AWS SOA-C02 Practice Test – Member Shared Questions, Page 4

Question 31

An organization created an Amazon Elastic File System (Amazon EFS) volume with a file system ID of fs-85ba41fc, and it is actively used by 10 Amazon EC2 hosts. The organization has become concerned that the file system is not encrypted.

How can this be resolved?

A.

Enable encryption on each host's connection to the Amazon EFS volume. Each connection must be recreated for encryption to take effect.

B.

Enable encryption on the existing EFS volume by using the AWS Command Line Interface.

C.

Enable encryption on each host's local drive. Restart each host to encrypt the drive.

D.

Enable encryption on a newly created volume and copy all data from the original volume. Reconnect each host to the new volume.

Show Answer Comment (0)

Question 32

A SysOps administrator is attempting to download patches from the internet into an instance in a private subnet. An internet gateway exists for the VPC, and a NAT gateway has been deployed on the public subnet; however, the instance has no internet connectivity. The resources deployed into the private subnet must be inaccessible directly from the public internet.

Amazon SOA-C02 image Question 32 8067 09162024010005000000

What should be added to the private subnet's route table in order to address this issue, given the information provided?

A.

0.0.0.0/0 IGW

B.

0.0.0.0/0 NAT

C.

10.0.1.0/24 IGW

D.

10.0.1.0/24 NAT

Show Answer Comment (0)

Question 33

An organization finds that a high number of gp2 Amazon EBS volumes are running out of space.

Which solution will provide the LEAST disruption with MINIMAL effort?

A.

Create a snapshot and restore it to a larger gp2 volume.

B.

Create a RAID 0 with another new gp2 volume to increase capacity.

C.

Leverage the Elastic Volumes feature of EBS to increase gp2 volume size.

D.

Write a script to migrate data to a larger gp2 volume.

Show Answer Comment (0)

Question 34

A company hosts a website on multiple Amazon EC2 instances that run in an Auto Scaling group. Users are reporting slow responses during peak times between 6 PM and 11 PM every weekend. A SysOps administrator must implement a solution to improve performance during these peak times.

What is the MOST operationally efficient solution that meets these requirements?

A.

Create a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to increase the desired capacity before peak times.

B.

Configure a scheduled scaling action with a recurrence option to change the desired capacity before and after peak times.

C.

Create a target tracking scaling policy to add more instances when memory utilization is above 70%.

D.

Configure the cooldown period for the Auto Scaling group to modify desired capacity before and after peak times.

Show Answer Comment (0)

Question 35

A company's SysOps administrator has created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instance are encrypted with AWS managed keys.

The SysOps administrator creates an Amazon Machine Image (AMI) of the custom EC2 instance and plans to share the AMI with the company's other AWS accounts. The company requires that all AMIs are encrypted with AWS Key Management Service (AWS KMS) keys and that only authorized AWS accounts can access the shared AMIs.

Which solution will securely share the AMI with the other AWS accounts?

A.

In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.

B.

In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the CMK. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with.

C.

In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the CMK. Modify the permissions on the copied AMI to make it public.

D.

In the account where the AMI was created, modify the key policy of the AWS managed key to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with.Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.

Show Answer Comment (0)

Question 36

A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network. What actions should the SysOps administrator take to meet these requirements?

A.

Create a VPC endpoint for the S3 bucket, and create an IAM policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.

B.

Create a VPC endpoint for the S3 bucket, and create an S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.

C.

Create a service-linked role for Amazon EC2 that allows the EC2 instances to interact directly with Amazon S3, and attach an IAM policy to the role that allows the EC2 instances full access to the S3 bucket.

D.

Create a NAT gateway in the VPC, and modify the VPC route table to route all traffic destined for Amazon S3 through the NAT gateway.

Show Answer Comment (0)

Question 37

A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct IAM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket. Which action will solve this problem while adhering to least privilege access?

A.

Add a bucket policy to the S3 bucket permitting access from the IAM role.

B.

Attach an S3 gateway endpoint to the VPC. Configure the route table for the private subnet.

C.

Configure the route table to allow the instances on the private subnet access through the internet gateway.

D.

Create a NAT Gateway in a private subnet and configure the route table for the private subnets.

Show Answer Comment (0)

Question 38

A SysOps administrator noticed that a large number of Elastic IP addresses are being created on the company's AWS account, but they are not being associated with Amazon EC2 instance, and are incurring Elastic IP address charges in the monthly bill.

How can the administrator identify who is creating the Elastic IP addresses?

A.

Attach a cost-allocation tag to each requested Elastic IP address with the IAM user name of the developer who creates it.

B.

Query AWS CloudTrail logs by using Amazon Athena to search for Elastic IP address events.

C.

Create a CloudWatch alarm on the EIPCreated metric and send an Amazon SNS notification when the alarm triggers.

D.

Use Amazon Inspector to get a report of all Elastic IP addresses created in the last 30 days.

Show Answer Comment (0)

Question 39

A SysOps administrator is deploying an application on 10 Amazon EC2 instances. The application must be highly available. The instances must be placed on distinct underlying hardware.

What should the SysOps administrator do to meet these requirements?

A.

Launch the instances into a cluster placement group in a single AWS Region.

B.

Launch the instances into a partition placement group in multiple AWS Regions.

C.

Launch the instances into a spread placement group in multiple AWS Regions.

D.

Launch the instances into a spread placement group in a single AWS Region.

Show Answer Comment (0)

Question 40

A SysOps administrator is investigating issues on an Amazon RDS for MariaDB DB instance. The SysOps administrator wants to display the database load categorized by detailed wait events. How can the SysOps administrator accomplish this goal?

A.

Create an Amazon CloudWatch dashboard.