SOA-C02 - findprotools.com

soa-c02 Fast Test

Total question: 10 (Login to full test)

Question 1:

A firm uses Amazon EC2 instances for running its flagship application. With new business expansion plans, the firm is looking at a bigger footprint for its AWS infrastructure. The development team needs to share Amazon Machine Images (AMIs) across AZs, AWS accounts and Regions.

What are the key points to be considered before planning the expansion? (Select two)

You need to share any CMKs used to encrypt snapshots and any Amazon EBS snapshots that the AMI references

AMIs are regional resources and can be shared across Regions

You do not need to share the Amazon EBS snapshots that an AMI references in order to share the AMI

You can only share AMIs that have unencrypted volumes and volumes that are encrypted with a customer-managed CMK

You can only share AMIs that have unencrypted volumes and volumes that are encrypted with an AWS-managed CMK

Question 2:

A retail company has realized that their Amazon EBS volume backed EC2 instance is consistently over-utilized and needs an upgrade. A developer has connected with you to understand the key parameters to be considered when changing the instance type.

As a SysOps Administrator, which of the following would you identify as correct regarding the instance types for the given use-case? (Select three)

The new instance retains its public, private IPv4 addresses, any Elastic IP addresses, and any IPv6 addresses that were associated with the old instance

Resizing of an instance is possible if the root device is either EBS volume or an instance store volume. However, instance store volumes taking longer to start on the new instance, since cache data is lost on these instances

You must stop your Amazon EBS–backed instance before you can change its instance type. AWS moves the instance to new hardware; however, the instance ID does not change

If your instance is in an Auto Scaling group, the Amazon EC2 Auto Scaling service marks the stopped instance as unhealthy, and may terminate it and launch a replacement instance

There is no downtime on the instance if you choose an instance of a compatible type since AWS starts the new instance and shifts the applications from current instance

Resizing of an instance is only possible if the root device for your instance is an EBS volume

Question 3:

A media company stores all their articles on Amazon S3 buckets. As a security measure, they have server access logging enabled for all the buckets. The company is looking at a solution that can regularly check if logging is enabled for all the existing buckets and for any new ones they create. If the solution can also automate the remedy, it will be a perfect fit for their requirement.

Which of the following would you suggest to address the given use-case?

Amazon S3 server access logging is checked by AWS Trusted Advisor, as part of the best practices check it performs. Configure a remedy action with Trusted Advisor for all the resources that fails this best practice check

Enable AWS CloudTrail to track the logging information for all the S3 buckets. Currently, AWS does not provide an automatic remediation process, hence, use a Lambda function to rectify any aberrations found during the checks

Use AWS Config rules to check whether or not an S3 bucket has logging enabled, and carry out the necessary remediation if needed

Create a Lambda function that will check the logging status of all the S3 buckets and raise an Amazon SNS notification, if a remedy is needed

Question 4:

The Chief Technology Officer (CTO) of a healthcare company realized that he does not have access to an Amazon S3 bucket present in the company's own AWS account. The CTO is the root user for the AWS account and has created other AWS users using the root user account.

What is the reason for this behavior and how can you fix this?

An Amazon S3 bucket policy that specifies a wildcard (*) in the principal element, sometimes is declared void by AWS to avoid the risk of complete public exposure. Such S3 buckets policies are in invalid status and have random behavior

Root user has access to all the resources in his AWS account. Contact AWS support to resolve the access issue

Root user always has access to all the resources of the account. The Amazon S3 bucket could be from another AWS account and the S3 bucket has been shared with the root user and hence appears in his list of S3 buckets

If an IAM user, with full access to IAM and Amazon S3, assigns a bucket policy to an Amazon S3 bucket and doesn't specify the AWS account root user as a principal, the root user is denied access to that bucket

Question 5:

As a SysOps Administrator, you create and maintain various system configurations for the teams you work with. You have created a CloudFront distribution with origin as an Amazon S3 bucket. The configuration has worked fine so far. However, for a few hours now, an error similar to this has cropped up - The authorization header is malformed; the region '<AWS Region>' is wrong; expecting '<AWS Region>'.

What is the reason for this error and how will you fix it?

This error indicates that the API key used for authorization is from an AWS Region that is different from the Region that S3 bucket is created in

This error indicates the configured Amazon S3 bucket has been moved from one AWS Region to the other. That is, deleted from one AWS Region and created with the same name in another. To fix this error, update your CloudFront distribution so that it finds the S3 bucket in the bucket's current AWS Region

This error indicates that the CloudFront distribution and Amazon S3 are not in the same AWS Region. Move one resource so that, both the CloudFront distribution and Amazon S3 are in the same AWS Region

This error indicates that when CloudFront forwarded a request to the origin, the origin didn’t respond before the request expired. This could be an access issue caused by a firewall or a Security Group not allowing access to CloudFront to access S3 resources

Question 6:

A company has recently moved its server infrastructure to Amazon EC2 instances. The company needs to use CloudWatch metrics to track the state of each of the instances.

Which of the following is the right way to configure the instances for CloudWatch monitoring to work?

Install CloudWatch Agent on all the instances and attach an IAM user to the EC2 instances to be able to run the CloudWatch agent

Install CloudWatch Agent on all the instances and attach necessary Security Groups to the EC2 instances to be able to run the CloudWatch agent

Install CloudWatch Agent on all the instances and attach an IAM role to the EC2 instances to be able to run the CloudWatch agent

Configure CloudWatch from AWS Console for the instances that need to be monitored by CloudWatch. AWS automatically installs and configure the agent for the mentioned instances

Question 7:

As part of the ongoing system maintenance, a SysOps Administrator has decided to increase the storage capacity of an EBS volume that is attached to an Amazon EC2 instance. However, the increased size is not reflected in the file system.

What has gone wrong in the configuration and how can it be fixed?

Linux servers automatically pick the modifications done to EBS volumes, but Windows servers do not offer this feature. Use the Windows Disk Management utility to increase the disk size to the new modified volume size

After you increase the size of an EBS volume, you must extend the file system to a larger size

EBS volume might be encrypted. Encrypted EBS volumes will not show modifications done when still attached to the instance. Detach the EBS volume and attach it back

EBS volume needs to be detached and attached back again to the instance for the modifications to show

Question 8:

A financial analytics company stores their confidential reports in an Amazon S3 bucket. These reports should be preserved for 5 years and these are no more valid or useful for the company after 5 years. Manual deletion is often delayed which results in higher storage costs for the company.

As a SysOps Administrator, which is the simplest solution to delete the expired reports on-time to save costs?

Disable versioning on the S3 bucket for which the retention period is being set, to avoid creating retention periods for all versions of the object. Then, configure the retention period in the object lock settings to 5 years

Configure a lifecycle policy to delete the object 5 years after the object is created

Configure the "Retain Until Date" in the object lock settings to a date that is 5 years from the object creation date and create a lifecycle policy to delete the object 5 years after the object is created

Configure the Amazon S3 bucket default settings to specify the "Retain Until Date" for all the objects in the bucket

Question 9:

A SysOps administrator has deployed multiple applications on a fleet of Amazon EC2 instances.

What is the right way to configure scheduled events for these EC2 instances?

Scheduled events are managed by AWS, you cannot configure scheduled events for your instances

Use Amazon EventBridge to configure scheduled events on Amazon EC2 instances

Use CloudWatch Alarm to configure scheduled events on Amazon EC2 instances

Use CloudWatch Agent to configure scheduled events on Amazon EC2 instances

Question 10:

Your company has decided that certain users should have Multi-Factor Authentication (MFA) enabled for their sign-in credentials. A newly hired manager has a Gemalto MFA device that he used in his earlier company. He has approached you to configure it for his AWS account.

How will you configure his existing Gemalto MFA device so he can seamlessly connect with AWS services in the new company?

Security constraints mandate that sharing of secrets between multiple parties can only happen in edge cases. Hence, formal approval is needed between AWS and the previous company to use the same Gemalto device

You can re-use an existing Gemalto device with AWS MFA, as Gemalto devices do not share any secrets between multiple parties

AWS MFA relies on knowing a unique secret associated with your hardware MFA. This has to be generated again with AWS MFA for the Gemalto device to work with AWS

AWS MFA does not support the use of your existing Gemalto device