Question 1

[Monitoring, Reporting, and Automation]
A SysOps administrator must ensure that all of a company's current and future Amazon S3 buckets
have logging enabled If an S3 bucket does not have logging enabled an automated process must
enable logging for the S3 bucket.
Which solution will meet these requirements?

Accepted Answer

B

Explanation: To design a high-traffic static website that is highly available and provides low latency globally, you can use Amazon S3, CloudFront, and Route 53. This solution leverages the global edge locations of CloudFront to deliver content with low latency. Create an Amazon S3 Bucket: Open the S3 console at Amazon S3 Console. Create a new bucket and upload your website content. Configure S3 for Static Website Hosting: Go to the Properties tab of your bucket. Enable Static website hosting and set the index document (e.g., index.html). Create a CloudFront Distribution: Open the CloudFront console at Amazon CloudFront Console. Create a new distribution and set the S3 bucket as the origin. Configure distribution settings, including caching behaviors and SSL/TLS settings. Create Route 53 Alias Record: Open the Route 53 console at Amazon Route 53 Console. Select the hosted zone for your domain. Create a new record set, choose ALIAS as the record type, and point it to the CloudFront distribution. Amazon S3 Static Website Hosting Creating a CloudFront Distribution Routing Traffic to a CloudFront Distribution

Question 2

[Deployment, Provisioning, and Automation]
A company has migrated its application to AWS. The company will host the application on Amazon
EC2 instances of multiple instance families.
During initial testing, a SysOps administrator identifies performance issues on selected EC2 instances.
The company has a strict budget allocation policy, so the
SysOps administrator must use the right resource types with the performance characteristics to
match the workload.
What should the SysOps administrator do to meet this requirement?

Accepted Answer

B

Explanation: Scaling Policies in Auto Scaling: When multiple scaling policies trigger at the same time, each policy is executed independently. If both policies are set to add 5 instances when CPU utilization reaches 80%, they will both be executed when the threshold is met. Therefore, the total number of instances added will be the sum of the instances specified in both policies. In this case, 5 instances from one policy and 5 instances from the other policy will result in a total of 10 instances being added. Steps to Configure and Verify Scaling Policies: Go to the AWS Management Console. Navigate to EC2 and select "Auto Scaling Groups." Select your Auto Scaling group and review the scaling policies. Ensure that both scaling policies are configured to trigger at 80% CPU utilization. Monitor the Auto Scaling group's activity to verify the addition of instances when the CPU utilization threshold is reached. Scaling Policies for Amazon EC2 Auto Scaling

Question 3

[Security and Compliance]
A company migrates a write-once, read-many (WORM) drive to an Amazon S3 bucket that has S3
Object Lock configured in governance mode. During the migration, the company copies unneeded
data to the S3 bucket.
A SysOps administrator attempts to delete the unneeded data from the S3 bucket by using the AWS
CLI. However, the SysOps administrator receives an error.
Which combination of steps should the SysOps administrator take to successfully delete the
unneeded data? (Select TWO.)

Accepted Answer

C, D

Explanation: When using Amazon S3 Object Lock configured in governance mode, deleting objects before their retention period ends requires specific permissions. To bypass these governance restrictions, the administrator must: C: Assume a role that has the s3:BypassGovernanceRetention permission. This permission allows the role to override the governance mode restrictions. D: Include the x-amz-bypass-governance-retention:true header in the delete request. This header is necessary to programmatically bypass the governance retention settings when making a delete request via the AWS CLI or SDK. These steps enable the deletion of objects under governance mode retention without waiting for the retention period to expire, addressing the need to remove unintended data uploads effectively. For further details, refer to the AWS documentation on S3 Object Lock Amazon S3 Object Lock.

Question 4

[Monitoring, Reporting, and Automation]
A company hosts an internet web application on Amazon EC2 instances. The company is replacing
the application with a new AWS Lambda function. During a transition period, the company must
route some traffic to the legacy application and some traffic to the new Lambda function. The
company needs to use the URL path of request to determine the routing.
Which solution will meet these requirements?

Accepted Answer

C, D

Explanation: AWS Config Managed Rule for S3 Logging: The s3-bucket-logging-enabled AWS Config rule checks whether S3 buckets have logging enabled. Steps: Go to the AWS Management Console. Navigate to AWS Config. Create a rule using s3-bucket-logging-enabled. Add a remediation action using an AWS Lambda function or Systems Manager Automation runbook. AWS Config Managed Rules Using AWS Lambda for Remediation: Create a Lambda function that enables logging on S3 buckets. Steps: Write a Lambda function in Python or Node.js to enable logging. Configure the function to trigger on non-compliant buckets. Reference: AWS Lambda Using AWS Systems Manager Automation: The AWS-ConfigureS3BucketLogging runbook automates enabling logging. Steps: Go to the AWS Management Console. Navigate to Systems Manager. Create an Automation document or use the existing AWS-ConfigureS3BucketLogging runbook. Configure the remediation action to use this runbook. Reference: AWS Systems Manager Automation

Question 5

[Security and Compliance] The SysOps administrator needs to configure a website for CloudFront when the DNS CNAME record points to an S3 URL instead of CloudFront. Options:

Accepted Answer

D

Explanation: To correctly route traffic through CloudFront, the CNAME record should point to the CloudFront distribution's domain (dllllllabcdef8.cloudfront.net). This ensures that requests reach CloudFront first, which then forwards them to the S3 bucket as configured. Correcting the DNS Record: Changing the DNS CNAME record to point to the CloudFront distribution ensures that all requests go through CloudFront, leveraging its caching and content delivery capabilities. No Need to Modify S3 Bucket: Since CloudFront accesses the S3 origin through its identity, there’s no need to disable S3 Block Public Access.

Question 6

[Security and Compliance]
A company has an AWS Config rule that identifies open SSH ports in security groups. The rule has an
automatic remediation action to delete the SSH inbound rule for noncompliant security groups.
However, business units require SSH access and can provide a list of trusted IPs to restrict access.
Options:

Accepted Answer

B

Explanation: The problem requires modifying the inbound SSH rule to restrict access to a list of trusted IPs instead of deleting it entirely. AWS Config rules can be configured with automatic remediation actions using either Systems Manager Automation runbooks or Lambda functions. However, AWS Systems Manager Automation runbooks are often more appropriate for managing infrastructure changes like security group modifications because they are reusable, parameterized, and easier to audit. Create a Systems Manager Automation runbook: This runbook will contain steps to add or modify the existing security group rule, allowing SSH access only from the specified IP addresses. Update the AWS Config rule: Modify the Config rule to call this new runbook for its automatic remediation. This will prevent deletion of the SSH rule and instead update it based on the IP list.

Question 7

[Security and Compliance]
A SysOps administrator needs to configure the Amazon Route 53 hosted zone for example.com and
www.example.com to point to an Application Load Balancer (ALB). Which combination of actions
should the SysOps administrator take to meet these requirements? (Select TWO.)

Accepted Answer

C, D

Explanation: You are correct that an A record typically points to an IP address. However, in the case of an Application Load Balancer (ALB), you cannot use an A record with an IP address because the IP addresses of an ALB can change over time. Instead, you can use an alias record to point to the DNS name of the ALB. An alias record is a Route 53 extension to DNS that allows you to route traffic to selected AWS resources, such as an ALB, by using a friendly DNS name, such as example.com, instead of the resource’s IP address or DNS name.

Question 8

[Deployment, Provisioning, and Automation] To manage Auto Scaling group instances that have OS vulnerabilities, the SysOps administrator needs an automated patching solution. Options:

Accepted Answer

A

Explanation: Using AWS Systems Manager Patch Manager with a maintenance window is a best practice for automating OS patch management across instances in an Auto Scaling group. Patch Manager: Allows for scheduled patching according to maintenance windows, ensuring minimal impact on application uptime. RebootOption parameter: Setting this to RebootIfNeeded ensures patches are applied fully when a reboot is required. AWS-RunPatchBaseline: This document automates the patching process and can be customized based on compliance requirements.

Question 9

[Monitoring, Reporting, and Automation]
A company hosts an internet web application on Amazon EC2 instances. The company is replacing
the application with a new AWS Lambda function. During a transition period, the company must
route some traffic to the legacy application and some traffic to the new Lambda function. The
company needs to use the URL path of request to determine the routing.
Which solution will meet these requirements?

Accepted Answer

C

Explanation: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.SSL.htm Amazon RDS supports SSL/TLS encryption for connections to the database, and this can be enabled by creating a custom parameter group and setting the rds.force_ssl parameter to 1. This will ensure that all connections to the database are encrypted, protecting the data and maintaining compliance with the company's requirements.l

Question 10

[Security and Compliance]
A company recently deployed an application in production. The production environment currently
runs on a single Amazon EC2 instance that hosts the application's web application and a MariaDB
database. Company policy states that all IT production environments must be highly available.
What should a SysOps administrator do to meet this requirement?

Accepted Answer

A

Explanation: To make the production environment highly available in accordance with company policy: Database Migration: Move the MariaDB database from a single EC2 instance to Amazon RDS for MariaDB configured for Multi-AZ. This setup ensures high availability of the database with synchronous replication to a standby instance in a different Availability Zone. Application Scalability: Deploy the application on EC2 instances within an Auto Scaling group. Configure the Auto Scaling group to operate across multiple Availability Zones to ensure that the application remains available even if one zone becomes unavailable. Load Balancing: Place the EC2 instances behind an Elastic Load Balancer (ELB). The load balancer will distribute incoming application traffic across the multiple, geographically dispersed EC2 instances, further enhancing the availability and fault tolerance of the application. This solution leverages AWS managed services to increase the reliability and availability of both the application and database layers, adhering to best practices for deploying critical production environments on AWS.

Question 11

[Security and Compliance]
A company updates its security policy to clarify cloud hosting arrangements for regulated workloads.
Workloads that are identified as sensitive must run on hardware that is not shared with other
customers or with other AWS accounts within the company.
Which solution will ensure compliance with this policy?

Accepted Answer

A

Explanation: Dedicated Hosts are physical servers that are dedicated to a single customer, ensuring that the customer’s workloads are not shared with other customers or with other AWS accounts within the company. This will ensure that the company’s security policy is followed and that sensitive workloads are running on hardware that is not shared with other customers or with other AWS accounts within the company.

Question 12

[Deployment, Provisioning, and Automation]
A company has migrated its application to AWS. The company will host the application on Amazon
EC2 instances of multiple instance families.
During initial testing, a SysOps administrator identifies performance issues on selected EC2 instances.
The company has a strict budget allocation policy, so the
SysOps administrator must use the right resource types with the performance characteristics to
match the workload.
What should the SysOps administrator do to meet this requirement?

Accepted Answer

C

Explanation: When managing performance and cost for EC2 instances across different families, the following steps are recommended: Utilize AWS Compute Optimizer: This service provides recommendations for EC2 instances based on historical usage patterns and existing configurations. It helps identify optimal EC2 instance types and sizes that could deliver better performance and cost savings for your specific workload. Implement Compute Savings Plans: After determining the most suitable instance types and sizes through Compute Optimizer, purchasing Compute Savings Plans can offer significant cost savings. These savings plans apply to any instance family across any region, providing flexibility and cost efficiency without upfront commitment to specific instance types. AWS Documentation Reference: Further details can be found in the AWS documentation on Compute Optimizer and Compute Savings Plans: AWS Compute Optimizer AWS Compute Savings Plans.

Question 13

[Monitoring, Reporting, and Automation]
A company hosts an internet web application on Amazon EC2 instances. The company is replacing
the application with a new AWS Lambda function. During a transition period, the company must
route some traffic to the legacy application and some traffic to the new Lambda function. The
company needs to use the URL path of request to determine the routing.
Which solution will meet these requirements?

Accepted Answer

D

Explanation: To route traffic based on the URL path during a transition period where both an EC2-based legacy application and a new AWS Lambda function are in use: Use of Application Load Balancer (ALB): ALBs support advanced request routing based on the URL path, among other criteria. This capability allows the ALB to evaluate the URL path of incoming requests and route them appropriately to either the legacy EC2 instances or the Lambda function. Path-Based Routing Rules: Configure the ALB with rules that specify which URL paths should be directed to the EC2 instances and which should be routed to the Lambda function. For example, requests to /legacy/* might go to the EC2 instances, while /new/* could be directed to the Lambda function. Integration with Lambda: ALBs can directly invoke Lambda functions in response to HTTP requests, making them ideal for scenarios where both server-based and serverless components are used in tandem. This setup not only facilitates a smooth transition by enabling simultaneous operation of both components but also leverages the native capabilities of ALBs to manage traffic based on application requirements effectively.

Question 14

[Monitoring, Reporting, and Automation]
A company is running a development application on an Amazon EC2 instance. The application
uploads 500.000 files that are 1 GB in size into a large! Amazon S3 bucket that has default encryption
enabled The EC2 instance is in the same AWS Region where the S3 bucket is deployed.
The company uses performance logging that is built into the application software. The logs show that
the application is constantly waiting for the files to be written to the S3 bucket. A SysOps
administrator needs to improve the application's throughput performance. The SysOps administrator
validates that the networking on the EC2 instance is not constrained.
What should the SysOps administrator do to improve the S3 upload performance''

Accepted Answer

B

Explanation: Improve S3 Upload Performance: Using multiple bucket prefixes can improve throughput by allowing parallel upload streams. Steps: Modify the application to write files to different prefixes in the S3 bucket. Example: Instead of writing all files to s3://bucket-name/, write to s3://bucket-name/prefix1/, s3://bucket-name/prefix2/, etc. Best Practices for Amazon S3 Performance

Question 15

[Monitoring, Reporting, and Automation]
A SysOps administrator must ensure that all of a company's current and future Amazon S3 buckets
have logging enabled If an S3 bucket does not have logging enabled an automated process must
enable logging for the S3 bucket.
Which solution will meet these requirements?

Accepted Answer

A

Explanation: To immediately notify software developers if an AWS Lambda function experiences an error, follow these steps: Create an SNS Topic: Navigate to the Amazon SNS console and create a new topic. Add email subscriptions for each developer to the SNS topic. Reference: Creating an Amazon SNS Topic Create a CloudWatch Alarm: Go to the Amazon CloudWatch console and create an alarm based on the Errors metric for the specific Lambda function. Use the Lambda function name as a dimension. Configure the alarm to trigger when the metric exceeds a threshold indicating an error. Reference: Creating Alarms in Amazon CloudWatch Configure Notification: Set the CloudWatch alarm action to send a notification to the SNS topic created in step 1 when the alarm state reaches ALARM. Reference: Using Amazon SNS for CloudWatch Alarms This configuration ensures that developers are notified immediately via email if the Lambda function experiences an error.

Free AWS SOA-C02 Actual Exam Questions