Amazon SOA-C02 Practice Exams
Last updated on Oct 21,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 21,2026
Question #11
A company has an application that is deployed 10 two AWS Regions in an active-passive configuration. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in each Region. The instances are in an Amazon EC2 Auto Scaling group in each Region. The application uses an Amazon Route 53 hosted zone (or DNS. A SysOps administrator needs to configure automatic failover to the secondary Region.
What should the SysOps administrator do to meet these requirements?
- A . Configure Route 53 alias records that point to each ALB. Choose a failover routing policy. Set Evaluate Target Health to Yes.
- B . Configure CNAME records that point to each ALB. Choose a failover routing policy. Set Evaluate Target Health to Yes.
- C . Configure Elastic Load Balancing (ELB) health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as
targets. - D . Configure EC2 health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.
Correct Answer: A
A
Explanation:
Amazon Route 53’s failover routing policy allows you to route traffic to a primary resource unless it is unavailable, in which case Route 53 can fail over to a secondary resource.
Steps:
Open Route 53 Console:
Open the Amazon Route 53 console.
Create Alias Records:
In your hosted zone, create two alias records.
One alias record should point to the ALB in the primary region and the other to the ALB in the secondary region.
Set Failover Routing Policy:
For the alias record pointing to the primary ALB, set the routing policy to "Failover" and designate it as the primary.
For the alias record pointing to the secondary ALB, set the routing policy to "Failover" and designate it as the secondary.
Enable Health Checks:
Ensure that "Evaluate Target Health" is set to "Yes" for both alias records. This ensures that Route 53 will check the health of the ALBs before routing traffic.
Configure Health Checks for ALBs:
Ensure that each ALB has appropriate health checks configured to accurately report the health of the instances.
Reference: Route 53 Failover Routing
Configuring Alias Records
A
Explanation:
Amazon Route 53’s failover routing policy allows you to route traffic to a primary resource unless it is unavailable, in which case Route 53 can fail over to a secondary resource.
Steps:
Open Route 53 Console:
Open the Amazon Route 53 console.
Create Alias Records:
In your hosted zone, create two alias records.
One alias record should point to the ALB in the primary region and the other to the ALB in the secondary region.
Set Failover Routing Policy:
For the alias record pointing to the primary ALB, set the routing policy to "Failover" and designate it as the primary.
For the alias record pointing to the secondary ALB, set the routing policy to "Failover" and designate it as the secondary.
Enable Health Checks:
Ensure that "Evaluate Target Health" is set to "Yes" for both alias records. This ensures that Route 53 will check the health of the ALBs before routing traffic.
Configure Health Checks for ALBs:
Ensure that each ALB has appropriate health checks configured to accurately report the health of the instances.
Reference: Route 53 Failover Routing
Configuring Alias Records
Question #12
A SysOps administrator has used AWS Cloud Formation to deploy a sereness application into a production VPC. The application consists of an AWS Lambda function, an Amazon DynamoOB table, and an Amazon API Gateway API. The SysOps administrator must delete the AWS Cloud Formation stack without deleting the DynamoOB table.
Which action should the SysOps administrator take before deleting the AWS Cloud Formation stack?
- A . Add a Retain deletion policy to the DynamoOB resource in the AWS CloudFormation stack.
- B . Add a Snapshot deletion policy to the DynamoOB resource In the AWS CloudFormation stack.
- C . Enable termination protection on the AWS Cloud Formation stack.
- D . Update the application’s IAM policy with a Deny statement for the dynamodb:DeleteTabie action.
Correct Answer: A
A
Explanation:
Understand the Problem:
The requirement is to delete the CloudFormation stack without deleting the DynamoDB table.
Analyze the Requirements:
Ensure the DynamoDB table is preserved when the CloudFormation stack is deleted.
Evaluate the Options:
Option A: Add a Retain deletion policy to the DynamoDB resource.
The Retain policy ensures that the DynamoDB table is not deleted when the stack is deleted.
Option B: Add a Snapshot deletion policy to the DynamoDB resource.
Snapshot policy is not applicable to DynamoDB tables and would not retain the table itself.
Option C: Enable termination protection on the CloudFormation stack.
Prevents stack deletion entirely but does not specifically protect the DynamoDB table. Option D: Update the IAM policy with a Deny statement for dynamodb:DeleteTable. Prevents deletion of the table but is not a CloudFormation stack-specific solution. Select the Best Solution:
Option A: Adding a Retain deletion policy to the DynamoDB resource in the CloudFormation stack ensures the table is preserved when the stack is deleted.
Reference: AWS CloudFormation Deletion Policy
Using the Retain deletion policy ensures that the DynamoDB table is not deleted when the CloudFormation stack is deleted, preserving critical data.
A
Explanation:
Understand the Problem:
The requirement is to delete the CloudFormation stack without deleting the DynamoDB table.
Analyze the Requirements:
Ensure the DynamoDB table is preserved when the CloudFormation stack is deleted.
Evaluate the Options:
Option A: Add a Retain deletion policy to the DynamoDB resource.
The Retain policy ensures that the DynamoDB table is not deleted when the stack is deleted.
Option B: Add a Snapshot deletion policy to the DynamoDB resource.
Snapshot policy is not applicable to DynamoDB tables and would not retain the table itself.
Option C: Enable termination protection on the CloudFormation stack.
Prevents stack deletion entirely but does not specifically protect the DynamoDB table. Option D: Update the IAM policy with a Deny statement for dynamodb:DeleteTable. Prevents deletion of the table but is not a CloudFormation stack-specific solution. Select the Best Solution:
Option A: Adding a Retain deletion policy to the DynamoDB resource in the CloudFormation stack ensures the table is preserved when the stack is deleted.
Reference: AWS CloudFormation Deletion Policy
Using the Retain deletion policy ensures that the DynamoDB table is not deleted when the CloudFormation stack is deleted, preserving critical data.
Question #13
A company is migrating its production file server to AWS. All data that is stored on the file server must remain accessible if an Availability Zone becomes unavailable or when system maintenance is performed. Users must be able to interact with the file server through the SMB protocol. Users also must have the ability to manage file permissions by using Windows ACLs.
Which solution will net these requirements?
- A . Create a single AWS Storage Gateway file gateway.
- B . Create an Amazon FSx for Windows File Server Multi-AZ file system.
- C . Deploy two AWS Storage Gateway file gateways across two Availability Zones. Configure an Application Load Balancer in front of the file gateways.
- D . Deploy two Amazon FSx for Windows File Server Single-AZ 2 file systems. Configure Microsoft Distributed File System Replication (DFSR).
Correct Answer: B
B
Explanation:
Amazon FSx for Windows File Server provides a fully managed native Microsoft Windows file system that supports the SMB protocol and Windows ACLs, ensuring compatibility with existing applications and processes. Using a Multi-AZ deployment ensures high availability by providing automatic failover to a standby instance in a different Availability Zone.
Create Amazon FSx for Windows File Server:
Open the Amazon FSx console at Amazon FSx Console.
Choose Create file system.
Select Amazon FSx for Windows File Server, then click Next.
Configure File System Settings:
In the File system details section, provide the necessary details such as Deployment type, Storage capacity, and Throughput capacity.
Select Multi-AZ deployment to ensure high availability.
Choose the Windows authentication method, either AWS Managed Microsoft AD or Self-managed Microsoft AD.
Network & Security Configuration:
Select the VPC, subnet, and security groups to attach to the file system. Ensure subnets are in different Availability Zones for Multi-AZ configuration. Review and Create:
Review the settings and click Create file system.
Access the File System:
Once the file system is created, you can map the network drive using the provided DNS name and manage permissions using Windows ACLs.
Reference: Amazon FSx for Windows File Server Documentation
Creating a Multi-AZ File System
B
Explanation:
Amazon FSx for Windows File Server provides a fully managed native Microsoft Windows file system that supports the SMB protocol and Windows ACLs, ensuring compatibility with existing applications and processes. Using a Multi-AZ deployment ensures high availability by providing automatic failover to a standby instance in a different Availability Zone.
Create Amazon FSx for Windows File Server:
Open the Amazon FSx console at Amazon FSx Console.
Choose Create file system.
Select Amazon FSx for Windows File Server, then click Next.
Configure File System Settings:
In the File system details section, provide the necessary details such as Deployment type, Storage capacity, and Throughput capacity.
Select Multi-AZ deployment to ensure high availability.
Choose the Windows authentication method, either AWS Managed Microsoft AD or Self-managed Microsoft AD.
Network & Security Configuration:
Select the VPC, subnet, and security groups to attach to the file system. Ensure subnets are in different Availability Zones for Multi-AZ configuration. Review and Create:
Review the settings and click Create file system.
Access the File System:
Once the file system is created, you can map the network drive using the provided DNS name and manage permissions using Windows ACLs.
Reference: Amazon FSx for Windows File Server Documentation
Creating a Multi-AZ File System
Question #14
A software development company has multiple developers who work on the same product. Each developer must have their own development environment, and these development environments must be identical. Each development environment consists of Amazon EC2 instances and an Amazon RDS DB instance. The development environments should be created only when necessary, and they must be terminated each night to minimize costs.
What is the MOST operationally efficient solution that meets these requirements?
- A . Provide developers with access to the same AWS CloudFormation template so that they can provision their development environment when necessary. Schedule a nightly cron job on each development instance to stop all running processes to reduce CPU utilization to nearly zero.
- B . Provide developers with access to the same AWS CloudFormation template so that they can provision their development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to delete the AWS CloudFormation stacks.
- C . Provide developers with CLI commands so that they can provision their own development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to terminate all EC2 instances and the DB instance.
- D . Provide developers with CLI commands so that they can provision their own development environment when necessary. Schedule a nightly Amazon EventBridge (Amazon CloudWatch Events) rule to cause AWS CloudFormation to delete all of the development environment resources.
Correct Answer: B
B
Explanation:
To efficiently manage and automate the creation and termination of development environments:
AWS CloudFormation Templates:
Provide a standardized CloudFormation template for developers to create identical development environments.
Reference: AWS CloudFormation User Guide
Automate Termination:
Use Amazon EventBridge (CloudWatch Events) to schedule a nightly rule that invokes an AWS Lambda function.
The Lambda function should be designed to delete the CloudFormation stacks created for development environments.
Reference: Amazon EventBridge
This solution ensures operational efficiency and cost management.
B
Explanation:
To efficiently manage and automate the creation and termination of development environments:
AWS CloudFormation Templates:
Provide a standardized CloudFormation template for developers to create identical development environments.
Reference: AWS CloudFormation User Guide
Automate Termination:
Use Amazon EventBridge (CloudWatch Events) to schedule a nightly rule that invokes an AWS Lambda function.
The Lambda function should be designed to delete the CloudFormation stacks created for development environments.
Reference: Amazon EventBridge
This solution ensures operational efficiency and cost management.
Question #15
A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6-only subnets.
How should a SysOps administrator configure the VPC to meet these requirements?
- A . Create and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
- B . Create and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.
- C . Create and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets.
- D . Create and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
Correct Answer: C
C
Explanation:
To meet the requirement of using only IPv6 for all EC2 instances while allowing outbound internet access and preventing inbound internet access, an egress-only internet gateway is the correct solution. An egress-only internet gateway allows outbound communication over IPv6 and blocks inbound communication, ensuring that the instances can access the internet but are not directly accessible from the internet.
Create an Egress-Only Internet Gateway:
Open the Amazon VPC console at Amazon VPC Console.
In the navigation pane, choose Egress-only internet gateways.
Choose Create egress-only internet gateway, and then attach it to your VPC.
Create a Custom Route Table:
In the VPC console, navigate to Route Tables.
Create a new route table or select an existing one.
Add a route with the destination set to ::/0 (which represents all IPv6 addresses) and the target set to the egress-only internet gateway.
Attach the Route Table to IPv6-Only Subnets:
Associate the route table with the IPv6-only subnets in your VPC.
This configuration ensures that your IPv6-only EC2 instances can access the internet while being protected from inbound internet traffic.
Reference: Egress-Only Internet Gateways
IPv6 Addresses
C
Explanation:
To meet the requirement of using only IPv6 for all EC2 instances while allowing outbound internet access and preventing inbound internet access, an egress-only internet gateway is the correct solution. An egress-only internet gateway allows outbound communication over IPv6 and blocks inbound communication, ensuring that the instances can access the internet but are not directly accessible from the internet.
Create an Egress-Only Internet Gateway:
Open the Amazon VPC console at Amazon VPC Console.
In the navigation pane, choose Egress-only internet gateways.
Choose Create egress-only internet gateway, and then attach it to your VPC.
Create a Custom Route Table:
In the VPC console, navigate to Route Tables.
Create a new route table or select an existing one.
Add a route with the destination set to ::/0 (which represents all IPv6 addresses) and the target set to the egress-only internet gateway.
Attach the Route Table to IPv6-Only Subnets:
Associate the route table with the IPv6-only subnets in your VPC.
This configuration ensures that your IPv6-only EC2 instances can access the internet while being protected from inbound internet traffic.
Reference: Egress-Only Internet Gateways
IPv6 Addresses
Question #16
A company uploaded its website files to an Amazon S3 bucket that has S3 Versioning enabled. The company uses an Amazon CloudFront distribution with the S3 bucket as the origin. The company recently modified the tiles, but the object names remained the same. Users report that old content is still appearing on the website.
How should a SysOps administrator remediate this issue?
- A . Create a CloudFront invalidation, and add the path of the updated files.
- B . Create a CloudFront signed URL to update each object immediately.
- C . Configure an S3 origin access identity (OAI) to display only the updated files to users.
- D . Disable S3 Versioning on the S3 bucket so that the updated files can replace the old files.
Correct Answer: A
A
Explanation:
When users report that old content is still appearing on the website after modifying files in an S3 bucket used by CloudFront, creating a CloudFront invalidation is the best solution.
CloudFront Invalidation:
Invalidation is the process of removing objects from the CloudFront cache before they expire.
This ensures that the updated content is served to the users.
Creating an Invalidation:
Open the CloudFront console.
Select the distribution and go to the "Invalidations" tab.
Create a new invalidation and specify the paths of the updated files.
Reference: Invalidating Files in Amazon CloudFront
A
Explanation:
When users report that old content is still appearing on the website after modifying files in an S3 bucket used by CloudFront, creating a CloudFront invalidation is the best solution.
CloudFront Invalidation:
Invalidation is the process of removing objects from the CloudFront cache before they expire.
This ensures that the updated content is served to the users.
Creating an Invalidation:
Open the CloudFront console.
Select the distribution and go to the "Invalidations" tab.
Create a new invalidation and specify the paths of the updated files.
Reference: Invalidating Files in Amazon CloudFront
Question #17
A company is creating a new multi-account environment in AWS Organizations. The company will use AWS Control Tower to deploy the environment. Users must be able to create resources in approved AWS Regions only. The company must configure and govern all accounts by using a standard baseline configuration.
Which combination of steps will meet these requirements in the MOST operationally efficient way? (Select TWO.)
- A . Create a permission set and a custom permissions policy in AWS IAM Identity Center (AWS Single Sign-On) for each user to prevent each user from creating resources in unapproved Regions.
- B . Deploy AWS Config rules in each AWS account to govern the account’s security compliance and to delete any resources that are created in unapproved Regions.
- C . Deploy AWS Lambda functions to configure security settings across all accounts in the organization and to delete any resources that are created in unapproved Regions.
- D . Implement a service control policy (SCP) to deny any access to AWS based on the requested Region.
- E . Modify the AWS Control Tower landing zone settings to govern the approved Regions.
Correct Answer: DE
DE
Explanation:
To restrict resource creation in unapproved regions across multiple AWS accounts efficiently, combining SCPs and Control Tower settings is effective:
SCP for Regional Restrictions: Create and apply an SCP that explicitly denies access to AWS services in unapproved regions. This policy will enforce region-based restrictions at the organizational unit or account level.
Control Tower Regional Governance: Adjust the settings in AWS Control Tower’s landing zone to include governance for approved regions. This helps in maintaining a standard configuration that aligns with organizational policies regarding AWS regions.
AWS Documentation
Reference: For more information, check the AWS documentation on SCPs and AWS Control Tower:
Service Control Policies
AWS Control Tower.
DE
Explanation:
To restrict resource creation in unapproved regions across multiple AWS accounts efficiently, combining SCPs and Control Tower settings is effective:
SCP for Regional Restrictions: Create and apply an SCP that explicitly denies access to AWS services in unapproved regions. This policy will enforce region-based restrictions at the organizational unit or account level.
Control Tower Regional Governance: Adjust the settings in AWS Control Tower’s landing zone to include governance for approved regions. This helps in maintaining a standard configuration that aligns with organizational policies regarding AWS regions.
AWS Documentation
Reference: For more information, check the AWS documentation on SCPs and AWS Control Tower:
Service Control Policies
AWS Control Tower.
Question #18
A SysOps administrator is designing a solution for an Amazon RDS for PostgreSQL DB instance. Database credentials must be stored and rotated monthly. The applications that connect to the DB instance send write-intensive traffic with variable client connections that sometimes increase significantly in a short period of time.
Which solution should a SysOps administrator choose to meet these requirements?
- A . Configure AWS Key Management Service (AWS KMS) to automatically rotate the keys for the DB instance. Use RDS Proxy to handle the increases in database connections.
- B . Configure AWS Key Management Service (AWS KMS) to automatically rotate the keys for the DB instance. Use RDS read replicas to handle the increases in database connections.
- C . Configure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS Proxy to handle the increases in database connections.
- D . Configure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS read replicas to handle the increases in database connections.
Correct Answer: C
C
Explanation:
To meet the requirements of storing and rotating database credentials monthly and handling write-intensive traffic with variable client connections, you can use AWS Secrets Manager and Amazon RDS Proxy.
AWS Secrets Manager for Credential Rotation:
Open the AWS Secrets Manager console at AWS Secrets Manager Console.
Store the database credentials as a new secret and configure automatic rotation for every 30 days.
AWS Secrets Manager will handle the rotation process and update the secret with new credentials.
Amazon RDS Proxy for Connection Management:
Open the Amazon RDS console at Amazon RDS Console.
Create an RDS Proxy for the PostgreSQL DB instance.
Configure the proxy to handle the connection pooling and manage the connections efficiently.
The proxy will help manage the database connections, reduce the overhead on the database, and improve performance during peak loads.
This solution ensures that database credentials are securely stored and rotated automatically while handling increased database connections effectively.
Reference: AWS Secrets Manager
Using AWS Secrets Manager to Rotate Amazon RDS Database Credentials
Amazon RDS Proxy
C
Explanation:
To meet the requirements of storing and rotating database credentials monthly and handling write-intensive traffic with variable client connections, you can use AWS Secrets Manager and Amazon RDS Proxy.
AWS Secrets Manager for Credential Rotation:
Open the AWS Secrets Manager console at AWS Secrets Manager Console.
Store the database credentials as a new secret and configure automatic rotation for every 30 days.
AWS Secrets Manager will handle the rotation process and update the secret with new credentials.
Amazon RDS Proxy for Connection Management:
Open the Amazon RDS console at Amazon RDS Console.
Create an RDS Proxy for the PostgreSQL DB instance.
Configure the proxy to handle the connection pooling and manage the connections efficiently.
The proxy will help manage the database connections, reduce the overhead on the database, and improve performance during peak loads.
This solution ensures that database credentials are securely stored and rotated automatically while handling increased database connections effectively.
Reference: AWS Secrets Manager
Using AWS Secrets Manager to Rotate Amazon RDS Database Credentials
Amazon RDS Proxy
Question #18
A SysOps administrator is designing a solution for an Amazon RDS for PostgreSQL DB instance. Database credentials must be stored and rotated monthly. The applications that connect to the DB instance send write-intensive traffic with variable client connections that sometimes increase significantly in a short period of time.
Which solution should a SysOps administrator choose to meet these requirements?
- A . Configure AWS Key Management Service (AWS KMS) to automatically rotate the keys for the DB instance. Use RDS Proxy to handle the increases in database connections.
- B . Configure AWS Key Management Service (AWS KMS) to automatically rotate the keys for the DB instance. Use RDS read replicas to handle the increases in database connections.
- C . Configure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS Proxy to handle the increases in database connections.
- D . Configure AWS Secrets Manager to automatically rotate the credentials for the DB instance. Use RDS read replicas to handle the increases in database connections.
Correct Answer: C
C
Explanation:
To meet the requirements of storing and rotating database credentials monthly and handling write-intensive traffic with variable client connections, you can use AWS Secrets Manager and Amazon RDS Proxy.
AWS Secrets Manager for Credential Rotation:
Open the AWS Secrets Manager console at AWS Secrets Manager Console.
Store the database credentials as a new secret and configure automatic rotation for every 30 days.
AWS Secrets Manager will handle the rotation process and update the secret with new credentials.
Amazon RDS Proxy for Connection Management:
Open the Amazon RDS console at Amazon RDS Console.
Create an RDS Proxy for the PostgreSQL DB instance.
Configure the proxy to handle the connection pooling and manage the connections efficiently.
The proxy will help manage the database connections, reduce the overhead on the database, and improve performance during peak loads.
This solution ensures that database credentials are securely stored and rotated automatically while handling increased database connections effectively.
Reference: AWS Secrets Manager
Using AWS Secrets Manager to Rotate Amazon RDS Database Credentials
Amazon RDS Proxy
C
Explanation:
To meet the requirements of storing and rotating database credentials monthly and handling write-intensive traffic with variable client connections, you can use AWS Secrets Manager and Amazon RDS Proxy.
AWS Secrets Manager for Credential Rotation:
Open the AWS Secrets Manager console at AWS Secrets Manager Console.
Store the database credentials as a new secret and configure automatic rotation for every 30 days.
AWS Secrets Manager will handle the rotation process and update the secret with new credentials.
Amazon RDS Proxy for Connection Management:
Open the Amazon RDS console at Amazon RDS Console.
Create an RDS Proxy for the PostgreSQL DB instance.
Configure the proxy to handle the connection pooling and manage the connections efficiently.
The proxy will help manage the database connections, reduce the overhead on the database, and improve performance during peak loads.
This solution ensures that database credentials are securely stored and rotated automatically while handling increased database connections effectively.
Reference: AWS Secrets Manager
Using AWS Secrets Manager to Rotate Amazon RDS Database Credentials
Amazon RDS Proxy
Question #20
A company’s public website is hosted in an Amazon S3 bucket in the us-east-1 Region behind an Amazon CloudFront distribution. The company wants to ensure that the website is protected from DDoS attacks. A SysOps administrator needs to deploy a solution that gives the company the ability to maintain control over the rate limit at which DDoS protections are applied.
Which solution will meet these requirements?
- A . Deploy a global-scoped AWS WAF web ACL with an allow default action. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the CloudFront distribution.
- B . Deploy an AWS WAF web ACL with an allow default action in us-east-1. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the S3 bucket.
- C . Deploy a global-scoped AWS WAF web ACL with a block default action. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the CloudFront distribution.
- D . Deploy an AWS WAF web ACL with a block default action in us-east-1. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the S3 bucket.
Correct Answer: A
A
Explanation:
AWS WAF (Web Application Firewall) helps protect your web applications from common web exploits and bots. A rate-based rule allows you to control the rate of requests to your application.
Create a Global-Scoped AWS WAF Web ACL:
Navigate to the AWS WAF console.
Create a new Web ACL and choose "Global" for the scope.
Set the default action to "Allow".
Configure a Rate-Based Rule:
Within the Web ACL, add a new rule and select "Rate-based rule".
Define the rate limit (e.g., 2000 requests per 5 minutes).
Set the action to "Block".
Associate Web ACL with CloudFront Distribution:
After creating the Web ACL and rule, go to your CloudFront distribution settings. In the "General" tab, associate the Web ACL with your CloudFront distribution. Review and Confirm:
Review the configuration and ensure the Web ACL is correctly associated with the CloudFront distribution.
Reference: AWS WAF Rate-Based Rules
Associating AWS WAF with CloudFront
A
Explanation:
AWS WAF (Web Application Firewall) helps protect your web applications from common web exploits and bots. A rate-based rule allows you to control the rate of requests to your application.
Create a Global-Scoped AWS WAF Web ACL:
Navigate to the AWS WAF console.
Create a new Web ACL and choose "Global" for the scope.
Set the default action to "Allow".
Configure a Rate-Based Rule:
Within the Web ACL, add a new rule and select "Rate-based rule".
Define the rate limit (e.g., 2000 requests per 5 minutes).
Set the action to "Block".
Associate Web ACL with CloudFront Distribution:
After creating the Web ACL and rule, go to your CloudFront distribution settings. In the "General" tab, associate the Web ACL with your CloudFront distribution. Review and Confirm:
Review the configuration and ensure the Web ACL is correctly associated with the CloudFront distribution.
Reference: AWS WAF Rate-Based Rules
Associating AWS WAF with CloudFront