Free Amazon SOA-C02 Practice Exams - Page 27 of 48

Question #261

A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct IAM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket.

Which action will solve this problem while adhering to least privilege access?

A . Add a bucket policy to the S3 bucket permitting access from the IAM role.
B . Attach an S3 gateway endpoint to the VPC. Configure the route table for the private subnet.
C . Configure the route table to allow the instances on the private subnet access through the internet gateway.
D . Create a NAT gateway in a private subnet and configure the route table for the private subnets.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Technology to use is a VPC endpoint – "A VPC endpoint enables private connections between your VPC and supported AWS services and VPC endpoint services powered by AWS PrivateLink. AWS PrivateLink is a technology that enables you to privately access services by using private IP addresses. Traffic between your VPC and the other service does not leave the Amazon network." S3 is an example of a gateway endpoint. We want to see services in AWS while not leaving the VPC.

Question #262

The company needs a shared file solution for EC2 Windows instances in a Multi-AZ deployment that uses native Windows storage capabilities and maximizes consistency.

A . Create an Amazon FSx for Windows File Server Multi-AZ file system. Map file shares on the instances by using the file system’s DNS name.
B . Grant the instances access to a shared Amazon S3 bucket. Use Windows Task Scheduler to synchronize the contents of the S3 bucket locally to each instance periodically.
C . Create an Amazon Elastic File System (Amazon EFS) file system that uses the EFS Standard storage class. Mount the file system to the instances by using the file system’s DNS name and the EFS mount helper.
D . Create a new Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume. Attach the EBS volume as an additional drive to each instance.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Amazon FSx for Windows File Server provides a fully managed, highly available, and native Windows file system compatible with the SMB protocol, ideal for Windows workloads requiring shared access.

Multi-AZ File System: Ensures high availability across multiple Availability Zones.

Native Windows Capabilities: Allows instances to map file shares and access files using Windows storage features, offering strong consistency and performance for shared files.

Other options, like Amazon S3 and Amazon EFS, either lack native Windows integration or do not offer the desired consistency and high availability for shared file systems in a Windows environment.

Question #263

A SysOps administrator receives notification that an application that is running on Amazon EC2 instances has failed to authenticate to an Amazon RDS database. To troubleshoot, the SysOps administrator needs to investigate AWS Secrets Manager password rotation

Which Amazon CloudWatch log will provide insight into the password rotation?

A . AWS CloudTrail logs
B . EC2 instance application logs
C . AWS Lambda function logs
D . RDS database logs

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

To investigate AWS Secrets Manager password rotation and troubleshoot the authentication failure of an application running on Amazon EC2 instances, you should check the AWS Lambda function logs responsible for the password rotation.

Understand Secrets Manager Password Rotation:

AWS Secrets Manager can automatically rotate secrets according to a specified rotation schedule using an AWS Lambda function.

Reference: Rotate AWS Secrets Manager secrets

Identify the Lambda Function:

Locate the Lambda function configured for password rotation in the AWS Secrets Manager console.

Reference: Managing Lambda Rotation Function

Access CloudWatch Logs:

Navigate to the CloudWatch console.

Select "Logs" and find the log group associated with the Lambda function responsible for password rotation.

Review the logs for any errors or issues related to the password rotation process.

Reference: Logging AWS Lambda function activity with Amazon CloudWatch Logs

By checking the AWS Lambda function logs, you can gain insights into any issues or errors that occurred during the password rotation process, helping to troubleshoot the authentication failure.

Question #263

A SysOps administrator receives notification that an application that is running on Amazon EC2 instances has failed to authenticate to an Amazon RDS database. To troubleshoot, the SysOps administrator needs to investigate AWS Secrets Manager password rotation

Which Amazon CloudWatch log will provide insight into the password rotation?

A . AWS CloudTrail logs
B . EC2 instance application logs
C . AWS Lambda function logs
D . RDS database logs

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

To investigate AWS Secrets Manager password rotation and troubleshoot the authentication failure of an application running on Amazon EC2 instances, you should check the AWS Lambda function logs responsible for the password rotation.

Understand Secrets Manager Password Rotation:

AWS Secrets Manager can automatically rotate secrets according to a specified rotation schedule using an AWS Lambda function.

Reference: Rotate AWS Secrets Manager secrets

Identify the Lambda Function:

Locate the Lambda function configured for password rotation in the AWS Secrets Manager console.

Reference: Managing Lambda Rotation Function

Access CloudWatch Logs:

Navigate to the CloudWatch console.

Select "Logs" and find the log group associated with the Lambda function responsible for password rotation.

Review the logs for any errors or issues related to the password rotation process.

Reference: Logging AWS Lambda function activity with Amazon CloudWatch Logs

By checking the AWS Lambda function logs, you can gain insights into any issues or errors that occurred during the password rotation process, helping to troubleshoot the authentication failure.

Question #265

A company is using an Amazon DynamoDB table for data. A SysOps administrator must configure replication of the table to another AWS Region for disaster recovery.

What should the SysOps administrator do to meet this requirement?

A . Enable DynamoDB Accelerator (DAX).
B . Enable DynamoDB Streams, and add a global secondary index (GSI).
C . Enable DynamoDB Streams, and-add a global table Region.
D . Enable point-in-time recovery.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

To configure replication of a DynamoDB table to another AWS Region for disaster recovery, you should use DynamoDB Global Tables. Global Tables use DynamoDB Streams to replicate changes across multiple regions.

Enable DynamoDB Streams:

Navigate to the DynamoDB console.

Select your table and enable DynamoDB Streams.

Add a Global Table Region:

With Streams enabled, go to the Global Tables tab.

Add a new region to the table, specifying the region where you want to replicate the data.

Automatic Replication:

DynamoDB will handle the replication of data across regions automatically, ensuring data consistency and high availability.

Reference: DynamoDB Global Tables

Enabling DynamoDB Streams

Question #265

A company is using an Amazon DynamoDB table for data. A SysOps administrator must configure replication of the table to another AWS Region for disaster recovery.

What should the SysOps administrator do to meet this requirement?

A . Enable DynamoDB Accelerator (DAX).
B . Enable DynamoDB Streams, and add a global secondary index (GSI).
C . Enable DynamoDB Streams, and-add a global table Region.
D . Enable point-in-time recovery.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

To configure replication of a DynamoDB table to another AWS Region for disaster recovery, you should use DynamoDB Global Tables. Global Tables use DynamoDB Streams to replicate changes across multiple regions.

Enable DynamoDB Streams:

Navigate to the DynamoDB console.

Select your table and enable DynamoDB Streams.

Add a Global Table Region:

With Streams enabled, go to the Global Tables tab.

Add a new region to the table, specifying the region where you want to replicate the data.

Automatic Replication:

DynamoDB will handle the replication of data across regions automatically, ensuring data consistency and high availability.

Reference: DynamoDB Global Tables

Enabling DynamoDB Streams

Question #267

A company has an Auto Scaling group of Amazon EC2 instances that scale based on average CPU utilization. The Auto Scaling group events log indicates an InsufficientlnstanceCapacity error.

Which actions should a SysOps administrator take to remediate this issue? (Select TWO.

A . Change the instance type that the company is using.
B . Configure the Auto Scaling group in different Availability Zones.
C . Configure the Auto Scaling group to use different Amazon Elastic Block Store (Amazon EBS) volume sizes.
D . Increase the maximum size of the Auto Scaling group.
E . Request an increase in the instance service quota.

Reveal Solution Hide Solution

Correct Answer: AB
AB

Explanation:

To remediate the InsufficientInstanceCapacity error when scaling the Auto Scaling group, the SysOps administrator can take the following actions:

Change the Instance Type:

Insufficient capacity errors can occur if there is not enough available capacity for the specified instance type in the selected Availability Zone.

Changing to a different instance type might resolve the capacity issue.

Reference: EC2 Instance Types

Configure the Auto Scaling Group in Different Availability Zones:

Distributing instances across multiple Availability Zones can help mitigate capacity constraints in a single zone.

Update the Auto Scaling group configuration to include multiple Availability Zones.

Reference: Distributing Auto Scaling Instances Across Multiple Availability Zones

By changing the instance type and configuring the Auto Scaling group to use multiple Availability Zones, the SysOps administrator can address the capacity issues and ensure that the Auto Scaling group can scale as needed.

Question #268

A compliance learn requites all administrator passwords for Amazon RDS DB instances to be changed at least annually.

Which solution meets this requirement in the MOST operationally efficient manner?

A . Store the database credentials in AWS Secrets Manager. Configure automatic rotation for the secret every 365 days.
B . Store the database credentials as a parameter In the RDS parameter group. Create a database trigger to rotate the password every 365 days.
C . Store the database credentials in a private Amazon S3 bucket. Schedule an AWS Lambda function to generate a new set of credentials every 365 days.
D . Store the database credentials in AWS Systems Manager Parameter Store as a secure string parameter. Configure automatic rotation for the parameter every 365 days.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The most operationally efficient solution to ensure that administrator passwords for Amazon RDS DB instances are changed at least annually is to use AWS Secrets Manager with automatic rotation.

AWS Secrets Manager:

AWS Secrets Manager helps you protect access to your applications, services, and IT resources without the upfront cost and complexity of managing your own hardware security infrastructure.

Secrets Manager enables you to rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.

Configure Automatic Rotation:

Store the database credentials in AWS Secrets Manager.

Configure the secret to rotate automatically every 365 days.

AWS Secrets Manager provides built-in integration for rotating credentials for supported databases,

including Amazon RDS.

Steps to Configure:

Open the Secrets Manager console.

Create a new secret and provide the necessary database credentials.

Enable automatic rotation and set the rotation interval to 365 days.

Secrets Manager will handle the rotation process, updating the credentials in the database and ensuring they are securely stored.

Reference: AWS Secrets Manager

Rotating Your AWS Secrets Manager Secrets

Question #269

A SysOps administrator noticed that a large number of Elastic IP addresses are being created on the company’s AWS account, but they are not being associated with Amazon EC2 instances, and are incurring Elastic IP address charges in the monthly bill.

How can the administrator identify who is creating the Elastic IP addresses?

A . Attach a cost-allocation tag to each requested Elastic IP address with the IAM user name of the developer who creates it.
B . Query AWS CloudTrail logs by using Amazon Athena to search for Elastic IP address events.
C . Create a CloudWatch alarm on the ElPCreated metric and send an Amazon SNS notification when the alarm triggers.
D . Use Amazon Inspector to get a report of all Elastic IP addresses created in the last 30 days.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

To identify who is creating the Elastic IP addresses, the following steps should be taken:

Enable CloudTrail Logging:

Ensure AWS CloudTrail is enabled to log all API activities in your AWS account.

Reference: Setting Up AWS CloudTrail

Create an Athena Table for CloudTrail Logs:

Set up an Athena table that points to the S3 bucket where CloudTrail logs are stored.

Reference: Creating Tables in Athena

Query CloudTrail Logs:

Use Athena to run SQL queries to search for AllocateAddress events, which represent the creation of Elastic IP addresses.

Example Query:

sql

Copy code

SELECT userIdentity.userName, eventTime, eventSource, eventName, requestParameters FROM cloudtrail_logs

WHERE eventName = ‘AllocateAddress’;

Reference: Analyzing AWS CloudTrail Logs

Review Results:

Review the results to identify which IAM user or role is creating the Elastic IP addresses.

Reference: AWS CloudTrail Log Analysis

Question #270

A SysOps administrator is helping a development team deploy an application to AWS Trie AWS CloudFormat on temp ate includes an Amazon Linux EC2 Instance an Amazon Aurora DB cluster and a hard coded database password that must be rotated every 90 days

What is the MOST secure way to manage the database password?

A . Use the AWS SecretsManager Secret resource with the GenerateSecretString property to automatically generate a password Use the AWS SecretsManager RotationSchedule resource lo define a rotation schedule lor the password Configure the application to retrieve the secret from AWS Secrets Manager access the database
B . Use me AWS SecretsManager Secret resource with the SecretStrmg property Accept a password as a CloudFormation parameter Use the AllowedPatteen property of the CloudFormaton parameter to require e minimum length, uppercase and lowercase letters and special characters Configure me application to retrieve the secret from AWS Secrets Manager to access the database
C . Use the AWS SSM Parameter resource Accept input as a Qoudformatton parameter to store the parameter as a secure sting Configure the application to retrieve the parameter from AWS Systems Manager Parameter Store to access the database
D . Use the AWS SSM Parameter resource Accept input as a Cloudf ormetton parameter to store the parameter as a string Configure the application to retrieve the parameter from AWS Systems Manager Parameter Store to access the database

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Step-by-Step

Understand the Problem:

Manage a database password securely and rotate it every 90 days.

Analyze the Requirements:

Ensure secure management and automatic rotation of the database password. Minimize manual intervention and risk of exposing the password.

Evaluate the Options:

Option A: Use the AWS SecretsManager Secret resource with the GenerateSecretString property.

Secrets Manager can automatically generate a strong password.

The RotationSchedule resource defines a rotation schedule to rotate the password every 90 days.

Option B: Use the AWS SecretsManager Secret resource with the SecretString property.

Requires accepting a password as a CloudFormation parameter and does not automate password generation.

Option C: Use the AWS SSM Parameter resource.

AWS Systems Manager Parameter Store can store secure strings, but it does not support automatic rotation.

Option D: Use the AWS SSM Parameter resource without secure string.

This option does not offer the security of Secrets Manager and does not support automatic rotation.

Select the Best Solution:

Option A: Using AWS Secrets Manager with the GenerateSecretString property and RotationSchedule resource ensures secure management and automatic rotation of the database password.

Reference: AWS Secrets Manager

Rotate AWS Secrets Manager Secrets

AWS Secrets Manager provides secure storage, automatic rotation, and seamless integration with applications for accessing secrets.