SOA-C02 : AWS Certified SysOps Administrator – Associate : Part 01

SOA-C02 : AWS Certified SysOps Administrator – Associate : Part 01

SOA-C02 : AWS Certified SysOps Administrator – Associate : Part 01

  1. A SysOps administrator is creating two AWS CloudFormation templates. The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway. The second template will deploy application resources within the VPC that was created by the first template. The second template should refer to the resources created by the first template.

    How can this be accomplished with the LEAST amount of administrative effort?

    • Add an export field to the outputs of the first template and import the values in the second template.
    • Create a custom resource that queries the stack created by the first template and retrieves the required values.
    • Create a mapping in the first template that is referenced by the second template.
    • Input the names of resources in the first template and refer to those names in the second template as a parameter.

  2. A company has deployed a web application in a VPC that has subnets in three Availability Zones. The company launches three Amazon EC2 instances from an EC2 Auto Scaling group behind an Application Load Balancer (ALB).

    A SysOps administrator notices that two of the EC2 instances are in the same Availability Zone, rather than being distributed evenly across all three Availability Zones. There are no errors in the Auto Scaling group’s activity history.

    What is the MOST likely reason for the unexpected placement of EC2 instances?

    • One Availability Zone did not have sufficient capacity for the requested EC2 instance type.
    • The ALB was configured for only two Availability Zones.
    • The Auto Scaling group was configured for only two Availability Zones.
    • Amazon EC2 Auto Scaling randomly placed the instances in Availability Zones.

  3. A company is running an application on premises and wants to use AWS for data backup. All of the data must be available locally. The backup application can write only to block-based storage that is compatible with the Portable Operating System Interface (POSIX).

    Which backup solution will meet these requirements?

    • Configure the backup software to use Amazon S3 as the target for the data backups.
    • Configure the backup software to use Amazon S3 Glacier as the target for the data backups.
    • Use AWS Storage Gateway, and configure it to use gateway-cached volumes.
    • Use AWS Storage Gateway, and configure it to use gateway-stored volumes.

  4. A company asks a SysOps administrator to ensure that AWS CloudTrail files are not tampered with after they are created. Currently, the company uses AWS Identity and Access Management (IAM) to restrict access to specific trails. The company’s security team needs the ability to trace the integrity of each file.

    What is the MOST operationally efficient solution that meets these requirements?

    • Create an Amazon EventBridge (Amazon CloudWatch Events) rule that invokes an AWS Lambda function when a new file is delivered. Configure the Lambda function to compute an MD5 hash check on the file and store the result in an Amazon DynamoDB table. The security team can use the values that are stored in DynamoDB to verify the integrity of the delivered files.
    • Create an AWS Lambda function that is invoked each time a new file is delivered to the CloudTrail bucket. Configure the Lambda function to compute an MD5 hash check on the file and store the result as a tag in an Amazon 53 object. The security team can use the information in the tag to verify the integrity of the delivered files.
    • Enable the CloudTrail file integrity feature on an Amazon S3 bucket. Create an IAM policy that grants the security team access to the file integrity logs that are stored in the S3 bucket.
    • Enable the CloudTrail file integrity feature on the trail. The security team can use the digest file that is created by CloudTrail to verify the integrity of the delivered files.

  5. A company has an Amazon RDS DB instance. The company wants to implement a caching service while maintaining high availability.

    Which combination of actions will meet these requirements? (Choose two.)

    • Add Auto Discovery to the data store.
    • Create an Amazon ElastiCache for Memcached data store.
    • Create an Amazon ElastiCache for Redis data store.
    • Enable Multi-AZ for the data store.
    • Enable Multi-threading for the data store.

  6. An existing, deployed solution uses Amazon EC2 instances with Amazon EBS General Purpose SSD volumes, an Amazon RDS PostgreSQL database, an Amazon EFS file system, and static objects stored in an Amazon S3 bucket. The Security team now mandates that at-rest encryption be turned on immediately for all aspects of the application, without creating new resources and without any downtime.

    To satisfy the requirements, which one of these services can the SysOps administrator enable at-rest encryption on?

    • EBS General Purpose SSD volumes
    • RDS PostgreSQL database
    • Amazon EFS file systems
    • S3 objects within a bucket

  7. A manufacturing company uses an Amazon RDS DB instance to store inventory of all stock items. The company maintains several AWS Lambda functions that interact with the database to add, update, and delete items. The Lambda functions use hardcoded credentials to connect to the database.

    A SysOps administrator must ensure that the database credentials are never stored in plaintext and that the password is rotated every 30 days.

    Which solution will meet these requirements in the MOST operationally efficient manner?

    • Store the database password as an environment variable for each Lambda function. Create a new Lambda function that is named PasswordRotate. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and update the environment variable for each Lambda function.
    • Use AWS Key Management Service (AWS KMS) to encrypt the database password and to store the encrypted password as an environment variable for each Lambda function. Grant each Lambda function access to the KMS key so that the database password can be decrypted when required. Create a new Lambda function that is named PasswordRotate to change the password every 30 days.
    • Use AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from Secrets Manager.
    • Use AWS Systems Manager Parameter Store to create a secure string to store credentials for the database. Create a new Lambda function called PasswordRotate. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and to update the secret within Parameter Store. Update each Lambda function to access the database password from Parameter Store.

  8. A company hosts its website in the us-east-1 Region. The company is preparing to deploy its website into the eu-central-1 Region. Website visitors who are located in Europe should access the website that is hosted in eu-central-1. All other visitors access the website that is hosted in us-east-1. The company uses Amazon Route 53 to manage the website’s DNS records.

    Which routing policy should a SysOps administrator apply to the Route 53 record set to meet these requirements?

    • Geolocation routing policy
    • Geoproximity routing policy
    • Latency routing policy
    • Multivalue answer routing policy

  9. A company is running a website on Amazon EC2 instances that are in an Auto Scaling group. When the website traffic increases, additional instances take several minutes to become available because of a long-running user data script that installs software. A SysOps administrator must decrease the time that is required for new instances to become available.

    Which action should the SysOps administrator take to meet this requirement?

    • Reduce the scaling thresholds so that instances are added before traffic increases.
    • Purchase Reserved Instances to cover 100% of the maximum capacity of the Auto Scaling group.
    • Update the Auto Scaling group to launch instances that have a storage optimized instance type.
    • Use EC2 Image Builder to prepare an Amazon Machine Image (AMI) that has pre-installed software.

  10. A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network.

    What actions should the SysOps administrator take to meet these requirements?

    • Create a VPC endpoint for the S3 bucket, and create an IAM policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
    • Create a VPC endpoint for the S3 bucket, and create an S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
    • Create a service-linked role for Amazon EC2 that allows the EC2 instances to interact directly with Amazon S3, and attach an IAM policy to the role that allows the EC2 instances full access to the S3 bucket.
    • Create a NAT gateway in the VPC, and modify the VPC route table to route all traffic destined for Amazon S3 through the NAT gateway.

  11. A SysOps administrator notices a scale-up event for an Amazon EC2 Auto Scaling group. Amazon CloudWatch shows a spike in the RequestCount metric for the associated Application Load Balancer. The administrator would like to know the IP addresses for the source of the requests.

    Where can the administrator find this information?

    • Auto Scaling logs
    • AWS CloudTrail logs
    • EC2 instance logs
    • Elastic Load Balancer access logs

  12. A company is using an Amazon Aurora MySQL DB cluster that has point-in-time recovery, backtracking, and automatic backup enabled. A SysOps administrator needs to be able to roll back the DB cluster to a specific recovery point within the previous 72 hours. Restores must be completed in the same production DB cluster.

    Which solution will meet these requirements?

    • Create an Aurora Replica. Promote the replica to replace the primary DB instance.
    • Create an AWS Lambda function to restore an automatic backup to the existing DB cluster.
    • Use backtracking to rewind the existing DB cluster to the desired recovery point.
    • Use point-in-time recovery to restore the existing DB cluster to the desired recovery point.

  13. A company is running a flash sale on its website. The website is hosted on burstable performance Amazon EC2 instances in an Auto Scaling group. The Auto Scaling group is configured to launch instances when the CPU utilization is above 70%.

    A couple of hours into the sale, users report slow load times and error messages for refused connections. A SysOps administrator reviews Amazon CloudWatch metrics and notices that the CPU utilization is at 20% across the entire fleet of instances.

    The SysOps administrator must restore the website’s functionality without making changes to the network infrastructure.

    Which solution will meet these requirements?

    • Activate unlimited mode for the instances in the Auto Scaling group.
    • Implement an Amazon CloudFront distribution to offload the traffic from the Auto Scaling group.
    • Move the website to a different AWS Region that is closer to the users.
    • Reduce the desired size of the Auto Scaling group to artificially increase CPU average utilization.

  14. A company uses Amazon Elasticsearch Service (Amazon ES) to analyze sales and customer usage data. Members of the company’s geographically dispersed sales team are traveling. They need to log in to Kibana by using their existing corporate credentials that are stored in Active Directory. The company has deployed Active Directory Federation Services (AD FS) to enable authentication to cloud services.

    Which solution will meet these requirements?

    • Configure Active Directory as an authentication provider in Amazon ES. Add the Active Directory server’s domain name to Amazon ES. Configure Kibana to use Amazon ES authentication.
    • Deploy an Amazon Cognito user pool. Configure Active Directory as an external identity provider for the user pool. Enable Amazon Cognito authentication for Kibana on Amazon ES.
    • Enable Active Directory user authentication in Kibana. Create an IP-based custom domain access policy in Amazon ES that includes the Active Directory server’s IP address.
    • Establish a trust relationship with Kibana on the Active Directory server. Enable Active Directory user authentication in Kibana. Add the Active Directory server’s IP address to Kibana.

  15. An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A SysOps administrator must ensure that the application can read, write, and delete messages from the SQS queues.

    Which solution will meet these requirements in the MOST secure manner?

    • Create an IAM user with an IAM policy that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues. Embed the IAM user’s credentials in the application’s configuration.
    • Create an IAM user with an IAM policy that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues. Export the IAM user’s access key and secret access key as environment variables on the EC2 instance.
    • Create and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows sqs:* permissions to the appropriate queues.
    • Create and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues.

  16. A company has an infernal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone. A SysOps administrator must make the application highly available.

    Which action should the SysOps administrator take to meet this requirement?

    • Increase the maximum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
    • Increase the minimum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
    • Update the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.
    • Update the Auto Scaling group to launch new instances in an Availability Zone in a second AWS Region.

  17. A company has launched a social media website that gives users the ability to upload images directly to a centralized Amazon S3 bucket. The website is popular in areas that are geographically distant from the AWS Region where the S3 bucket is located. Users are reporting that uploads are slow. A SysOps administrator must improve the upload speed.

    What should the SysOps administrator do to meet these requirements?

    • Create S3 access points in Regions that are closer to the users.
    • Create an accelerator in AWS Global Accelerator for the S3 bucket.
    • Enable S3 Transfer Acceleration on the S3 bucket.
    • Enable cross-origin resource sharing (CORS) on the S3 bucket.

  18. A company hosts an online shopping portal in the AWS Cloud. The portal provides HTTPS security by using a TLS certificate on an Elastic Load Balancer (ELB). Recently, the portal suffered an outage because the TLS certificate expired. A SysOps administrator must create a solution to automatically renew certificates to avoid this issue in the future.

    What is the MOST operationally efficient solution that meets these requirements?

    • Request a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. Write a scheduled AWS Lambda function to renew the certificate every 18 months.
    • Request a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
    • Register a certificate with a third-party certificate authority (CA). Import this certificate into AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
    • Register a certificate with a third-party certificate authority (CA). Configure the ELB to import the certificate directly from the CA. Set the certificate refresh cycle on the ELB to refresh when the certificate is within 3 months of the expiration date.

  19. A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct IAM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket.

    Which action will solve this problem while adhering to least privilege access?

    • Add a bucket policy to the S3 bucket permitting access from the IAM role.
    • Attach an S3 gateway endpoint to the VPC. Configure the route table for the private subnet.
    • Configure the route table to allow the instances on the private subnet access through the internet gateway.
    • Create a NAT Gateway in a private subnet and configure the route table for the private subnets.

  20. A company hosts a website on multiple Amazon EC2 instances that run in an Auto Scaling group. Users are reporting slow responses during peak times between 6 PM and 11 PM every weekend. A SysOps administrator must implement a solution to improve performance during these peak times.

    What is the MOST operationally efficient solution that meets these requirements?

    • Create a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to increase the desired capacity before peak times.
    • Configure a scheduled scaling action with a recurrence option to change the desired capacity before and after peak times.
    • Create a target tracking scaling policy to add more instances when memory utilization is above 70%.
    • Configure the cooldown period for the Auto Scaling group to modify desired capacity before and after peak times.