SOA-C02 - findprotools.com

soa-c02 Fast Test

Total question: 10 (Login to full test)

Question 1:

As a SysOps Administrator, you maintain the development account of a large team that comprises of both developers and testers. The Development account has two IAM groups: Developers and Testers. Users in both groups have permission to work in the development account and access resources there. From time to time, a developer must update the live S3 Bucket in the production account.

How will you configure the permissions for developers to access the production environment?

Create a Role in production account, that defines the development account as a trusted entity and specify a permissions policy that allows trusted users to update the bucket. Then, modify the IAM group policy in development account, so that testers are denied access to the newly created role. Developers can use the newly created role to access the live S3 buckets in production environment

Create a Role in development account, that defines the production account as a trusted entity and specify a permissions policy that allows trusted users to update the bucket. Then, modify the IAM group policy in development account, so that testers are denied access to the newly created role. Developers can use the newly created role to access the live S3 buckets in production environment

Use Inline policies to be sure that the permissions in a policy are not inadvertently assigned to an identity other than the one they're intended for

Create a Role in Production account, that defines the Development account as a trusted entity and specify a permissions policy that allows trusted users to update the bucket. Developers can use the newly created role to access the live S3 buckets in production environment

Question 2:

As a SysOps Administrator, you have been contacted by a team for troubleshooting a security issue they seem to be facing. A security check red flag is being raised for the security groups created by AWS Directory Services. The flag message says "Security Groups - Unrestricted Access."

How will you troubleshoot this issue?

Use AWS Trusted Advisor to know the exact reason for this error and take action as recommended by the Trusted Advisor

The security group configurations have to be checked and edited to cater to AWS security standards

Ignore or suppress the red flag since it is safe to do so, in this scenario

AWS Directory Service might have been initiated from an account that does not have proper permissions. Check the permissions on the IAM roles and IAM users used to initiate the service

Question 3:

A multi-national company extensively uses AWS CloudFormation to model and provision its AWS resources. A human error had earlier deleted a critical service from the CloudFormation stack that resulted in business loss. The company is looking at a quick and effective solution to lock the critical resources from any updates or deletes.

As a SysOps Administrator, what will you suggest to address this requirement?

Use nested stacks that will retain the configuration in the parent configuration even if the child configuration is lost or cannot be used

Use Stack policies to protect critical stack resources from unintentional updates

Use parameter constraints to specify the Identities that can update the Stack

Use revision controls to protect critical stack resources from unintentional updates

Question 4:

A startup has reserved On-Demand Capacity Reservations for the Amazon EC2 instances they use for running analytics. Once the billing report was generated, the company was surprised to see that the costs were much higher than expected. The startup has hired you as a SysOps Administrator to bridge this knowledge gap.

Can you identify the important points to remember when considering On-Demand Capacity Reservations? (Select two)

On-Demand Capacity Reservations enable you to reserve capacity for your Amazon EC2 instances in a specific Availability Zone for any duration

Capacity Reservations can be used with Dedicated Hosts, however, they can't be used with placement groups

Capacity Reservations are transferable from one AWS account to another

Capacity Reservations do not offer any billing discounts

On-Demand Capacity Reservations require a fixed one-year or three-year commitment

Question 5:

A team noticed that it has accidentally deleted the AMI of Amazon EC2 instances belonging to the test environment. The team had configured backups via EBS snapshots for these instances.

Which of the following options would you suggest to recover/rebuild the accidentally deleted AMI? (Select two)

AWS Support retains backups of AMIs. Write to the support team to get help for recovering the lost AMI

Create a new AMI from Amazon EC2 instances that were launched before the deletion of AMI

Create a new AMI from Amazon EBS snapshots that were created as backups

Recover the AMI from the current Amazon EC2 instances that were launched before the deletion of AMI

Recover the AMI from Amazon EBS snapshots that were created as backups before the deletion of AMI

Question 6:

The technology team at a retail company has set the DisableApiTermination attribute for a business-critical Amazon EC2 Windows instance to prevent termination of the instance via an API. This instance is behind an Auto Scaling Group (ASG) and the InstanceInitiatedShutdownBehavior attribute is set for the instance. A developer has initiated shutdown from the instance using operating system commands.

What will be the outcome of the above scenario?

The instance will not shutdown because DisableApiTermination attribute is set

ASG cannot terminate an instance whose DisableApiTermination attribute is set

The operating system of the instance will send an Amazon SNS notification to the concerned person, that was configured when DisableApiTermination attribute was set. The operating system will hold the shutdown for few configured minutes and then progress with instance shutdown

The instance will be terminated

Question 7:

As a SysOps Administrator, you have been asked to fix the network performance issues for a fleet of Amazon EC2 instances of a company.

Which of the following use-cases represents the right fit for using enhanced networking?

To reach speeds up to 2,500 Gbps between EC2 instances

To configure Direct Connect to reach speeds up to 25 Gbps between EC2 instances

To support throughput near or exceeding 20K packets per second (PPS) on the VIF driver

To configure multi-attach for an EBS volume that can be attached to a maximum of 16 EC2 instances in a single Availability Zone

Question 8:

The development team at a retail company manages the deployment and scaling of their web application through AWS Elastic Beanstalk. After configuring the Elastic Beanstalk environment, the team has realized that Beanstalk is not handling the scaling activities the way they expected. This has impacted the application's ability to respond to the variations in traffic.

How should the environment be configured to get the best of Beanstalk's auto-scaling capabilities?

The Auto Scaling group in your Elastic Beanstalk environment uses the number of logged-in users, as the criteria to trigger auto-scaling action. These alarms must be configured based on the parameters appropriate for your application

The Auto Scaling group in your Elastic Beanstalk environment uses two default Amazon CloudWatch alarms to trigger scaling operations. These alarms must be configured based on the parameters appropriate for your application

The IAM Role attached to the Auto Scaling group might not have enough permissions to scale instances on-demand

By default, Auto Scaling group created from Beanstalk uses Elastic Load Balancing health checks. Configure the Beanstalk to use Amazon EC2 status checks

Question 9:

An automobile company uses a hybrid environment to run its technology infrastructure using a mix of on-premises instances and AWS Cloud. The company has a few managed instances in Amazon VPC. The company wants to avoid using the internet for accessing AWS Systems Manager APIs from this VPC.

As a Systems Administrator, which of the following would you recommend to address this requirement?

You can privately access AWS Systems Manager APIs from Amazon VPC by creating VPC Endpoint

You can privately access AWS Systems Manager APIs from Amazon VPC by creating Internet Gateway

You can privately access AWS Systems Manager APIs from Amazon VPC by creating NAT gateway

You can privately access AWS Systems Manager APIs from Amazon VPC by creating VPN connection

Question 10:

As SysOps Administrator, you have created two configuration files for CloudWatch Agent configuration. The first configuration file collects a set of metrics and logs from all servers and the second configuration file collects metrics from certain applications. You have given the same name to both the files but stored these files in different file paths.

What is the outcome when the CloudWatch Agent is started with the first configuration file and then the second configuration file is appended to it?

Second configuration file parameters are added to the Agent already running with the first configuration file parameters

Two different Agents are started with different configurations, collecting the metrics and logs listed in either of the configuration files

The append command overwrites the information from the first configuration file instead of appending to it

A CloudWatch Agent can have only one configuration file and all required parameters are defined in this file alone