Create an AWS Lambda function that terminates instances. Configure Amazon Inspector to report findings of unapproved AMIs to an Amazon Simple Queue Service (Amazon SQS) queue to invoke the Lambda function.

Question 21

Users of a company's internal web application recently experienced application performance issues for a brief period The application includes frontend web servers that run in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster The application also includes a bacKend Amazon Aurora PostgreSQL DB cluster that includes one DB instance.A SysOps administrator determines that the source of the performance issues was high utilization of the DB cluster. The single writer instance experienced more than 90% utilization for 11 minutes The cause of the high utilization was an automated report that is scheduled to run one time each weekWhat should the SysOps administrator do to ensure that users do not experience performance Issues each week when the report runs?

Accepted Answer

Increase the size of the DB instance. Monitor the performance during the next scheduled run of the report

Answer

Add a reader instance. Change the database connection string of the report application to use the newly created reader instance.

Answer

Add another writer instance Change the database connection string of the report application to use the newly created writer instance.

Answer

Configure auto scaling for the DB cluster Set the minimum capacity units, maximum capacity units, and target utilization

Question 22

A company is using AWS to deploy a critical application on a fleet of Amazon EC2 instances The company is rewriting the application because the application failed a security review The application will take 12 months to rewrite While this rewrite happens, the company needs to rotate IAM access keys that the application uses.A SysOps administrator must implement an automated solution that finds and rotates IAM access Keys that are at least 30 days old. The solution must then continue to rotate the IAM access Keys every 30 days.Which solution will meet this requirement with the MOST operational efficiency?

Accepted Answer

Create an AWS Lambda function that checks the age of IAM access keys and rotates them if they are at least 30 days old Use an Amazon EventBridge rule to invoke the Lambda function every time a new IAM access key is created.

Answer

Use an AWS Config rule to identify IAM access Keys that are at least 30 days old. Configure AWS Config to invoKe an AWS Systems Manager Automation runbook to rotate the identified IAM access keys.

Answer

Use AWS Trusted Advisor to identify IAM access Keys that are at least 30 days old. Configure Trusted Advisor to invoke an AWS Systems Manager Automation runbook to rotate the identified IAM access keys

Answer

Create a script that checks the age of IAM access Keys and rotates them if they are at least 30 days old. Launch an EC2 instance. Schedule the script to run as a cron expression on the EC2 instance every day.

Question 23

A company receives an alert from an Amazon CloudWatch alarm The alarm indicates that a web application that Is running on Amazon EC2 instances is not responding to requests The EC2 instances have a Red Hat Enterprise Linux operating system and are in an Auto Scaling group. The Auto Scaling group has a minimum capacity of 2 and a maximum capacity of 5.An Investigation reveals that the web application is experiencing oul-of-memory errors. The company adds memory lo the web application and wants to track operating system memory utilization. A CloudWatch memory metric does not currently exist tor the EC2 Instances in the Auto Scaling groupWhat should a SysOps administrator do to provide a CloudWatch memory metric for the EC2 instances?

Accepted Answer

Use an Amazon Machine Image (AMI) that includes the CloudWatch agent.

Answer

Turn on CloudWatch detailed monitoring

Answer

Turn on Instance Metadata Service Version 2 (IMOSv2).

Answer

Use an Amazon Machine Image (AMI) that is based on Amazon Linux.

Question 24

A company is using an Amazon CloudWatch alarm lo monitor the FreeLocalStorage metric for an Amazon Aurora PostgreSQL production database The alarm goes into ALARM state and indicates that the database is running low on temporary storage. A SysOps administrator discovers that a weekly report is using most of the temporary storage that is currently allocated.What should the SysOps administrator do to solve this problem?

Accepted Answer

Modify the configuration of the DB cluster to turn on storage auto scaling.

Answer

Turn on Aurora PostgreSQL query plan management.

Answer

Add an Aurora read replica to the DB cluster. Modify the report lo use the new read replica.

Answer

Modify the DB instance class for each DB instance In the DB cluster to increase the instance size.

Question 25

A SysOps administrator is responsible for more than 50 Amazon EC2 instances mat are deployed in a single production AWS account The EC2 instances are running several different operating systems The company's standards require patching to be completed at least once a month.The SysOps administrator wants to use AWS Systems Manager to reduce the number of hours the company spends on operating system patching each month.Which combination of steps should the SysOps administrator take to meet these requirements? (Select THREE.)

Accepted Answer

Group similar EC2 instances together into resource groups by using AWS Resource Groups

Accepted Answer

Create a schedule in Systems Manager Patch Manager. Specify the appropriate resource group as the target

Accepted Answer

Create a single Systems Manager maintenance window for each resource group.

Answer

Specify Systems Manager Automation runbooks to patch the operating systems. Register the runbooks as tasks in the maintenance window. Specify the appropriate resource group as the target

Answer

Create a Systems Manager Automation runbook to monitor and control the state of the patches required. Apply the runbook to Systems Manager Patch Manager

Answer

Configure Systems Manager Fleet Manager to apply a Systems Manager Automation runbook to the appropriate resource group.

Question 26

A company uses AWS Cloud Formation to deploy its infrastructure. The company recently retired an application. A cloud operations engineer initiates CloudFormation stack deletion, and the stack gets stuck in DELETE FAILED status.A SysOps administrator discovers that the stack had deployed a security group. The security group is referenced by other security groups in the environment. The SysOps administrator needs to delete the stack without affecting other applications.Which solution will meet these requirements m the MOST operationally efficient manner?

Accepted Answer

Delete the stack again. Specify that the security group be retained.

Answer

Create a new security group that has a different name Apply identical rules to the new security group. Replace all other security groups that reference the new security group. Delete the stack.

Answer

Create a CloudFormation change set to delete the security group. Deploy the change set.

Answer

Perform CloudFormation drift detection Delete the stack.

Question 27

A company's architeclure team must receive immediate email notification whenever new Amazon EC2 Instances are launched In the company's main AWS production accountWhat should a SysOps administrator do to meet this requirement?

Accepted Answer

Create an Amazon Simple Notification Service (Amazon SNS) topic and a subscription that uses the email protocol. Enter (he architecture team's email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched Specify the SNS topic as the rule's target

Answer

Create a user data script that sends an email message through a smarx host connector Include the architecture team's email address in the user data script as the recipient. Ensure that all new EC2 instances include the user data script as part of a standardized build process.

Answer

Create an Amazon Simple Queue Service (Amazon SOS) queue and a subscription that uses the email protocol Enter the architecture team's email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched Specify the SOS queue as the rule's target

Answer

Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure AWS Systems Manager to publish EC2 events to the SNS topic. Create an AWS Lambda function to poll the SNS topic. Configure the Lambda function to send any messages to the architecture team's email address.

Question 28

A SysOps administrator needs to update an AWS accoun1 name What should the SysOps administrator do to accomplish this goal?

Accepted Answer

Sign in as the AWS account root user to make the change.

Answer

Add the Administrator Access policy to the SysOps administrator's 1AM user.

Answer

Add the AWS_ConfigRole policy to the SysOps administrator's 1AM user.

Answer

Change the AWS account name through the AWS Trusted Advisor interface.

Question 29

A SysOps administrator needs to create a report that shows how many bytes are sent to and received from each target group member for an Application Load Balancer (ALB).Which combination of steps should the SysOps administrator take to meet these requirements? (Select TWO.)

Accepted Answer

Enable access logging for the ALB. Save the logs to an Amazon S3 bucket.

Accepted Answer

Use Amazon Athena to query the ALB logs Query the table Use the received_bytes and senl_byt.es fields to calculate the total bytes grouped by the target:port field.

Answer

Install the Amazon CloudWatch agent on the Instances in the target group.

Answer

Use Amazon Athena to query the ALB logs Query the table. Use the received_bytes and sent_byt.es fields to calculate the total bytes grouped by the clientport field

Answer

Create an Amazon CloudWatch dashboard that shows the Sum statistic of the ProcessedBytes metric for the ALB.

Question 30

A SysOps administrator must ensure that all of a company's current and future Amazon S3 buckets have logging enabled If an S3 bucket does not have logging enabled an automated process must enable logging for the S3 bucket.Which solution will meet these requirements?

Accepted Answer

Use the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that uses an AWS Lambda function to enable logging.

Accepted Answer

Use the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that uses the AWS-ConfigureS3BucketLoggmg AWS Systems Manager Automation runbook to enable logging.

Answer

Use AWS Trusted Advisor 10 perform a check for S3 buckets that do not have logging enabled Configure the check to enable logging for S3 buckets that do not have logging enabled.

Answer

Configure an S3 bucket policy that requires all current and future S3 buckets to have logging enabled

Question 31

After creating a presigned URL for an S3 object, users can no longer access the file after a few days.

Accepted Answer

The presigned URL's expiration date and time have passed.

Accepted Answer

The SysOps administrator's access key is no longer valid.

Answer

The S3 bucket's Block Public Access settings are enabled.

Answer

The S3 object's ACL does not include READ access for the All Users group.

Answer

The S3 object's ACL does not include READ_ACP access for the All Users group.

Question 32

The company needs to increase IOPS for two EC2 instances with gp2 volumes to support an upcoming promotion with higher I/O requirements.

Accepted Answer

Migrate the attached EBS volumes to General Purpose SSD (gp3) EBS volumes. Provision the appropriate IOPS.

Answer

Migrate the attached EBS volumes to Throughput Optimized HDD (st1) EBS volumes.

Answer

Configure Amazon ElastiCache integration on the EC2 instances.

Answer

Migrate the workload to two storage optimized EC2 instances.

Question 33

The SysOps administrator needs to create a key policy that grants data engineers least privilege access to decrypt and read data from an S3 bucket encrypted with KMS.

Accepted Answer

'kms:ListAliases', 'kms:DescribeKey', 'kms:Decrypt'

Answer

'kms:ReEncrypt*', 'kms:GenerateDataKey*', 'kms:Encrypt', 'kms:DescribeKey'

Answer

'kms:ListAliases', 'kms:GetKeyPolicy', 'kms:Describe*', 'kms:Decrypt'

Answer

'kms:Update*', 'kms:TagResource', 'kms:Revoke*', 'kms:Put*', 'kms:List*', 'kms:Get*', 'kms:Enable*', 'kms:Disable*', 'kms:Describe*', 'kms:Delete*', 'kms:Create*', kms:CancelKeyDeletion

Question 34

The SysOps administrator must restart the web server if specific errors are detected in logs on EC2 instances behind a load balancer.

Accepted Answer

Install the Amazon CloudWatch agent on the EC2 instances.

Accepted Answer

Create an Amazon CloudWatch metric filter for the web logs. Configure an alarm for the specific errors.

Accepted Answer

Create an Amazon EventBridge rule that responds to the alarm. Configure the rule to invoke an AWS Systems Manager Automation runbook to restart the web server software.

Answer

Create an AWS CloudTrail metric filter for the web logs. Configure an alarm for the specific errors.

Answer

Publish alarm findings to Amazon Simple Email Service (Amazon SES). Invoke an AWS Lambda function to restart the web server software.

Answer

Create an Amazon Simple Notification Service (Amazon SNS) notification that responds to the alarm. Configure the notification to invoke an AWS Systems Manager Automation runbook to restart the web server software.

Question 35

The company requires a disaster recovery solution for an Aurora PostgreSQL database with a 20-second RPO.

Accepted Answer

Reconfigure the database to be an Aurora global database. Set the RPO to 20 seconds.

Answer

Reconfigure the database to be an Aurora Serverless v2 database with an Aurora Replica in a separate Availability Zone. Set the replica lag to 20 seconds.

Answer

Modify the database to use a Multi-AZ cluster that has two readable standby instances in separate Availability Zones. Add an Aurora Replica in a separate Availability Zone. Set the replica lag to 20 seconds.

Question 36

The company needs a shared file solution for EC2 Windows instances in a Multi-AZ deployment that uses native Windows storage capabilities and maximizes consistency.

Accepted Answer

Create an Amazon FSx for Windows File Server Multi-AZ file system. Map file shares on the instances by using the file system's DNS name.

Answer

Grant the instances access to a shared Amazon S3 bucket. Use Windows Task Scheduler to synchronize the contents of the S3 bucket locally to each instance periodically.

Answer

Create an Amazon Elastic File System (Amazon EFS) file system that uses the EFS Standard storage class. Mount the file system to the instances by using the file system's DNS name and the EFS mount helper.

Answer

Create a new Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume. Attach the EBS volume as an additional drive to each instance.

Question 37

To automatically reboot an EC2 instance when disk usage reaches 100%, a solution with minimal operational overhead is needed.

Accepted Answer

Create a CloudWatch alarm for the EC2 instance. Create an Amazon EventBridge event rule that reacts to the CloudWatch alarm and reboots the EC2 instance.

Answer

Create a CloudWatch alarm for the EC2 instance. Create an Amazon Simple Email Service (Amazon SES) notification that reacts to the CloudWatch alarm and reboots the EC2 instance.

Answer

Create an AWS Lambda function to reboot the EC2 instance. Create a CloudWatch alarm that uses Amazon EventBridge to invoke the Lambda function.

Answer

Create an AWS Lambda function to reboot the EC2 instance. Use EC2 health checks to invoke the Lambda function.

Question 38

The SysOps administrator needs to prevent launching EC2 instances without a specific tag in the application OU.

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances when the CostCenter-Project tag is missing. Attach the SCP to the application OU.

Answer

Create an IAM group that has a policy allowing ec2:RunInstances when the CostCenter-Project tag is present. Place all IAM users in this group.

Answer

Create an IAM role with a policy that allows ec2:RunInstances when the CostCenter-Project tag is present. Attach the IAM role to users in the application OU accounts.

Answer

Create a service control policy (SCP) that denies ec2:RunInstances when the CostCenter-Project tag is missing. Attach the SCP to the root OU.

Question 39

A company has an AWS Config rule that identifies open SSH ports in security groups. The rule has an automatic remediation action to delete the SSH inbound rule for noncompliant security groups. However, business units require SSH access and can provide a list of trusted IPs to restrict access.

Accepted Answer

Create a new AWS Systems Manager Automation runbook that updates the security group's inbound rule with the IP addresses from the business units. Update the AWS Config rule to change the automatic remediation action to use the new runbook.

Answer

Create a new AWS Systems Manager Automation runbook that adds an IP set to the security group's inbound rule. Update the AWS Config rule to change the automatic remediation action to use the new runbook.

Answer

Create an AWS Lambda function that adds an IP set to the security group's inbound rule. Update the AWS Config rule to change the automatic remediation action to use the Lambda function.

Answer

Create an AWS Lambda function that updates the security group's inbound rule with the IP addresses from the business units. Update the AWS Config rule to change the automatic remediation action to use the Lambda function.

Question 40

A company's application on EC2 instances relies on a Single-AZ RDS for MySQL DB instance. The SysOps administrator needs to ensure failover to minimize downtime.

Accepted Answer

Modify the DB instance to be a Multi-AZ DB instance deployment.

Answer

Add a read replica in the same Availability Zone where the DB instance is deployed.

Answer

Add the DB instance to an Auto Scaling group that has a minimum capacity of 2 and a desired capacity of 2.

Answer

Use RDS Proxy to configure a proxy in front of the DB instance.

Amazon SOA-C02 Practice Test 10

Amazon SOA-C02 Practice Tests

Amazon SOA-C02 Practice Test 10

Question

Amazon SOA-C02 Practice Tests

Practice Tests