Quiz IT certification exam

Question 1

A company hosts an internet web application on Amazon EC2 instances. The company is replacing the application with a new AWS Lambda function. During a transition period, the company must route some traffic to the legacy application and some traffic to the new Lambda function. The company needs to use the URL path of request to determine the routing.

Which solution will meet these requirements?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Configure an Application Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.

Answer

Configure a Gateway Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.

Answer

Configure a Network Load Balancer to use the URL path to direct traffic to the legacy application and the new Lambda function.

Answer

Configure a Network Load Balancer to use a regular expression to match the URL path to direct traffic to the new Lambda function.

Question 2

A SysOps administrator manages policies for many AWS member accounts in an AWS Organizations structure. Administrators on other teams have access to the account root user credentials of the member accounts. The SysOps administrator must prevent all teams, including their administrators, from using Amazon DynamoDB. The solution must not affect the ability of the teams to access other AWS services.Which solution will meet these requirements?

Accepted Answer

Create a service control policy (SCP) in the management account to deny all DynamoDB actions. Apply the SCP to the root of the organization

Answer

In all member accounts, configure 1AM policies that deny access to all DynamoDB resources for all users, including the root user.

Answer

In all member accounts, configure 1AM policies that deny AmazonDynamoDBFullAccess to all users, including the root user.

Answer

Remove the default service control policy (SCP) in the management account. Create a replacement SCP that includes a single statement that denies all DynamoDB actions.

Question 3

A company hosts a production MySQL database on an Amazon Aurora single-node DB cluster. The database is queried heavily for reporting purposes. The DB cluster is experiencing periods of performance degradation because of high CPU utilization and maximum connections errors. A SysOps administrator needs to improve the stability of the database.Which solution will meet these requirements?

Accepted Answer

Create an Aurora Replica node. Create an Auto Scaling policy to scale replicas based on CPU utilization. Ensure that all reporting requests use the read-only connection string.

Answer

Create a second Aurora MySQL single-node DB cluster in a second Availability Zone. Ensure that all reporting requests use the connection string for this additional node.

Answer

Create an AWS Lambda function that caches reporting requests. Ensure that all reporting requests call the Lambda function.

Answer

Create a multi-node Amazon ElastiCache cluster. Ensure that all reporting requests use the ElastiCache cluster. Use the database if the data is not in the cache.

Question 4

A SysOps administrator is responsible for managing a fleet of Amazon EC2 instances. These EC2 instances upload build artifacts to a third-party service. The third-party service recently implemented a strict IP allow list that requires all build uploads to come from a single IP address.What change should the systems administrator make to the existing build fleet to comply with this new requirement?

Accepted Answer

Move all of the EC2 instances behind a NAT gateway and provide the gateway IP address to the service.

Answer

Move all of the EC2 instances behind an internet gateway and provide the gateway IP address to the service.

Answer

Move all of the EC2 instances into a single Availability Zone and provide the Availability Zone IP address to the service.

Answer

Move all of the EC2 instances to a peered VPC and provide the VPC IP address to the service.

Question 5

A SysOps administrator needs to monitor a process that runs on Linux Amazon EC2 instances. If the process stops, the process must restart automatically. The Amazon CloudWatch agent is already installed on all the EC2 Instances.Which solution will meet these requirements?

Accepted Answer

Add a procstat monitoring configuration to the CloudWatch agent for the process. Create an Amazon EventBridge event rule that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.

Answer

Add a StatsD monitoring configuration to the CloudWatch agent for the process. Create a CloudWatch alarm that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.

Answer

Add a StatsD monitoring configuration to the CloudWatch agent for the process. Create an Amazon EventBridge event rule that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.

Answer

Add a procstat monitoring configuration to the CloudWatch agent for the process. Create a CloudWatch alarm that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.

Question 6

A SysOps administrator is preparing to deploy an application to Amazon EC2 instances that are in an Auto Scaling group. The application requires dependencies to be installed. Application updates are Issued weekly.The SysOps administrator needs to implement a solution to incorporate the application updates on a regular basis. The solution also must conduct a vulnerability scan during Amazon Machine Image (AMI) creation.What is the MOST operationally efficient solution that meets these requirements?

Accepted Answer

Use EC2 Image Builder with a custom recipe to install the application and its dependencies.

Answer

Create a script that uses Packer. Schedule a cron job to run the script.

Answer

Install the application and its dependencies on an EC2 instance. Create an AMI of the H2 instance.

Answer

Invoke the EC2 Createlmage API operation by using an Amazon EventBridge scheduled rule.

Question 7

A company has a public web application that experiences rapid traffic increases after advertisements appear on local television. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The Auto Scaling group is not keeping up with the traffic surges after an advertisement runs. The company often needs to scale out to 100 EC2 instances during the traffic surges.The instance startup times are lengthy because of a boot process that creates machine-specific data caches that are unique to each instance. The exact timing of when the advertisements will appear on television is not known. A SysOps administrator must implement a solution so that the application can function properly during the traffic surges.Which solution will meet these requirements?

Accepted Answer

Create a warm pool. Keep enough instances in the Slopped state to meet the increased demand.

Answer

Start 100 instances. Allow the boot process to finish running. Store this data on the instance store volume before stopping the instances.

Answer

Increase the value of the instance warmup time in the scaling policy.

Answer

Use predictive scaling for the Auto Scaling group.

Question 8

A company is running production workloads that use a Multi-AZ deployment of an Amazon RDS for MySQL db.m6g.xlarge (general purpose) standard DB instance. Users report that they are frequently encountering a 'too many connections' error. A SysOps administrator observes that the number of connections on the database is high.The SysOps administrator needs to resolve this issue while keeping code changes to a minimum.Which solution will meet these requirements MOST cost-effectively?

Accepted Answer

Configure RDS Proxy. Modify the application configuration file to use the RDS Proxy endpoint.

Answer

Modify the RDS for MySQL DB instance to a larger instance size.

Answer

Migrate the RDS for MySQL DB instance to Amazon DynamoDB.

Answer

Modify the RDS for MySQL DB instance to a memory optimized DB instance.

Question 9

A development team created and deployed a new AWS Lambda function 15 minutes ago. Although the function was invoked many times. Amazon CloudWatch Logs are not showing any log messages.What is one cause of this?

Accepted Answer

The Lambda function's role does not include permissions to create CloudWatch Logs items.

Answer

The developers did not enable log messages for this Lambda function.

Answer

The Lambda function raises an exception before the first log statement has been reached.

Answer

The Lambda functions creates local log files that have to be shipped to CloudWatch Logs first before becoming visible.

Question 10

A company manages a set of accounts on AWS by using AWS Organizations. The company's security team wants to use a native AWS service to regularly scan all AWS accounts against the Center for Internet Security (CIS) AWS Foundations Benchmark.What is the MOST operationally efficient way to meet these requirements?

Accepted Answer

Designate an AWS Security Hub administrator account. Configure new accounts in the organization to automatically become member accounts. Enable CIS AWS Foundations Benchmark scans.

Answer

Designate a central security account as the AWS Security Hub administrator account. Create a script that sends an invitation from the Security Hub administrator account and accepts the invitation from the member account. Run the script every time a new account is created. Configure Security Hub to run the CIS AWS Foundations Benchmark scans.

Answer

Run the CIS AWS Foundations Benchmark across all accounts by using Amazon Inspector.

Answer

Designate a central security account as the Amazon GuardDuty administrator account. Create a script that sends an invitation from the GuardDuty administrator account and accepts the invitation from the member account. Run the script every time a new account is created. Configure GuardDuty to run the CIS AWS Foundations Benchmark scans.

Question 11

A SysOps administrator needs to configure an Amazon S3 bucket to host a web application. The SysOps administrator has created the S3 bucket and has copied the static files for the web application to the S3 bucket.The company has a policy that all S3 buckets must not be public.What should the SysOps administrator do to meet these requirements?

Accepted Answer

Create an Amazon CloudFront distribution. Configure the S3 bucket as an origin with an origin access identity (OAI). Give the OAI the s3:GetObject permission in the S3 bucket policy.

Answer

Configure static website hosting in the S3 bucket. Use Amazon Route 53 to create a DNS CNAME to point to the S3 website endpomt.

Answer

Create an Application Load Balancer (ALB). Change the protocol to HTTPS in the ALB listener configuration. Forward the traffic to the S3 bucket.

Answer

Create an accelerator in AWS Global Accelerator. Set up a listener configuration for port 443. Set the endpoint type to forward the traffic to the S3 bucket.

Question 12

A company recently deployed an application in production. The production environment currently runs on a single Amazon EC2 instance that hosts the application's web application and a MariaDB database. Company policy states that all IT production environments must be highly available.What should a SysOps administrator do to meet this requirement?

Accepted Answer

Migrale the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance. Run the application on EC2 instances that are in an Auto Scaling group that extends across multiple Availability Zones. Place the EC2 instances behind a load balancer.

Answer

Migrate the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance. Use AWS Application Migration Service to convert the application into an AWS Lambda function. Specify the Multi-AZ option for the Lambda function.

Answer

Copy the database to a different EC2 instance in a different Availability Zone. Use AWS Backup to create Amazon Machine Images (AMIs) of the application EC2 instance and the database EC2 instance. Create an AWS Lambda function that performs health checks every minute. In case of failure, configure the Lambda function to launch a new EC2 instance from the AMIs that AWS Backup created.

Answer

Migrate the database to a different EC2 instance. Place the application EC2 instance in an Auto Scaling group that extends across multiple Availability Zones. Create an Amazon Machine Image (AMI) from the database EC2 instance. Use the AMI to launch a second database EC2 instance in a different Availability Zone. Put the second database EC2 instance in the stopped state. Use the second database EC2 instance as a standby.

Question 13

A SysOps administrator maintains the security and compliance of a company's AWS account. To ensure the company's Amazon EC2 instances are following company policy, a SysOps administrator wants to terminate any EC2 instance that do not contain a department tag. Noncompliant resources must be terminated in near real time.Which solution will meet these requirements?

Accepted Answer

Create an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS-TerminateEC2lnstance automation runbook to terminate noncompliant resources.

Answer

Create a new Amazon EventBridge rule to monitor when new EC2 instances are created. Send the event to an Simple Notification Service (Amazon SNS) topic for automatic remediation.

Answer

Ensure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance's shutdown behavior to terminate.

Answer

Ensure AWS Systems Manager Compliance is configured to manage the EC2 instances. Call the AWS-StopEC2lnstances automation runbook to stop noncompliant resources.

Question 14

A company has deployed an application on AWS. The application runs on a fleet of Linux Amazon EC2 instances that are in an Auto Scaling group. The Auto Scaling group is configured to use launch templates. The launch templates launch Amazon Elastic Block Store (Amazon EBS) backed EC2 instances that use General Purpose SSD (gp3) EBS volumes for primary storage.A SysOps administrator needs to implement a solution to ensure that all the EC2 instances can share the same underlying files. The solution also must ensure that the data is consistent.Which solution will meet these requirements?

Accepted Answer

Create an Amazon Elastic File System (Amazon EFS) file system. Create a new launch template version that includes user data that mounts the EFS file system. Update the Auto Scaling group to use the new launch template version to cycle in newer EC2 instances and to terminate the older EC2 instances.

Answer

Enable Multi-Attach on the EBS volumes. Create a new launch template version that includes user data that mounts the EBS volume. Update the Auto Scaling group to use the new template version to cycle in newer EC2 instances and to terminate the older EC2 instances.

Answer

Create a cron job that synchronizes the data between the EBS volumes for all the EC2 instances in the Auto Scaling group. Create a lifecycle hook during instance launch to configure the cron job on all the EC2 instances. Rotate out the older EC2 instances.

Answer

Create a new launch template version that creates an Amazon Elastic File System (Amazon EFS) file system. Update the Auto Scaling group to use the new template version to cycle in newer EC2 instances and to terminate the older EC2 instances.

Question 15

A SysOps administrator is re-architecting an application. The SysOps administrator has moved the database from a public subnet, where the database used a public endpoint. into a private subnet to restrict access from the public network. After this change, an AWS Lambda function that requires read access to the database cannot connect to the database. The SysOps administrator must resolve this issue without compromising security.Which solution meets these requirements?

Accepted Answer

Connect the Lambda function to the database VPC. Connect to the database using its private endpoint.

Answer

Create an AWS PrivateLink interface endpoint for the Lambda function. Connect to the database using its private endpoint.

Answer

Attach an 1AM role to the Lambda function with read permissions to the database.

Answer

Move the database to a public subnet. Use security groups for secure access.

Question 16

A company is running Amazon RDS for PostgreSOL Multi-AZ DB clusters. The company uses an AWS Cloud Formation template to create the databases individually with a default size of 100 GB. The company creates the databases every Monday and deletes the databases every Friday.Occasionally, the databases run low on disk space and initiate an Amazon CloudWatch alarm. A SysOps administrator must prevent the databases from running low on disk space in the future.Which solution will meet these requirements with the FEWEST changes to the application?

Accepted Answer

Modify the Cloud Formation template to activate storage auto scaling on the existing DB instances.

Answer

Modify the CloudFormation template to use Amazon Aurora PostgreSOL as the DB engine.

Answer

Modify the CloudFormation template to use Amazon DynamoDB as the database. Activate storage auto scaling during creation of the tables

Answer

Create a CloudWatch alarm to monitor DB instance storage space. Configure the alarm to invoke the VACUUM command.

Question 17

A SysOps administrator manages a company's Amazon S3 buckets. The SysOps administrator has identified 5 GB of incomplete multipart uploads in an S3 bucket in the company's AWS account. The SysOps administrator needs to reduce the number of incomplete multipart upload objects in the S3 bucket.Which solution will meet this requirement?

Accepted Answer

Create an S3 Lifecycle rule on the S3 bucket to delete expired markers or incomplete multipart uploads

Answer

Require users that perform uploads of files into Amazon S3 to use the S3 TransferUtility.

Answer

Enable S3 Versioning on the S3 bucket that contains the incomplete multipart uploads.

Answer

Create an S3 Object Lambda Access Point to delete incomplete multipart uploads.

Question 18

A team of developers is using several Amazon S3 buckets as centralized repositories. Users across the world upload large sets of files to these repositories. The development team's applications later process these files.A SysOps administrator sets up a new S3 bucket. DOC-EXAMPLE-BUCKET, to support a new workload. The new S3 bucket also receives regular uploads of large sets of files from users worldwide. When the new S3 bucket is put into production, the upload performance from certain geographic areas is lower than the upload performance that the existing S3 buckets provide.What should the SysOps administrator do to remediate this issue?

Accepted Answer

Enable S3 Transfer Acceleration for the new S3 bucket. Verify that the developers are using the DOC-EXAMPLE-BUCKET.s3-accelerate.amazonaws.com endpoint name in their API calls.

Answer

Provision an Amazon ElasliCache for Redis cluster for the new S3 bucket. Provide the developers with the configuration endpoint of the cluster for use in their API calls.

Answer

Add the new S3 bucket to a new Amazon CloudFront distribution. Provide the developers with the domain name of the new distribution for use in their API calls.

Answer

Use S3 multipart upload for the new S3 bucket. Verify that the developers are using Region-specific S3 endpoint names such as D0C-EXAMPLE-BUCKET.s3. [RegionJ.amazonaws.com in their API calls.

Question 19

A company is planning to host an application on a set of Amazon EC2 instances that are distributed across multiple Availability Zones. The application must be able to scale to millions of requests each second.A SysOps administrator must design a solution to distribute the traffic to the EC2 instances. The solution must be optimized to handle sudden and volatile traffic patterns while using a single static IP address for each Availability Zone.Which solution will meet these requirements?

Accepted Answer

Network Load Balancer

Answer

Amazon Simple Queue Service (Amazon SQS) queue

Answer

Application Load Balancer

Answer

AWS Global Accelerator

Question 20

A company has an AWS Site-to-Site VPN connection between on-premises resources and resources that are hosted in a VPC. A SysOps administrator launches an Amazon EC2 instance that has only a private IP address into a private subnet in the VPC. The EC2 instance runs Microsoft Windows Server.A security group for the EC2 instance has rules that allow inbound traffic from the on-premises network over the VPN connection. The on-premises environment contains a third-party network firewall. Rules in the third-party network firewall allow Remote Desktop Protocol (RDP) traffic to flow between the on-premises users over the VPN connection.The on-premises users are unable to connect to the EC2 instance and receive a timeout error.What should the SysOps administrator do to troubleshoot this issue?

Accepted Answer

Create VPC flow logs for the EC2 instance's elastic network interface to check for rejected traffic.

Answer

Create Amazon CloudWatch logs for the EC2 instance to check for blocked traffic.

Answer

Create Amazon CloudWatch logs for the Site-to-Site VPN connection to check for blocked traffic.

Answer

Instruct users to use EC2 Instance Connect as a connection method.

Question 21

A company has an AWS Site-to-Site VPN connection between on-premises resources and resources that are hosted in a VPC. A SysOps administrator launches an Amazon EC2 instance that has only a private IP address into a private subnet in the VPC. The EC2 instance runs Microsoft Windows Server.A security group for the EC2 instance has rules that allow inbound traffic from the on-premises network over the VPN connection. The on-premises environment contains a third-party network firewall. Rules in the third-party network firewall allow Remote Desktop Protocol (RDP) traffic to flow between the on-premises users over the VPN connection.The on-premises users are unable to connect to the EC2 instance and receive a timeout error.What should the SysOps administrator do to troubleshoot this issue?

Accepted Answer

Create VPC flow logs for the EC2 instance's elastic network interface to check for rejected traffic.

Answer

Create Amazon CloudWatch logs for the EC2 instance to check for blocked traffic.

Answer

Create Amazon CloudWatch logs for the Site-to-Site VPN connection to check for blocked traffic.

Answer

Instruct users to use EC2 Instance Connect as a connection method.

Question 22

A SysOps administrator has set up a new Amazon EC2 instance as a web server in a public subnet. The instance uses HTTP port 80 and HTTPS port 443.The SysOps administrator has confirmed internet connectivity by downloading operating system updates and software from public repositories. However, the SysOps administrator cannot access the instance from a web browser on the internet.Which combination of steps should the SysOps administrator take to troubleshoot this issue? (Select THREE.)

Accepted Answer

Ensure that the inbound rules of the instance's security group allow traffic on ports 80 and 443.

Accepted Answer

Ensure that ephemeral ports 1024-65535 are allowed in the outbound rules of the network ACL that is associated with the instance's subnet.

Accepted Answer

Ensure that the filtering rules for any firewalls that are running on the instance allow inbound traffic on ports 80 and 443.

Answer

Ensure that the outbound rules of the instance's security group allow traffic on ports 80 and 443.

Answer

Ensure that ephemeral ports 1024-65535 are allowed in the inbound rules of the network ACL that is associated with the instance's subnet.

Answer

Ensure that AWS WAF is turned on for the instance and is blocking web traffic.

Question 23

An application is deployed in a VPC in both the us-east-2 and eu-west-1 Regions. A significant amount of data needs to be transferred between the two Regions. What is the MOST cost-effective way to set up the data transfer?

Accepted Answer

Establish an inter-Region VPC peering connection between the VPCs.

Answer

Establish a VPN connection between the Regions using third-party VPN products from AWS Marketplace.

Answer

Establish Amazon CloudFront distributions tor the Amazon EC2 instances from both Regions.

Answer

Establish an AWS PrivateLinK connection between the two Regions.

Question 24

A company uses AWS Organizations to host several applications across multiple AWS accounts. Several teams are responsible for building and maintaining the infrastructure of the applications across the AWS accounts.A SysOps administrator must implement a solution to ensure that user accounts and permissions are centrally managed. The solution must be integrated with the company's existing on-premises Active Directory environment. The SysOps administrator already has enabled AWS 1AM Identity Center (AWS Single Sign-On) and has set up an AWS Direct Connect connection.What is the MOST operationally efficient solution that meets these requirements?

Accepted Answer

Create an AD Connector that is associated with the on-premises Active Directory domain. Set the AD Connector as the identity source for 1AM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.

Answer

Create a Simple AD domain, and establish a forest trust relationship with the on-premises Active Directory domain. Set the Simple AD domain as the identity source for 1AM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.

Answer

Create an Active Directory domain controller on an Amazon EC2 instance that is joined to the on-premises Active Directory domain. Set the Active Directory domain controller as the identity source for 1AM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.

Answer

Use the built-in SSO directory as the identity source for 1AM Identity Center. Copy the users and groups from the on-premises Active Directory domain. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.

Question 25

A company wants to apply an existing Amazon Route 53 private hosted zone to a new VPC to allow for customized resource name resolution within the VPC. The Syspps administrator created the VPC and added the appropriate resource record sets to the private hosted zone.Which step should the SysOps administrator take to complete the setup?

Accepted Answer

Associate the Route 53 private hosted zone with the VPC.

Answer

Create a rule in the default security group for the VPC that allows traffic to the Route 53 Resolver.

Answer

Ensure the VPC network ACLs allow traffic to the Route 53 Resolver.

Answer

Ensure there is a route to the Route 53 Resolver in each of the VPC route tables.

Question 26

A company runs its web application on multiple Amazon EC2 instances that are part of an Auto Scaling group. The company wants the Auto Scaling group to scale out as soon as CPU utilization rises above 50% for the instances.How should a SysOps administrator configure the Auto Scaling group to meet these requirements?

Accepted Answer

Configure the Auto Scaling group to scale dynamically based on demand.

Answer

Configure the Auto Scaling group to scale based on events.

Answer

Configure the Auto Scaling group to scale based on a schedule.

Answer

Configure the Auto Scaling group to use predictive scaling.

Question 27

A SysOps administrator needs to design a disaster recovery (DR) plan for an application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The application uses an Amazon Aurora PostgreSQL database. The recovery time objective (RTO) and recovery point objective (RPO) are 15 minutes each.Which combination of steps should the SysOps administrator take to meet these requirements MOST cost-effectively? (Select TWO.)

Accepted Answer

Configure the Aurora cluster to replicate data to the DR Region by using the Aurora global database option.

Accepted Answer

Configure the DR Region with an ALB and an Auto Scaling group. Use the same configuration as in the primary Region.

Answer

Configure Aurora backups to be exported to the DR Region.

Answer

Configure the DR Region with an ALB and an Auto Scaling group. Set the Auto Scaling group's minimum capacity, maximum capacity, and desired capacity to 1.

Answer

Manually launch a new ALB and a new Auto Scaling group by using AWS CloudFormation during a failover activity.

Question 28

A company migrates a write-once, read-many (WORM) drive to an Amazon S3 bucket that has S3 Object Lock configured in governance mode. During the migration, the company copies unneeded data to the S3 bucket.A SysOps administrator attempts to delete the unneeded data from the S3 bucket by using the AWS CLI. However, the SysOps administrator receives an error.Which combination of steps should the SysOps administrator take to successfully delete the unneeded data? (Select TWO.)

Accepted Answer

Assume a role that has the s3:BypassGovernanceRetention permission.

Accepted Answer

Include the x-amz-bypass-governance-retention:true header in the request when issuing the delete command.

Answer

Increase the Retain Until Date.

Answer

Assume a role that has the s3:BypassLegalRetention permission.

Answer

Include the x-amz-bypass-legal-retention:true header in the request when issuing the delete command.

Question 29

A company is deploying an ecommerce application to an AWS Region that is located in France. The company wants users from only France to be able to access the first version of the application. The company plans to add more countries for the next version of the application. A SysOps administrator needs to configure the routing policy in Amazon Route 53.Which solution will meet these requirements?

Accepted Answer

Use a geolocation routing policy. Select France as the location in the record.

Answer

Use a geoproximity routing policy. Select France as the location in the record.

Answer

Use an IP-based routing policy. Select all IP addresses that are allocated to France in the record.

Answer

Use a geoproximity routing policy. Select all IP addresses that are allocated to France in the record.

Question 30

A company has an on-premises DNS solution and wants to resolve DNS records in an Amazon Route 53 private hosted zone for example.com. The company has set up an AWS Direct Connect connection for network connectivity between the on-premises network and the VPC. A SysOps administrator must ensure that an on-premises server can query records in the example.com domain.What should the SysOps administrator do to meet these requirements?

Accepted Answer

Create a Route 53 Resolver inbound endpoint Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.

Answer

Create a Route 53 Resolver inbound endpoint. Attach a security group to the endpoint to allow outbound traffic on TCP/UDP port 53 to the on-premises DNS servers.

Answer

Create a Route 53 Resolver outbound endpoint. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.

Answer

Create a Route 53 Resolver outbound endpoint. Attach a security group to the endpoint to allow outbound traffic on TCP/UDP port 53 to the on-premises DNS servers.

Question 31

A company has an AWS Lambda function in Account

Accepted Answer

The Lambda function needs to read the objects in an Amazon S3 bucket in Account B. A SysOps administrator must create corresponding 1AM roles in both accounts. Which solution will meet these requirements?

Answer

In Account A, create a Lambda execution role to assume the role in Account B. In Account B. create a role that the function can assume to gain access to the S3 bucket.

Answer

In Account A, create a Lambda execution role that provides access to the S3 bucket. In Account B. create a role that the function can assume.

Answer

In Account A. create a role that the function can assume. In Account B, create a Lambda execution role that provides access to the S3 bucket.

Answer

In Account A. create a role that the function can assume to gain access to the S3 bucket. In Account B. create a Lambda execution role to assume the role in Account A.

Question 32

A company's SysOps administrator maintains a highly available environment. The environment includes Amazon EC2 instances and an Amazon RDS Multi-AZ database. The EC2 instances are in an Auto Scaling group behind an Application Load Balancer.Recently, the company conducted a failover test. The SysOps administrator needs to decrease the failover time of the RDS database by at least 10%.Which solution will meet this requirement?

Accepted Answer

Increase the RDS instance size.

Answer

Modify the RDS cluster to run in a single Availability Zone.

Answer

Create a read replica in another AWS Region. Promote the read replica in case of failure.

Answer

Create an RDS proxy. Point the application to the proxy endpoint.

Question 33

A company has an application that collects notifications from thousands of alarm systems. The notifications include alarm notifications and information notifications. The information notifications include the system arming processes, disarming processes, and sensor status.All notifications are kept as messages in an Amazon Simple Queue Service (Amazon SQS) queue. Amazon EC2 instances that are in an Auto Scaling group process the messages. A SysOps administrator needs to implement a solution that prioritizes alarm notifications over information notifications.Which solution will meet these requirements?

Accepted Answer

Create a queue for alarm notifications and a queue for information notifications. Update the application to collect messages from the alarm notifications queue first.

Answer

Adjust the Auto Scaling group to scale faster when a high number of messages is in the queue.

Answer

Use the Amazon Simple Notification Service (Amazon SNS) fanout feature with Amazon SQS to send the notifications in parallel to all the EC2 instances.

Answer

Add an Amazon DynamoDB stream to accelerate the message processing.

Question 34

A company uses AWS CloudFormation to manage a stack of Amazon EC2 instances on AWS. A SysOps administrator needs to keep the instances and all of the instances' data, even if someone deletes the stack.Which solution will meet these requirements?

Accepted Answer

Set the DeletionPolicy attribute to Retain for the EC2 instance resource in the CloudFormation template.

Answer

Set the DeletionPolicy attribute to Snapshot for the EC2 instance resource in the CloudFormation template.

Answer

Automate backups by using Amazon Data Lifecycle Manager (Amazon DLM).

Answer

Create a backup plan in AWS Backup.

Question 35

A company has an application that runs behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon Route 53 record set contains an alias record for app.anycompany.com that references the ALB in us-west-2 and uses a simple routing policy. The application is experiencing an increase in users from other locations in the world. These users are experiencing high latency.Most of the new users are close to the ap-southeast-2 Region. The company deploys a copy of the application to ap-southeast-2. A SysOps administrator must implement a solution that automatically routes requests to the lowest latency endpoint for users without changing the URL.Which solution will meet these requirements?

Accepted Answer

Change the existing alias record to use a latency routing policy. Create two latency records, one record that references each ALB.

Answer

Add a new value to the existing alias record for app.anycompany.com with the DNS name of the new ALB in ap-southeast-2.

Answer

Change the existing alias record to use a geolocation routing policy. Create two geolocation records, one record that references each ALSelect the location that is closest to each Region.

Answer

Change the existing alias record to use a multivalue routing policy Add the DNS name of each ALB to the record.

Question 36

A company has applications that process transaction requests multiple times each minute. The applications write transaction data to a single Amazon RDS DB instance. As the company begins to process more transactions, the company becomes concerned that it has no failover solution in place for disaster recovery (DR). The company needs the DB instance to fail over automatically without losing any committed transactions.Which solution will meet these requirements?

Accepted Answer

Modify the DB instance to be a Multi-AZ deployment.

Answer

Create an RDS read replica in the same AWS Region. Configure an AWS Lambda function to promote the replica as the primary DB instance during a DR scenario.

Answer

Create an RDS read replica in a different AWS Region. Configure an AWS Lambda function to promote the replica as the primary DB instance during a DR scenario.

Answer

Setup an Amazon CloudWatch alarm that monitors the DB instance memory utilization with a threshold greater than 90%. Invoke an AWS Lambda function to restart the DB instance.

Question 37

A company is using AWS Certificate Manager (ACM) to manage public SSL/TLS certificates. A SysOps administrator needs to send an email notification when a certificate has less than 14 days until expiration.Which solution will meet this requirement with the LEAST operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry melric for all ACM certificates. Configure the rule to send an event to a target Amazon Simple Notification Service (Amazon SNS) topic if DaysToExpiry is less than 14. Subscribe the appropriate email addresses to the SNS topic.

Answer

Create an Amazon CloudWatch custom metric to monitor certificate expiration for all ACM certificates. Create an Amazon EventBridge rule that has an event source of a ws. cloud watch Configure the rule to send an event to a target Amazon Simple Notification Service (Amazon SNS) topic if the DaysToExpiry metric is less than 14. Subscribe the appropriate email addresses to the SNS topic.

Answer

Create an Amazon CloudWatch dashboard that displays the DaysToExpiry metric for all ACM certificates. If DaysToExpiry is less than 14, send an email message to the appropriate email addresses. Send the email message by running a predefined CLI command to publish to an Amazon Simple Notification Service (Amazon SNS) topic.

Answer

Create an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry metric for all ACM certificates. Configure a target SMS identity that uses a predefined email template. Configure the rule to send an event to the target SMS identity if DaysToExpiry is less than 14.

Question 38

A company wants to store sensitive financial data within Amazon S3 buckets. The company has a corporate policy that does not allow public read or write access to the buckets. A SysOps administrator must create a solution to automatically remove S3 permissions that allow public read or write access.Which AWS service should the SysOps administrator use to meet these requirements in the MOST operationally efficient manner?

Accepted Answer

AWSConfig

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 39

A company is running a development application on an Amazon EC2 instance. The application uploads 500.000 files that are 1 GB in size into a large! Amazon S3 bucket that has default encryption enabled The EC2 instance is in the same AWS Region where the S3 bucket is deployed.The company uses performance logging that is built into the application software. The logs show that the application is constantly waiting for the files to be written to the S3 bucket. A SysOps administrator needs to improve the application's throughput performance. The SysOps administrator validates that the networking on the EC2 instance is not constrained.What should the SysOps administrator do to improve the S3 upload performance''

Accepted Answer

Split the S3 write operations to use multiple bucket prefixes to write items in parallel.

Answer

Enable S3 Transfer Acceleration on the S3 bucket.

Answer

Configure AWS PrivateLink for Amazon S3 Turn off encryption on the S3 bucket

Answer

Configure AWS Global Accelerator in the Region. Turn off encryption on the S3 bucket.

Question 40

A company that uses AWS Organizations recently implemented AWS Control Tower The company now needs to centralize identity management A SysOps administrator must federate AWS 1AM Identity Center with an external SAML 2.0 identity provider (IdP) to centrally manage access to all the company's accounts and cloud applicationsWhich prerequisites must the SysOps administrator have so that the SysOps administrator can connect to the external IdP? (Select TWO.)

Accepted Answer

A copy of the 1AM Identity Center SAML metadata

Accepted Answer

The IdP metadata, including the public X.509 certificate

Answer

The IP address of the IdP

Answer

Root access to the management account

Answer

Administrative permissions to the member accounts of the organization

Amazon SOA-C02 Practice Test 9

Amazon SOA-C02 Practice Tests

Amazon SOA-C02 Practice Test 9

Question

Amazon SOA-C02 Practice Tests

Practice Tests