Easily To Pass New Amazon SOA-C02 Dumps with 146 Questions
Latest SOA-C02 Study Guides 2022 - With Test Engine PDF
AWS SOA-C02 Exam Certification Details:
| Passing Score | 720 / 1000 |
| Sample Questions | AWS SOA-C02 Sample Questions |
| Schedule Exam | AWS Certification |
| Number of Questions | 65 |
| Exam Name | AWS SysOps Administrator Associate (AWS-SysOps) |
| Exam Price | $150 USD |
| Recommended Training / Books | Systems Operations on AWS |
| Duration | 180 minutes |
AWS-SysOps Exam Syllabus Topics:
| Section | Objectives | Weight |
|---|---|---|
| Cost and Performance Optimization | - Implement cost optimization strategies
- Implement performance optimization strategies
| 12% |
| Reliability and Business Continuity | - Implement scalability and elasticity
- Implement high availability and resilient environments
- Implement backup and restore strategies
| 16% |
| Deployment, Provisioning, and Automation | - Provision and maintain cloud resources
- Automate manual or repeatable processes
| 18% |
| Security and Compliance | - Implement and manage security and compliance policies
- Implement data and infrastructure protection strategies
| 16% |
NEW QUESTION 75
A company hosts a web application on an Amazon EC2 instance in a production VPC. Client connections to the application are failing. A SysOps administrator inspects the VPC flow logs and finds the following entry:
2 111122223333 eni-<###> 192.0.2.15 203.0.113.56 40711 443 6 1 40 1418530010 1418530070 REJECT OK What is a possible cause of these failed connections?
- A. A security group is denying traffic on port 443.
- B. The EC2 instance is shut down.
- C. The VPC has no internet gateway attached.
- D. The network ACL is blocking HTTPS traffic.
Answer: A
Explanation:
Reference:
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-accepted-rejected
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html# Accepted and rejected traffic: In this example, RDP traffic (destination port 3389, TCP protocol) to network interface eni-1235b8ca123456789 in account 123456789010 was rejected. 2 123456789010 eni-1235b8ca123456789 172.31.9.69 172.31.9.12 49761 3389 6 20 4249 1418530010 1418530070 REJECT OK
NEW QUESTION 76
A company stores files on 50 Amazon S3 buckets in the same AWS Region The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances The company needs a solution that produces no additional cost Which solution will meet these requirements?
- A. Create one interface VPC endpoint for all the S3 buckets Add the interface VPC endpoint to the VPC route table
- B. Create an interface VPC endpoint (or each S3 bucket Attach the interface VPC endpoints to each subnet inside the VPC
- C. Create a gateway VPC endpoint lor each S3 bucket Attach the gateway VPC endpoints to each subnet inside the VPC
- D. Create one gateway VPC endpoint for all the S3 buckets Add the gateway VPC endpoint to the VPC route table
Answer: D
NEW QUESTION 77
A company's SysOps administrator has created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instance are encrypted with AWS managed keys.
The SysOps administrator creates an Amazon Machine Image (AMI) of the custom EC2 instance and plans to share the AMI with the company's other AWS accounts. The company requires that all AMIs are encrypted with AWS Key Management Service (AWS KMS) keys and that only authorized AWS accounts can access the shared AMIs.
Which solution will securely share the AMI with the other AWS accounts?
- A. In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms ReEncrypf, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.
- B. In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescrlbeKey, kms:ReEncrypt\ kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI. and specify the CMK. Modify the permissions on the copied AMI to make it public.
- C. In the account where the AMI was created, modify the key policy of the AWS managed key to provide kms:DescnbeKey. kms:ReEncrypt\ kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.
- D. In the account where the AMI was created, create a customer master key (CMK). Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*. kms:CreateGrant, and kms;Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI. and specify the CMK. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with.
Answer: D
Explanation:
Reference:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html
NEW QUESTION 78
A SysOps administrator is using Amazon EC2 instances to host an application. The SysOps administrator needs to grant permissions for the application to access an Amazon DynamoDB table.
Which solution will meet this requirement?
- A. Create access keys to access the DynamoDB table. Assign the access keys to the EC2 instance profile.
- B. Create an IAM user to access the DynamoDB table. Assign the IAM user to the EC2 instance profile.
- C. Create an IAM role to access the DynamoDB table. Assign the IAM role to the EC2 instance profile.
- D. Create an EC2 key pair to access the DynamoDB table. Assign the key pair to the EC2 instance profile.
Answer: C
NEW QUESTION 79
An organization with a large IT department has decided to migrate to AWS With different job functions in the IT department it is not desirable to give all users access to all AWS resources Currently the organization handles access via LDAP group membership What is the BEST method to allow access using current LDAP credentials?
- A. Federate the LDAP directory with IAM using SAML Create different IAM roles to correspond to different LDAP groups to limit permissions
- B. Create a Lambda function to read LDAP groups and automate the creation of IAM users
- C. Use AWS CloudFormation to create IAM roles Deploy Direct Connect to allow access to the on-premises LDAP server
- D. Create an AWS Directory Service Simple AD Replicate the on-premises LDAP directory to Simple AD
Answer: A
NEW QUESTION 80
A company uses AWS Organizations to manage multiple AWS accounts with consolidated billing enabled.
Organization member account owners want the benefits of Reserved Instances (RIs) but do not want to share RIs with other accounts.
Which solution will meet these requirements?
- A. Purchase RIs in individual member accounts. Disable RI discount sharing in the management account.
- B. Purchase RIs in the management account. Disable RI discount sharing in the member accounts.
- C. Purchase RIs in individual member accounts. Disable RI discount sharing in the member accounts.
- D. Purchase RIs in the management account. Disable RI discount sharing in the management account.
Answer: C
NEW QUESTION 81
A team of On-call engineers frequently needs to connect to Amazon EC2 Instances In a private subnet to troubleshoot and run commands. The Instances use either the latest AWS-provided Windows Amazon Machine Images (AMIs) or Amazon Linux AMIs.
The team has an existing IAM role for authorization. A SysOps administrator must provide the team with access to the Instances by granting IAM permissions to this Which solution will meet this requirement?
- A. Associate an Elastic IP address and a security group with each instance. Add the engineers' IP addresses to the security group inbound rules. Add a statement to the IAM role policy to allow the ec2:AuthoflzeSecurityGroupIngress action so that the team can connect to the Instances.
- B. Add a statement to the IAM role policy to allow the ssm:StartSession action on the instances. Instruct the team to use AWS Systems Manager Session Manager to connect to the Instances by using the assumed IAM role.
- C. Create a bastion host with an EC2 Instance, and associate the bastion host with the VPC. Add a statement to the IAM role policy to allow the ec2:CreateVpnConnection action on the bastion host. Instruct the team to use the bastion host endpoint to connect to the instances.
Answer: B
Explanation:
D Create an internet-facing Network Load Balancer. Use two listeners. Forward port 22 to a target group of Linux instances. Forward port 3389 to a target group of Windows Instances. Add a statement to the IAM role policy to allow the ec2:CreateRoute action so that the team can connect to the Instances.
NEW QUESTION 82
A company uses AWS Organizations to manage multiple AWS accounts with consolidated billing enabled. Organization member account owners want the benefits of Reserved Instances (RIs) but do not want to share RIs with other accounts.
Which solution will meet these requirements?
- A. Purchase RIs in the management account. Disable Rl discount sharing in the management account.
- B. Purchase RIs in the management account. Disable Rl discount sharing in the member accounts.
- C. Purchase RIs in individual member accounts. Disable Rl discount sharing in the member accounts.
- D. Purchase RIs in individual member accounts. Disable Rl discount sharing in the management account.
Answer: B
NEW QUESTION 83
A company stores files on 50 Amazon S3 buckets in the same AWS Region. The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost.
Which solution will meet these requirements?
- A. Create a gateway VPC endpoint for each S3 bucket. Attach the gateway VPC endpoints to each subnet inside the VPC.
- B. Create one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table.
- C. Create one interface VPC endpoint for all the S3 buckets. Add the interface VPC endpoint to the VPC route table.
- D. Create an interface VPC endpoint for each S3 bucket. Attach the interface VPC endpoints to each subnet inside the VPC.
Answer: B
NEW QUESTION 84
A company is running a flash sale on its website. The website is hosted on burstable performance Amazon EC2 instances in an Auto Scaling group. The Auto Scaling group is configured to launch instances when the CPU utilization is above 70%.
A couple of hours into the sale, users report slow load times and error messages for refused connections. A SysOps administrator reviews Amazon CloudWatch metrics and notices that the CPU utilization is at 20% across the entire fleet of instances.
The SysOps administrator must restore the website's functionality without making changes to the network infrastructure.
Which solution will meet these requirements?
- A. Reduce the desired size of the Auto Scaling group to artificially increase CPU average utilization.
- B. Implement an Amazon CloudFront distribution to offload the traffic from the Auto Scaling group.
- C. Activate unlimited mode for the instances in the Auto Scaling group.
- D. Move the website to a different AWS Region that is closer to the users.
Answer: B
Explanation:
Reference:
Implement an Amazon CloudFront distribution to offload the traffic from the Auto Scaling group does not breach the requirement of no changes in the network infrastructure. Reason is that cloudfront is a distribution that allows you to distribute content using a worldwide network of edge locations that provide low latency and high data transfer speeds. It plug in to existing setup, not changes to it.
NEW QUESTION 85
A SysOps administrator is notified that an Amazon EC2 instance has stopped responding The AWS Management Console indicates that the system status checks are failing What should the administrator do first to resolve this issue?
- A. Terminate the EC2 instance and relaunch it
- B. Stop and then start the EC2 instance so that it can be launched on a new host
- C. Reboot the EC2 instance so it can be launched on a new host
- D. View the AWS CloudTrail log to investigate what changed on the EC2 instance
Answer: B
Explanation:
Reference:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-windows-system-status-check-fail/
NEW QUESTION 86
A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct IAM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket.
Which action will solve this problem while adhering to least privilege access?
- A. Configure the route table to allow the instances on the private subnet access through the internet gateway.
- B. Attach an S3 gateway endpoint to the VPC. Configure the route table for the private subnet.
- C. Add a bucket policy to the S3 bucket permitting access from the IAM role.
- D. Create a NAT gateway in a private subnet and configure the route table for the private subnets.
Answer: B
NEW QUESTION 87
A company hosts a web portal on Amazon EC2 instances. The web portal uses an Elastic Load Balancer (ELB) and Amazon Route 53 for its public DNS service. The ELB and the EC2 instances are deployed by way of a single AWS CloudFormation stack in the us-east-1 Region. The web portal must be highly available across multiple Regions.
Which configuration will meet these requirements?
- A. Deploy a copy of the stack in the us-west-2 Region. Create a single start of authority (SOA) record in Route 53 that includes the IP address from each ELB. Configure the SOA record with health checks. Use the ELB in us-east-1 as the primary record and the ELB in us-west-2 as the secondary record.
- B. Deploy a copy of the stack in the us-west-2 Region. Create an additional A record in Route 53 that includes the ELB in us-west-2 as an alias target. Configure the A records with a failover routing policy and health checks. Use the ELB in us-east-1 as the primary record and the ELB in us-west-2 as the secondary record.
- C. Deploy a new group of EC2 instances in the us-west-2 Region. Configure EC2 health checks on all EC2 instances in each Region. Configure a peering connection between the VPCs. Use the VPC in us-east-1 as the primary record and the VPC in us-west-2 as the secondary record.
- D. Deploy a new group of EC2 instances in the us-west-2 Region. Associate the new EC2 instances with the existing ELB, and configure load balancer health checks on all EC2 instances. Configure the ELB to update Route 53 when EC2 instances in us-west-2 fail health checks.
Answer: B
NEW QUESTION 88
A company asks a SysOps administrator to ensure that AWS CloudTrail files are not tampered with after they are created. Currently, the company uses AWS Identity and Access Management (IAM) to restrict access to specific trails. The company's security team needs the ability to trace the integrity of each file.
What is the MOST operationally efficient solution that meets these requirements?
- A. Create an AWS Lambda function that is invoked each time a new file is delivered to the CloudTrail bucket. Configure the Lambda function to compute an MD5 hash check on the file and store the result as a tag in an Amazon 53 object. The security team can use the information in the tag to verify the integrity of the delivered files.
- B. Enable the CloudTrail file integrity feature on an Amazon S3 bucket. Create an IAM policy that grants the security team access to the file integrity logs that are stored in the S3 bucket.
- C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that invokes an AWS Lambda function when a new file is delivered. Configure the Lambda function to compute an MD5 hash check on the file and store the result in an Amazon DynamoDB table. The security team can use the values that are stored in DynamoDB to verify the integrity of the delivered files.
- D. Enable the CloudTrail file integrity feature on the trail. The security team can use the digest file that is created by CloudTrail to verify the integrity of the delivered files.
Answer: B
NEW QUESTION 89
A company uses AWS Organizations to manage multiple AWS accounts with consolidated billing enabled. Organization member account owners want the benefits of Reserved Instances (RIs) but do not want to share RIs with other accounts.
Which solution will meet these requirements?
- A. Purchase RIs in the management account. Disable Rl discount sharing in the management account.
- B. Purchase RIs in the management account. Disable Rl discount sharing in the member accounts.
- C. Purchase RIs in individual member accounts. Disable Rl discount sharing in the member accounts.
- D. Purchase RIs in individual member accounts. Disable Rl discount sharing in the management account.
Answer: D
Explanation:
Reference:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ri-consolidated-billing/ RI discounts apply to accounts in an organization's consolidated billing family depending upon whether RI sharing is turned on or off for the accounts. By default, RI sharing for all accounts in an organization is turned on. The management account of an organization can change this setting by turning off RI sharing for an account. The capacity reservation for an RI applies only to the account the RI was purchased on, no matter whether RI sharing is turned on or off.
NEW QUESTION 90
A company uses an Amazon Elastic File System (Amazon EFS) file system to share files across many Linux Amazon EC2 instances. A SysOps administrator notices that the file system's PercentIOLimit metric is consistently at 100% for 15 minutes or longer. The SysOps administrator also notices that the application that reads and writes to that file system is performing poorly. They application requires high throughput and IOPS while accessing the file system.
What should the SysOps administrator do to remediate the consistently high PercentIOLimit metric?
- A. Create a new EFS file system that uses Max I/O performance mode. Use AWS DataSync to migrate data to the new EFS file system.
- B. Modify the existing EFS file system and activate Provisioned Throughput mode.
- C. Create an EFS lifecycle policy to transition future files to the Infrequent Access (IA) storage class to improve performance. Use AWS DataSync to migrate existing data to IA storage.
- D. Modify the existing EFS file system and activate Max I/O performance mode.
Answer: A
Explanation:
Reference:
To support a wide variety of cloud storage workloads, Amazon EFS offers two performance modes, General Purpose mode and Max I/O mode. You choose a file system's performance mode when you create it, and it cannot be changed. If the PercentIOLimit percentage returned was at or near 100 percent for a significant amount of time during the test, your application should use the Max I/O performance mode. https://docs.aws.amazon.com/efs/latest/ug/performance.html
NEW QUESTION 91
A company is migrating its production file server to AWS. All data that is stored on the file server must remain accessible if an Availability Zone becomes unavailable or when system maintenance is performed. Users must be able to interact with the file server through the SMB protocol. Users also must have the ability to manage file permissions by using Windows ACLs.
Which solution will net these requirements?
- A. Create an Amazon FSx for Windows File Server Multi-AZ file system.
- B. Create a single AWS Storage Gateway file gateway.
- C. Deploy two Amazon FSx for Windows File Server Single-AZ 2 file systems. Configure Microsoft Distributed File System Replication (DFSR).
- D. Deploy two AWS Storage Gateway file gateways across two Availability Zones. Configure an Application Load Balancer in front of the file gateways.
Answer: A
Explanation:
Reference:
https://aws.amazon.com/fsx/windows/
NEW QUESTION 92
A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct IAM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket.
Which action will solve this problem while adhering to least privilege access?
- A. Configure the route table to allow the instances on the private subnet access through the internet gateway.
- B. Attach an S3 gateway endpoint to the VPC. Configure the route table for the private subnet.
- C. Add a bucket policy to the S3 bucket permitting access from the IAM role.
- D. Create a NAT gateway in a private subnet and configure the route table for the private subnets.
Answer: B
Explanation:
Reference:
Technology to use is a VPC endpoint - "A VPC endpoint enables private connections between your VPC and supported AWS services and VPC endpoint services powered by AWS PrivateLink. AWS PrivateLink is a technology that enables you to privately access services by using private IP addresses. Traffic between your VPC and the other service does not leave the Amazon network." S3 is an example of a gateway endpoint. We want to see services in AWS while not leaving the VPC.
NEW QUESTION 93
An errant process is known to use an entire processor and run at 100%. A SysOps administrator wants to automate restarting the instance once the problem occurs for more than 2 minutes.
How can this be accomplished?
- A. Create a CloudWatch alarm for the EC2 instance with detailed monitoring. Enable an action to restart the instance.
- B. Create an Amazon CloudWatch alarm for the Amazon EC2 instance with basic monitoring. Enable an action to restart the instance.
- C. Create a Lambda function to restart the EC2 instance, triggered by EC2 health checks.
- D. Create an AWS Lambda function to restart the EC2 instance, triggered on a scheduled basis every 2 minutes.
Answer: A
NEW QUESTION 94
A company is running an application on premises and wants to use AWS for data backup All of the data must be available locally The backup application can write only to block-based storage that is compatible with the Portable Operating System Interface (POSIX) Which backup solution will meet these requirements?
- A. Configure the backup software to use Amazon S3 as the target for the data backups
- B. Configure the backup software to use Amazon S3 Glacier as the target for the data backups
- C. Use AWS Storage Gateway, and configure it to use gateway-cached volumes
- D. Use AWS Storage Gateway, and configure it to use gateway-stored volumes
Answer: D
NEW QUESTION 95
A company manages an application that uses Amazon ElastiCache for Redis with two extra-large nodes spread across two different Availability Zones. The company's IT team discovers that the ElastiCache for Redis cluster has 75% freeable memory. The application must maintain high availability.
What is the MOST cost-effective way to resize the cluster?
- A. Deploy a new ElastiCache for Redis cluster that uses large node types. Migrate the data from the original cluster to the new cluster. After the process is complete, shut down the original cluster.
- B. Decrease the number of nodes in the ElastiCache for Redis cluster from 2 to 1.
- C. Deploy a new ElastiCache for Redis cluster that uses large node types. Take a backup from the original cluster, and restore the backup in the new cluster. After the process is complete, shut down the original cluster.
- D. Perform an online resizing for the ElastiCache for Redis cluster. Change the node types from extra-large nodes to large nodes.
Answer: A
NEW QUESTION 96
A SysOps administrator is creating two AWS CloudFormation templates. The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway. The second template will deploy application resources within the VPC that was created by the first template. The second template should refer to the resources created by the first template.
How can this be accomplished with the LEAST amount of administrative effort?
- A. Create a mapping in the first template that is referenced by the second template.
- B. Create a custom resource that queries the stack created by the first template and retrieves the required values.
- C. Add an export field to the outputs of the first template and import the values in the second template.
- D. Input the names of resources in the first template and refer to those names in the second template as a parameter.
Answer: C
Explanation:
Reference:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-exports.html
NEW QUESTION 97
......
SOA-C02 Dumps and Exam Test Engine: https://dumpstorrent.dumpsking.com/SOA-C02-testking-dumps.html
