Question 1

In AWS, which security aspects are the customer's responsibility? (Choose four.)

Accepted Answer

Customers are responsible for managing the security of their EC2 instances, including patch management (B), encrypting EBS volumes (C), managing IAM credentials (D), and configuring Security Groups and ACLs (F). Physical access (A) and decommissioning storage devices (E) are AWS's responsibility.

Question 2

Which services allow the customer to retain run administrative privileges or the underlying EC2 instances? (Choose two.)

Accepted Answer

AWS Elastic Beanstalk and Amazon Elastic Map Reduce allow customers to retain administrative privileges over the underlying EC2 instances, enabling them to manage and configure the instances as needed.

Question 3

Your mission is to create a lights-out datacenter environment, and you plan to use AWS OpsWorks to accomplish this. First you created a stack and added an App Server layer with an instance running in it. Next you added an application to the instance, and now you need to deploy a MySQL RDS database instance. Which of the following answers accurately describe how to add a backend database server to an OpsWorks stack? (Choose three.)

Accepted Answer

OpsWorks allows you to add a database layer and configure it using recipes. The connection details are set using JSON attributes, and a custom recipe can be used to configure the app server to connect to the RDS database.

Question 4

Which method can be used to prevent an IP address block from accessing public objects in an S3 bucket?

Accepted Answer

A bucket policy can be used to define rules that apply to requests for objects in an S3 bucket, including denying access from specific IP address blocks.

Question 5

What would happen to an RDS (Relational Database Service) multi-Availability Zone deployment if the primary DB instance fails?

Accepted Answer

In an RDS multi-AZ deployment, if the primary DB instance fails, the CNAME is automatically switched to point to the standby instance, ensuring minimal downtime.

Question 6

A corporate website is hosted on several Amazon EC2 instances across multiple regions around the globe. How should an Administrator configure the website to maintain high availability with minimal downtime if one of the regions has network connectivity congestion for an extended period of time?

Accepted Answer

The answer of A corporate website is hosted on several...

Question 7

As part of an operational audit, an Administrator is tasked with showing that all security responsibilities under the customer's control are properly executed. Which of the following items is the customer responsible for providing to the auditor? (Choose two.)

Accepted Answer

The answer of As part of an operational audit, an...

Question 8

A company is auditing their infrastructure to obtain a compliance certification. Which of the following options are the company's responsibility within the Shared Responsibility Model? (Choose two.)

Accepted Answer

The answer of A company is auditing their infrastructure to...

Question 9

How can software determine the public and private IP addresses of the Amazon EC2 instance that it is running on?

Accepted Answer

The local instance metadata service provides information about the instance, including its public and private IP addresses. This can be accessed from within the instance itself.

Question 10

Which of the following are the customer's responsibilities, according to the AWS Shared Responsibility Security Model? (Choose two.)

Accepted Answer

Customers are responsible for the security "in" the cloud, which includes configuring operating systems, networks, and firewalls, as well as managing client-side data encryption and data integrity. AWS handles the security "of" the cloud, including infrastructure and physical security.

Question 11

What can an Administrator do to monitor whether an organization's instances are compliant with corporate policies and guidelines?

Accepted Answer

AWS Config allows administrators to set up rules to automatically check the configuration of AWS resources, including instances, to ensure they comply with corporate policies and guidelines.

Question 12

A security policy allows instances in the Production and Development accounts to write application logs to an Amazon S3 bucket belonging to the Security team's account. Only the Security team should be allowed to delete logs from the S3 bucket. Using the "myAppRole" EC2 role, the production and development teams report that the application servers are not able to write to the S3 bucket. Which changes need to be made to the policy to allow the application logs to be written to the S3 bucket? Production Account: 111111111111 Dev Account: 222222222222 Security Account: 555555555555

Accepted Answer

The answer of A security policy allows instances in the...

Question 13

A user has launched a Windows based EC2 instance. However, the instance has some issues and the user wants to check the log. When the user checks the Instance console output from the AWS console, what will it display?

Accepted Answer

The answer of A user has launched a Windows based...

Question 14

A colleague is attempting to launch several new CloudFormation stacks, and receives the following error response:  What should be done to address the error?

Accepted Answer

The answer of A colleague is attempting to launch several...

Question 15

A user needs to put sensitive data in an Amazon S3 bucket that can be accessed through an S3 VPC endpoint only. The user must ensure that resources in the VPC can only access the single S3 bucket. Which combination of actions will meet the requirements? (Choose two.)

Accepted Answer

The answer of A user needs to put sensitive data...

Question 16

Which two steps are required to generate a report detailing specific cost allocation tags when creating a Monthly Cost Allocation report? (Choose two.)

Accepted Answer

The answer of Which two steps are required to generate...

Question 17

A corporate policy requires all new infrastructure deployments to use scalable and reusable resources to improve resources delivery times. The policy also restricts resource configuration management to the systems operations team. The development team requests the ability to deploy resources on demand in an effort to streamline their software development lifecycle. What can the systems operations team do to ensure company policy is followed while also meeting the development team's requests?

Accepted Answer

The answer of A corporate policy requires all new infrastructure...

Question 18

Your organization is preparing for a security assessment of your use of AWS. In preparation for this assessment, which two IAM best practices should you consider implementing? (Choose two.)

Accepted Answer

MFA on the root account and for privileged IAM users, and assigning IAM users and groups configured with policies granting least privilege access are both IAM best practices that should be considered when preparing for a security assessment.

Question 19

How can you secure data at rest on an EBS volume?

Accepted Answer

The answer of How can you secure data at rest...

Question 20

You have a proprietary data store on-premises that must be backed up daily by dumping the data store contents to a single compressed 50GB file and sending the file to AWS. Your SLAs state that any dump file backed up within the past 7 days can be retrieved within 2 hours. Your compliance department has stated that all data must be held indefinitely. The time required to restore the data store from a backup is approximately 1 hour. Your on-premise network connection is capable of sustaining 1gbps to AWS. Which backup methods to AWS would be most cost-effective while still meeting all of your requirements?

Accepted Answer

Transferring the daily backup files to S3 and using lifecycle policies to transition them to Glacier is cost-effective and meets the requirements for retrieval time and indefinite storage.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)