Quiz IT certification exam

Question 1

A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6- only subnets.

How should a SysOps administrator configure the VPC to meet these requirements?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Create and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets.

Answer

Create and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.

Answer

Create and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.

Answer

Create and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.

Question 2

A company wants to track its AWS costs in all member accounts that are part of an organization in AWS Organizations. Managers of the member accounts want to receive a notification when the estimated costs exceed a predetermined amount each month. The managers are unable to configure a billing alarm. The IAM permissions for all users are correct. What could be the cause of this issue?

Accepted Answer

The company has not configured AWS Resource Access Manager (AWS RAM) to share billing information between the member accounts and the management/payer account.

Answer

The management/payer account does not have billing alerts turned on.

Answer

Amazon GuardDuty is turned on for all the accounts.

Answer

The company has not configured an AWS Config rule to monitor billing.

Question 3

A SysOps administrator creates an AWS CloudFormation template to define an application stack that can be deployed in multiple AWS Regions. The SysOps administrator also creates an Amazon CloudWatch dashboard by using the AWS Management Console. Each deployment of the application requires its own CloudWatch dashboard. How can the SysOps administrator automate the creation of the CloudWatch dashboard each time the application is deployed?

Accepted Answer

Export the existing CloudWatch dashboard as JSON. Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Include the exported JSON in the resource's DashboardBody property.

Answer

Create a script by using the AWS CLI to run the aws cloudformation put-dashboard command with the name of the dashboard. Run the command each time a new CloudFormation stack is created.

Answer

Update the CloudFormation template to define an resource. Use the intrinsic Ref function to reference the ID of the existing CloudWatch dashboard.

Answer

Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource.Specify the name of the existing dashboard in the DashboardName property.

Question 4

A SysOps administrator is required to monitor free space on Amazon EBS volumes attached to Microsoft Windows-based Amazon EC2 instances within a company’s account. The administrator must be alerted to potential issues. What should the administrator do to receive email alerts before low storage space affects EC2 instance performance?

Accepted Answer

Use the Amazon CloudWatch agent to send disk space metrics, then set up CloudWatch alarms using an Amazon SNS topic.

Answer

Use built-in Amazon CloudWatch metrics, and configure CloudWatch alarms and an Amazon SNS topic for email notifications

Answer

Use AWS CloudTrail logs and configure the trail to send notifications to an Amazon SNS topic.

Answer

Use AWS Trusted Advisor and enable email notification alerts for EC2 disk space

Question 5

A company plans to migrate several of its high performance computing (MPC) virtual machines (VMs) to Amazon EC2 instances on AWS. A SysOps administrator must identify a placement group for this deployment. The strategy must minimize network latency and must maximize network throughput between the HPC VMs.Which strategy should the SysOps administrator choose to meet these requirements?

Accepted Answer

Deploy the instances in a cluster placement group in one Availability Zone.

Answer

Deploy the instances in a partition placement group in two Availability Zones

Answer

Deploy the instances in a partition placement group in one Availability Zone

Answer

Deploy the instances in a spread placement group in two Availably Zones

Question 6

A company's VPC has connectivity to an on-premises data center through an AWS Site-to-Site VPN.The company needs Amazon EC2 instances in the VPC to send DNS queries for example com to the DNS servers in the data center. Which solution will meet these requirements?

Accepted Answer

Create an Amazon Route 53 Resolver outbound endpoint Create a conditional forwarding rule on the on-premises DNS servers to forward DNS requests for example.com to the outbound endpoints

Answer

Create an Amazon Route 53 Resolver inbound endpoint Create a conditional forwarding rule on the on-primes DNS servers to forward DNS requests for example.com to the inbound endpoints.

Answer

Create an Amazon Route 53 Resolver inbound endpoint Create a forwarding rule on the resolver that sends all queries for example.com to the on-premises DNS servers. Associate this rule with the VPC.

Answer

Create an Amazon Route 53 Resolver outbound endpoint. Create a forwarding rule on the resolver that sends all queries for exarrc4e.com to the on-premises DNS servers Associate this rule with the VPC.

Question 7

A software company runs a workload on Amazon EC2 instances behind an Application Load Balancer (ALB) A SysOcs administrator needs to define a custom health check for the EC2 instances. What is the MOST operationally efficient solution?

Accepted Answer

Configure the health check on the ALB and ensure that the HeathCheckPath setting s correct

Answer

Set up each EC2 Instance so that it writes its healthy/unhealthy status into a shared Amazon S3 bucket for the ALB to read

Answer

Set up Amazon ElasticCache to track the EC2 instances as they scale in and out

Answer

Configure an Amazon API Gateway health check to ensure custom checks on aw of the EC2 instances

Question 8

A SysOos administrator s tasked with analyzing database performance. The database runs on a single Amazon RDS D6 instance. The SysOps administrator finds that, during times of peak traffic, resources on the database are over utilized due to the amount of read traffic.Which actions should the SysOps administrator take to improve RDS performance? (Select TWO.)

Accepted Answer

Add a read replica.

Accepted Answer

Modify the application to use Amazon ElastiCache for Memcached.

Answer

Migrate the database from RDS to Amazon DynamoDB.

Answer

Migrate the database to Amazon EC2 with enhanced networking enabled

Answer

Upgrade the database to a Multi-AZ deployment.

Question 9

A company recently its server infrastructure to Amazon EC2 instances. The company wants to use Amazon CloudWatch metrics to track instance memory utilization and available disk space. What should a SysOps administrator do to meet these requirements?

Accepted Answer

Install and configure the CloudWatch agent on all the instances Attach an IAM user to allow the instances to write logs to CloudWatch.

Answer

Configure CloudWatch from the AWS Management Console tor all the instances that require monitoring by CloudWatch. AWS automatically installs and configures the agents far the specified instances.

Answer

Install and configure the CloudWatch agent on all the instances Attach an IAM role to allow the instances to write logs to CloudWatch.

Answer

Install and configure the CloudWatch agent on all the instances. Attach the necessary security groups to allow the instances to write logs to CloudWatch

Question 10

A SysOps administrator configures an Amazon S3 gateway endpoint in a VPC. The private subnets inside the VPC do not nave outbound internet access. A user logs in to an Amazon EC2 instance in one of the private subnets and cannot upload a file to an Amazon S3 bucket in the same AWS Region Which solution will solve this problem?

Accepted Answer

Update the EC2 subnet route table to include the S3 prefix tot destination routes to the S3 gateway endpoint.

Answer

Update the EC2 instance role policy to allow s3:PutObjed access to the target S3 bucket.

Answer

Update the EC2 security group to allow outbound traffic to 0.0.0.070 for port 80.

Answer

Update the S3 bucket policy to allow s3 PurObject access from the private subnet OOR block.

Question 11

A company applies user-defined tags to resources that are associated with me company's AWS workloads Twenty days after applying the tags, the company notices that it cannot use re tags to filter views in the AWS Cost Explorer console. What is the reason for this issue?

Accepted Answer

The company has not activated the user-defined tags for cost allocation.

Answer

It lakes at least 30 days to be able to use tags to filter views in Cost Explorer.

Answer

The company has not created an AWS Cost and Usage Report

Answer

The company has not created a usage budget in AWS Budgets

Question 12

A company's SysOps administrator must ensure that all Amazon EC2 Windows instances that are launched in an AWS account have a third-party agent installed. The third-party agent has an msi package. The company uses AWS Systems Manager for patching, and the Windows instances are tagged appropriately. The third-party agent required periodic updates as new versions are released. The SysOps administrator must deploy these updates automaticallyWhich combination of steps will meet these requirements with the LEAST operational effort? (Seed TWO.) Create a Systems Manager Distributor package for the third-party agent.

Accepted Answer

Make sure that Systems Manager Inventory Is configured. If Systems Manager Inventory is not configured, set up a new inventory tor instances that is based on the appropriate tag value for Windows.

Accepted Answer

Create a Systems Manager Opsitem with the tag value for Windows Attach the Systems Manager Distributor package to the Opsitem. Create a maintenance window that is specific to the package deployment Configure the maintenance window to cover 24 hours a day.

Answer

Create a Systems Manager State Manager association to run the AWS-RunRemoteScript document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windows with a schedule of 1 day

Answer

Create a Systems Manager State Manager- association to run the AWS-ConfigureAWSPackage document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windows with a schedule of 1 day

Question 13

A global gaming company is preparing to launch a new game on AWS. The game runs in multiple AWS Regions on a fleet of Amazon EC2 instances. The instances are in an Auto Scaling group behind an Application Load Balancer (ALB) in each Region. The company plans to use Amazon Route 53 tor DNS services. The DNS configuration must direct users to the Region that is closest to mem and must provide automated failover. Which combination of steps should a SysOps administrator take to configure Route 53 to meet these requirements?{Select TWO.)

Accepted Answer

Create Amazon CloudWatch alarms that monitor the health of the ALB in each Region. Configure Route 53 DNS failover by using a health check that monitors the alarms.

Accepted Answer

Configure Route 53 geoproximity routing Specify the Regions that are used for the infrastructure

Answer

Create Amazon CloudWatch alarms that monitor the hearth of the EC2 instances in each Region.Configure Route 53 DNS failover by using a health check that monitors the alarms.

Answer

Configure Route 53 DNS failover by using a health check that monitors the private address of an EC2 instance in each Region.

Answer

Configure Route 53 simple routing Specify the continent, country, and state or province that are used for the infrastructure.

Question 14

A SysOps administrator is configuring an application on Amazon EC2 instances for a company Teams in other countries will use the application over the internet. The company requires the application endpoint to have a static pubic IP address.How should the SysOps administrator deploy the application to meet this requirement?

Accepted Answer

Behind an internet-facing Network Load Balancer

Answer

Behind an Amazon API Gateway API

Answer

Behind an Application Load Balancer

Answer

In an Amazon CloudFront distribution

Question 15

A SysOps administrator trust manage the security of An AWS account Recently an IAM users access key was mistakenly uploaded to a public code repository. The SysOps administrator must identity anything that was changed by using this access key.

Accepted Answer

Search AWS CloudTrail event history tor all events initiated with the compromised access key within the suspected timeframe

Answer

Create an Amazon EventBridge (Amazon CloudWatch Events) rule to send all IAM events lo an AWS Lambda function for analysis

Answer

Query Amazon EC2 togs by using Amazon CloudWatch Logs Insights for all events Heated with the compromised access key within the suspected timeframe

Answer

Search VPC Flow Logs foe all events initiated with the compromised access key within the suspected Timeframe.

Question 16

A company maintains a large set of sensitive data in an Amazon S3 bucket. The company's security team asks a SyeOps administrator to help verify that all current objects in the S3 bucket are encrypted. What is the MOST operationally efficient solution that meets these requirements?

Accepted Answer

Create an S3 Inventory configuration on the S3 bucket Induce the appropriate status fields.

Answer

Create a script that runs against the S3 bucket and outputs the status of each object.

Answer

Provide the security team with an IAM user that has read access to the S3 bucket.

Answer

Use the AWS CLI to output a list of all objects in the S3 bucket.

Question 17

A company has a high-performance Windows workload. The workload requires a storage volume mat provides consistent performance of 10.000 KDPS. The company does not want to pay for additional unneeded capacity to achieve this performance.Which solution will meet these requirements with the LEAST cost?

Accepted Answer

Use a Provisioned IOPS SSD (lol) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10.000 provisioned IOPS

Answer

Use a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10.000 provisioned IOPS.

Answer

Use an Amazon Elastic File System (Amazon EFS) file system w\ Max I/O mode.

Answer

Use an Amazon FSx for Windows Fife Server foe system that is configured with 10.000 IOPS

Question 18

A company has an application that is running on Amazon EC2 instances in a VPC. The application needs access to download software updates from the internet. The VPC has public subnets and private signets. The company's security policy requires all ECS instances to be deployed in private subnets What should a SysOps administrator do to meet those requirements?

Accepted Answer

Add a NAT gateway to a public subnet in the route table for the private subnets, add a route to the NAT gateway.

Answer

Add an internet gateway to the VPC In the route table for the private subnets, odd a route to the interne; gateway.

Answer

Add a NAT gateway to a private subnet. In the route table for the private subnets, add a route to the NAT gateway.

Answer

Add two internet gateways to the VPC. In The route tablet for the private subnets and public subnets, add a route to each internet gateway.

Question 19

A SysOps administrator has successfully deployed a VPC with an AWS Cloud Formation template The SysOps administrator wants to deploy me same template across multiple accounts that are managed through AWS Organizations. Which solution will meet this requirement with the LEAST operational overhead?

Accepted Answer

CreateStack API call. Use AWS CloudFormation StackSets from the management account to deploy the template in each of the accounts

Answer

Assume the OrganizationAccountAcccssKolc IAM role from the management account. Deploy the template in each of the accounts

Answer

Create an AWS Lambda function to assume a role in each account Deploy the template by using the AWS CloudFormation CreateStack API call

Answer

Create an AWS Lambda function to query fc a list of accounts Deploy the template by using the AWS Cloudformation

Question 20

A SysOps administrator must ensure that a company's Amazon EC2 instances auto scale as expected The SysOps administrator configures an Amazon EC2 Auto Scaling Lifecycle hook to send an event to Amazon EventBridge (Amazon CloudWatch Events), which then invokes an AWS Lambda function to configure the EC2 distances When the configuration is complete, the Lambda function calls the complete Lifecycle-action event to put the EC2 instances into service. In testing, the SysOps administrator discovers that the Lambda function is not invoked when the EC2 instances auto scale. What should the SysOps administrator do to reserve this issue?

Accepted Answer

Update the Lambda function execution role so that it has permission to call the complete lifecycleaction event

Answer

Add a permission to the Lambda function so that it can be invoked by the EventBridge (CloudWatch Events) rule.

Answer

Change the lifecycle hook action to CONTINUE if the lifecycle hook experiences a fa* we or timeout.

Answer

Configure a retry policy in the EventBridge (CloudWatch Events) rule to retry the Lambda function invocation upon failure.

Question 21

A company with multiple AWS accounts needs to obtain recommendations for AWS Lambda functions and identify optimal resource configurations for each Lambda function. How should a SysOps administrator provide these recommendations?

Accepted Answer

Enable AWS Compute Optimizer and export the Lambda function recommendations

Answer

Create an AWS Serverless Application Repository and export the Lambda function recommendations.

Answer

Enable all features of AWS Organization and export the recommendations from AWS CloudTrail Insights.

Answer

Run AWS Trusted Advisor and export the Lambda function recommendations

Question 22

A SysOps administrator needs to delete an AWS CloudFormation stack that is no longer in use. The CloudFormation stack is in the DELETE_FAILED state. The SysOps administrator has validated the permissions that are required to delete the Cloud Formation stack.

Accepted Answer

There are additional resources associated with a security group m the stack

Accepted Answer

There are Amazon S3 buckets that still contain objects in the stack.

Answer

The configured timeout to delete the stack was too low for the delete operation to complete.

Answer

The stack contains nested stacks that must be manually deleted fast.

Answer

The stack was deployed with the -disable rollback option.

Question 23

A company stores critical data m Amazon S3 buckets. A SysOps administrator must build a solution to record all S3 API activity. Which action will meet this requirement?

Accepted Answer

Create an AWS CloudTrail trail to log data events tor all S3 objects

Answer

Configure S3 bucket metrics to record object access logs

Answer

Enable S3 server access logging for each S3 bucket

Answer

Use AWS IAM Access Analyzer for Amazon S3 to store object access logs.

Question 24

A SysOps administrator is optimizing the cost of a workload. The workload is running in multiple AWS Regions and is using AWS Lambda with Amazon EC2 On-Demand Instances for the compute. The overall usage is predictable. The amount of compute that is consumed in each Region varies, depending on the users' locations.Which approach should the SysOps administrator use to optimize this workload?

Accepted Answer

Purchase Compute Savings Plans based on the usage during the past 30 days

Answer

Purchase Convertible Reserved Instances by calculating the usage baseline.

Answer

Purchase EC2 Instance Savings Plane based on the usage during the past 30 days

Answer

Purchase Standard Reserved Instances by calculating the usage baseline.

Question 25

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A SysOpe administrator notices that some of these EC2 instances show up as heathy in the Auto Scaling g-out but show up as unhealthy in the ALB target group. What is a possible reason for this issue?

Accepted Answer

The target group health check is configured with an incorrect port or path

Answer

Security groups ate rot allowing traffic between the ALB and the failing EC2 instances

Answer

The Auto Seating group health check is configured for EC2 status checks

Answer

The EC2 instances are failing to launch and failing EC2 status checks.

Question 26

A SysOps administrator is testing an application mat is hosted on five Amazon EC2 instances The instances run in an Auto Scaling group behind an Application Load Balancer (ALB) High CPU utilization during load testing is causing the Auto Scaling group to scale out. The SysOps administrator must troubleshoot to find the root cause of the high CPU utilization before the Auto Scaling group scales out. Which action should the SysOps administrator take to meet these requirements?

Accepted Answer

Suspend the Launch and Terminate process types.

Answer

Enable instance scale-in protection.

Answer

Place the instance into the Standby stale.

Answer

Remove the listener from the ALB

Question 27

A company uses Amazon S3 to aggregate raw video footage from various media teams across the US.The company recently expanded into new geographies in Europe and Australi a. The technical teams located in Europe and Australia reported delays when uploading large video tiles into the destination S3 bucket m toe United States. What are the MOST cost-effective ways to increase upload speeds into the S3 bucket? (Select TWO.)

Accepted Answer

Use Amazon S3 Transfer Acceleration for file uploads into the destination S3 bucket.

Accepted Answer

Use multipart uploads for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.

Answer

Create multiple AWS Direct Connect connections between AWS and branch offices in Europe and Australia tor He uploads into the destination S3 bucket

Answer

Create multiple AWS Site-to-Site VPN connections between AWS and branch offices in Europe and Australia for file uploads into the destination S3 bucket.

Answer

Use AWS Global Accelerator for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.

Question 28

A company needs to ensure strict adherence to a budget for 25 applications deployed on AWS Separate teams are responsible for storage compute, and database costs. A SysOps administrator must implement an automated solution to alert each team when their projected spend will exceed a quarterly amount mat has been set by the finance department. The solution cannot additional compute, storage, or database costs.

Accepted Answer

Use AWS Budgets :o create one cost budget and select each of the services in use Specify the budget amount defined by the finance department along with the forecasted cost threshold Enter the appropriate email recipients for the budget.

Answer

Configure AWS Cost and Usage Reports to send a daily report to an Amazon S3 bucket. Create an AWS Lambda function that will evaluate Spend by service and nobly each team by using Amazon Simple Notification Service (Amazon SNS) notifications. Invoke the Lambda function when a report is placed in the S3 bucket

Answer

Configure AWS Cost and Usage Reports to send a dairy report to an Amazon S3 bucket. Create a rule In Amazon EventBridge (Amazon CloudWatch Events) to evaluate the spend by service and notify each team by using Amazon Simple Queue Service (Amazon SOS) when the cost threshold i6 exceeded.

Answer

Use AWS Budgets to create a cost budget for each team, filtering by the services they own. Specify the budget amount defined by the finance department along with a forecasted cost threshold Enter the appropriate email recipients for each budget.

Question 29

A company plans to launch a static website on its domain example com and subdomain www example.com using Amazon S3. How should the SysOps administrator meet this requirement?

Accepted Answer

Create two S3 buckets named example.com and www.example.com. Configure the subdomain bucket to redirect requests to the domain bucket.

Answer

Create one S3 bucket named example.com for both the domain and subdomain.

Answer

Create one S3 bucket with a wildcard named '.example.com tor both the domain and subdomain.

Answer

Create two S3 buckets named http//example.com and http//" exampte.com. Configure thewildcard (') bucket to redirect requests to the domain bucket.

Question 30

A SysOps administrator configuring AWS Client VPN to connect use's on a corporate network to AWS resources mat are running in a VPC According to compliance requirements, only traffic that is destined for the VPC can travel across the VPN tunnel.How should the SysOps administrator configure Client VPN to meet these requirements?

Accepted Answer

On the Client VPN endpoint, specify DNS server IP addresses

Answer

Associate the Client VPN endpoint with a private subnet that has an internet route through a NAT gateway.

Answer

On the Client VPN endpoint, turns on the split-tunnel option.

Answer

Select a private certificate to use as the identity certificate tor the VPN client.

Question 31

A SysOps administrator has Nocked public access to all company Amazon S3 buckets. The SysOps administrator wants to be notified when an S3 bucket becomes publicly readable in the future. What is the MOST operationally efficient way to meet this requirement?

Accepted Answer

Enable the s3-bucket-public-read-prohibited managed rule in AWS Config. Subscribe the AWS Config rule to an Amazon Simple Notification Service (Amazon SNS) topic.

Answer

Create an AWS Lambda function that periodically checks the public access settings for each S3 bucket. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications.

Answer

Create a cron script that uses the S3 API to check the public access settings for each S3 bucket. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications

Answer

Enable S3 Event notified tons for each S3 bucket. Subscribe S3 Event Notifications to an Amazon Simple Notification Service (Amazon SNS) topic.

Question 32

A company wants to create an automated solution for all accounts managed by AWS Organizations to detect any worry groups that urn 0.0.0.0/0 as the source address for inbound traffic. The company also wants to automatically remediate any noncompliant security groups by restricting access to a specific CIDR block corresponds with the company's intranet.

Accepted Answer

Create an AWS Config rule to detect noncompliant security groups. Set up automatic remediation to change the 0.0.0.0/0 source address to the approved CIDK block.

Answer

Create an IAM policy to deny the creation of security groups that have 0.0.0.0/0 as the source address Attach this 1AM policy to every user in the company.

Answer

Create an AWS Lambda function to inspect now and existing security groups check for a noncompliant 0.0.0.0A) source address and change the source address to the approved CIDR block.

Answer

Create a service control policy (SCP) for the organizational unit (OU) to deny the creation of security groups that have the 0.0.0.0/0 source address. Set up automatic remediation to change Vie 0.0.0.0/0 source address to the approved CIDR block.

Question 33

A company runs an application on an Amazon EC2 instance A SysOps administrator creates an Auto Scaling group and an Application Load Balancer (ALB) to handle an increase in demand However, the EC2 instances are failing tie health check.What should the SysOps administrator do to troubleshoot this issue?

Accepted Answer

Verily that the application is running on the protocol and the port that the listens is expecting.

Answer

Verity that the Auto Scaling group is configured to use all AWS Regions.

Answer

Verify the listener priority in the ALB Change the priority if necessary.

Answer

Verify the maximum number of instances in the Auto Scaling group Change the number if necessary

Question 34

A SysOps administrator needs to create alerts that are based on the read and write metrics of Amazon Elastic Block Store (Amazon EBS) volumes that are attached to an Amazon EC2 instance. The SysOps administrator creates and enables Amazon CloudWatch alarms for the DiskReadBytes metric and the DiskWriteBytes metric.A custom monitoring tool that is installed on the EC2 instance with the same alarm configuration indicates that the volume metrics have exceeded the threshold. However, the CloudWatch alarms were not in ALARM state. Which action will ensure that the CloudWatch alarms function correctly?

Accepted Answer

Install and configure the CloudWatch agent on the EC2 instance to capture the desired metrics.

Answer

Install and configure AWS Systems Manager Agent on the EC2 instance to capture the desired metrics.

Answer

Reconfigure the CloudWatch alarms to use the VolumeReadBytes metric and the VolumeWriteBytes metric for the EBS volumes.

Answer

Reconfigure the CloudWatch alarms to use the VolumeReadBytes metric and the VolumeWriteBytes metric for the EC2 instance.

Question 35

A company has created a NAT gateway in a public subnet in a VPC. The VPC also contains a private subnet that includes Amazon EC2 instances. The EC2 instances use the NAT gateway to access the internet to download patches and updates. The company has configured a VPC flow log for the elastic network interface of the NAT gateway. The company is publishing the output to Amazon CloudWatch Logs. A SysOps administrator must identify the top five internet destinations that the EC2 instances in the private subnet communicate with for downloads. What should the SysOps administrator do to meet this requirement in the MOST operationally efficient way?

Accepted Answer

Use CloudWatch Logs Insights to identify the top five internet destinations.

Answer

Use AWS CloudTrail Insights events to identify the top five internet destinations.

Answer

Use Amazon CloudFront standard logs (access logs) to identify the top five internet destinations.

Answer

Change the flow log to publish logs to Amazon S3. Use Amazon Athena to query the log files in Amazon S3.

Question 36

A company has an application that is deployed 10 two AWS Regions in an active-passive configuration. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in each Region. The instances are in an Amazon EC2 Auto Scaling group in each Region. The application uses an Amazon Route 53 hosted zone (or DNS. A SysOps administrator needs to configure automatic failover to the secondary Region. What should the SysOps administrator do to meet these requirements?

Accepted Answer

Configure Route 53 alias records that point to each ALB. Choose a failover routing policy. Set Evaluate Target Health to Yes.

Answer

Configure CNAME records that point to each ALB. Choose a failover routing policy. Set Evaluate Target Health to Yes.

Answer

Configure Elastic Load Balancing (ELB) health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.

Answer

Configure EC2 health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.

Question 37

A company has a compliance requirement that no security groups can allow SSH ports to be open to all IP addresses. A SysOps administrator must implement a solution that will notify the company's SysOps team when a security group rule violates this requirement. The solution also must remediate the security group rule automatically. Which solution will meet these requirements?

Accepted Answer

Activate the AWS Config restricted-ssh managed rule. Add automatic remediation to the AWS Config rule by using the AWS Systems Manager Automation AWSDisablePublicAccessForSecurityGroup runbook. Create an Amazon EventBridge (Amazon CloudWatchEvents) rule to notify the SysOps team when the rule is noncompliant.

Answer

Create an Amazon EventBridge (Amazon CloudWatch Events) rule that invokes an AWS Lambda function when a security group changes. Configure the Lambda function to evaluate the security group for compliance, remove all inbound security group rules on all ports, and notify the SysOps team if the security group is noncompliant.

Answer

Create an AWS CloudTrail metric filter for security group changes. Create an Amazon CloudWatch alarm to notify the SysOps team through an Amazon Simple Notification Service (Amazon SNS) topic when (he metric is greater than 0. Subscribe an AWS Lambda function to the SNS topic to remediatethe security group rule by removing the rule.

Answer

Create an AWS CloudTrail metric filter for security group changes. Create an Amazon CloudWatch alarm for when the metric is greater than 0. Add an AWS Systems Manager action to the CloudWatch alarm to suspend the security group by using the Systems Manager Automation AWSDisablePublicAccessForSecurityGroup runbook when the alarm is in ALARM state. Add an Amazon Simple Notification Service (Amazon SNS) topic as a second target to notify the SysOps team.

Question 38

SIMULATIONYou need to update an existing AWS CloudFormation stack. If needed, a copy to the CloudFormation template is available in an Amazon SB bucket named cloudformation-bucket 1. Use the us-east-2 Region for all resources.2. Unless specified below, use the default configuration settings.3. update the Amazon EQ instance named Devinstance by making the following changes to the stacknamed 1700182:a) Change the EC2 instance type to us-east-t2.nano.b) Allow SSH to connect to the EC2 instance from the IP address range192.168.100.0/30.c) Replace the instance profile IAM role with IamRoleB.4. Deploy the changes by updating the stack using the CFServiceR01e role.5. Edit the stack options to prevent accidental deletion.6. Using the output from the stack, enter the value of the Prodlnstanceld in the text box below:<img alt="Amazon SOA-C02 image Question 238 8273 09162024010005000000"   width="286" height="39" src="https://examgecko.com/getfile/70f6fd22-3c20-4303-a08d-91f1b43a82ca">

Accepted Answer

See the for solution.

Question 39

A company recently acquired another corporation and all of that corporation's AWS accounts. A financial analyst needs the cost data from these accounts. A SysOps administrator uses Cost Explorer to generate cost and usage reports. The SysOps administrator notices that "No Tagkey" represents 20% of the monthly cost.What should the SysOps administrator do to tag the "No Tagkey" resources?

Accepted Answer

Use Tag Editor to find and taq all the untaqqed resources.

Answer

Add the accounts to AWS Organizations. Use a service control policy (SCP) to tag all the untagged resources.

Answer

Use an AWS Config rule to find the untagged resources. Set the remediation action to terminate the resources.

Answer

Use Cost Explorer to find and tag all the untagged resources.

Question 40

A SysOps administrator noticed that the cache hit ratio for an Amazon CloudFront distribution is less than 10%. Which collection of configuration changes will increase the cache hit ratio for the distribution? (Select TWO.)

Accepted Answer

Ensure that only required cookies, query strings, and headers are forwarded in the Cache Behavior Settings.

Accepted Answer

Increase the CloudFront time to live (TTL) settings in the Cache Behavior Settings.

Answer

Change the Viewer Protocol Policy to use HTTPS only.

Answer

Configure the distribution to use presigned cookies and URLs to restrict access to the distribution.

Answer

Enable automatic compression of objects in the Cache Behavior Settings.

Amazon SOA-C02 Practice Test 6

Amazon SOA-C02 Practice Tests