Question 1

A SysOps Administrator must set up notifications for whenever combined billing exceeds a certain threshold for all AWS accounts within a company. The Administrator has set up AWS Organizations and enabled Consolidated Billing. Which additional steps must the Administrator perform to set up the billing alerts?
A) In the payer account: Enable billing alerts in the Billing and Cost Management console; publish an Amazon SNS message when the billing alert triggers.
B) In each account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in Amazon CloudWatch; publish an SNS message when the alarm triggers.
C) In the payer account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in the Billing and Cost Management console to publish an SNS message when the alarm triggers.
D) In the payer account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in Amazon CloudWatch; publish an SNS message when the alarm triggers.

Accepted Answer

The correct approach is to enable billing alerts in the payer account's Billing and Cost Management console, then set up a billing alarm in Amazon CloudWatch to monitor the billing threshold and publish an SNS message when the alarm triggers.

Question 2

A SysOps Administrator at an ecommerce company discovers that several 404 errors are being sent to one IP address every minute. The Administrator suspects a bot is collecting information about products listed on the company's website. Which service should be used to block this suspected malicious activity?
A) AWS CloudTrail
B) Amazon Inspector
C) AWS Shield Standard
D) AWS WAF

Accepted Answer

AWS WAF (Web Application Firewall) can be used to block specific IP addresses and protect web applications from common web exploits, including blocking requests from bots.

Question 3

A Storage team wants all data transfers to an Amazon S3 bucket to remain within the AWS network. The team makes all changes to the AWS network infrastructure manually. An S3 VPC endpoint is created, and an endpoint policy with the proper permissions is set up. However, the application running on Amazon EC2 instances in the VPC is still unable to access the S3 bucket endpoint. What is one cause of this issue?
A) Request metrics for the S3 bucket need to be enabled.
B) S3 access logs need to be disabled for the VPC endpoints to function.
C) The subnet does not have the VPC endpoint as a target in the route table.
D) The EC2 instances need to have an Elastic Network Adapter enabled.

Accepted Answer

The answer of A Storage team wants all data transfers...

Question 4

Two companies will be working on several development projects together. Each company has an AWS account with a single VPC in us-east-1. Two companies would like to access one another's development servers. The IPv4 CIDR blocks in the two VPCs does not overlap. What can the SysOps Administrators for each company do to set up network routing?
A) Each Administrator should create a custom routing table that points to the other company's internet gateway public IP address.
B) Both Administrators should set up a NAT gateway in a public subnet in their respective VPCs. Then. using the public IP address from the NAT gateway, the Administrators should enable routing between the two VPCs.
C) Both Administrators should install a 1 Gbps AWS Direct Connect circuit in their respective environments. Then, using the AWS Management Console, the Administrators should create an AWS Direct Connect routing requests to enable connectivity.
D) One Administrator should create a VPC peering request and send it to the other Administrator's account. Once the other Administrator accepts the request, update the routing tables to enable traffic.

Accepted Answer

VPC peering allows two VPCs to communicate with each other as if they are within the same network, provided their CIDR blocks do not overlap. Once the peering connection is established and accepted, routing tables can be updated to enable traffic between the VPCs.

Question 5

Development teams are maintaining several workloads on AWS. Company management is concerned about rising costs and wants the SysOps Administrator to configure alerts so teams are notified when spending approaches preset limits. Which AWS service will satisfy these requirements?
A) AWS Budgets
B) AWS Cost Explorer
C) AWS Trusted Advisor
D) AWS Cost and Usage report

Accepted Answer

The answer of Development teams are maintaining several workloads on...

Question 6

A company wants to increase the availability and durability of a critical business application. The application currently uses a MySQL database running on an Amazon EC2 instance. The company wants to minimize application changes. How should the company meet these requirements?
A) Shut down the EC2 instance. Enable multi-AZ replication within the EC2 instance, then restart the instance.
B) Launch a secondary EC2 instance running MySQL. Configure a cron job that backs up the database on the primary EC2 instance and copies it to the secondary instance every 30 minutes.
C) Migrate the database to an Amazon RDS Aurora DB instance and create a Read Replica in another Availability Zone.
D) Create an Amazon RDS Microsoft SQL DB instance and enable multi-AZ replication. Back up the existing data and import it into the new database.

Accepted Answer

The answer of A company wants to increase the availability...

Question 7

A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network. What actions should the SysOps Administrator take to meet these requirements?
A) Create a VPC endpoint for the S3 bucket, and create an IAM policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
B) Create a VPC endpoint for the S3 bucket, and create a S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
C) Create a service-linked role for Amazon EC2 that allows the EC2 instances to interact directly with Amazon S3, and attach an IAM policy to the role that allows the EC2 instances full access to the S3 bucket.
D) Create a NAT gateway in the VPC, and modify the VPC route table to route all traffic destined for Amazon S3 through the NAT gateway.

Accepted Answer

Creating a VPC endpoint for the S3 bucket allows traffic to stay within the AWS private network. A bucket policy can then be used to restrict access to the bucket to only traffic coming from the VPC endpoint.

Question 8

A company is planning to deploy multiple ecommerce websites across the eu-west-1, ap-east-1, and us-west-1 Regions. The websites consist of Amazon S3 buckets, Amazon EC2 instances, Amazon RDS databases, and Elastic Load Balancers. Which method will accomplish the deployment with the LEAST amount of effort?
A) Configure deployment automation using AWS OpsWorks
B) Configure S3 cross-Region replication
C) Use AWS CloudFormation stack sets to deploy the application
D) Use AWS Elastic Beanstalk to deploy the application

Accepted Answer

AWS CloudFormation stack sets allow you to deploy and manage resources across multiple AWS accounts and regions with a single operation, making it the most efficient method for deploying resources across multiple regions with minimal effort.

Question 9

A developer is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) and notices that the application is not receiving all the expected elements from HTTP requests. The developer suspects users are not sending the correct query string. How should a sysops administrator verify this?
A) Monitor the ALB default Amazon CloudWatch metrics. Verify that the requests contain the expected query string.
B) ?onfigure the ALB to store access logs within Amazon S3. Verify that log entries contain the expected query string.
C) Open the ALB logs in Amazon CloudWatch. Verify that requests contain the expected query string.
D) Create a custom Amazon CloudWatch metric to store requests. Verify that the metric contains the expected query string.

Accepted Answer

The answer of A developer is deploying a web application...

Question 10

An application is being migrated to AWS with the requirement that archived data be retained for at least 7 years. What Amazon Glacier configuration option should be used to meet this compliance requirement?
A) A Glacier data retrieval policy
B) A Glacier vault access policy
C) A Glacier vault lock policy
D) A Glacier vault notification

Accepted Answer

A Glacier vault lock policy can be used to enforce compliance controls, such as retention periods, ensuring that archived data is retained for a specified duration, like 7 years, without being deleted.

Question 11

A SysOps Administrator has created a new Amazon S3 bucket named mybucket for the Operations team. Members of the team are part of an IAM group to which the following IAM policy has been assigned:  Which of the following actions will be allowed on the bucket? (Choose two.)
A) Get the bucket's region.
B) Delete an object.
C) Delete the bucket.
D) Download an object.
E) List all the buckets in the account.

Accepted Answer

The answer of A SysOps Administrator has created a new...

Question 12

An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group that terminates unhealthy instances. The Auto Scaling group is configured to determine the health status of EC2 instances using both EC2 status checks and ALB health checks. The Development team wants to analyze the unhealthy instances before termination. What should the SysOps Administrator do to accomplish this?
A) Configure the ALB health check to restart instances instead of terminating them.
B) Configure an AWS Lambda function to take a snapshot of all instances before they are terminated.
C) Implement Amazon CloudWatch Events to capture lifecycle events and trigger an AWS Lambda function for remediation.
D) Use an Amazon EC2 Auto Scaling lifecycle hook to pause instance termination after the instance has been removed from service.

Accepted Answer

Using an Amazon EC2 Auto Scaling lifecycle hook allows you to pause the termination process, giving you time to analyze the instance before it is terminated.

Question 13

A sysops administrator has an AWS Lambda function that performs maintenance on various AWS resources. This function must be run nightly. Which is the MOST cost-effective solution?
A) Launch a single t2.nano Amazon EC2 instance and create a Linux cron job to invoke the Lambda function at the same time every night.
B) Set up an Amazon CloudWatch metrics alarm to invoke the Lambda function at the same time every night.
C) Schedule a CloudWatch event to invoke the Lambda function at the same time every night.
D) Implement a Chef recipe in AWS OpsWorks stack to invoke the Lambda function at the same time every night.

Accepted Answer

Scheduling a CloudWatch event to invoke the Lambda function is the most cost-effective and serverless solution, as it does not require running additional infrastructure like EC2 instances or OpsWorks stacks.

Question 14

A SysOps Administrator is receiving alerts related to high CPU utilization of a Memcached-based Amazon ElastiCache cluster. Which remediation steps should be taken to resolve this issue? (Choose two.)
A) Add a larger Amazon EBS volume to the ElastiCache cluster nodes
B) Add a load balancer to route traffic to the ElastiCache cluster
C) Add additional worker nodes to the ElastiCache cluster
D) Create an Auto Scaling group for the ElastiCache cluster
E) Vertically scale the ElastiCache cluster by changing the node type

Accepted Answer

The answer of A SysOps Administrator is receiving alerts related...

Question 15

An Amazon EC2 instance in a private subnet needs to copy data to an Amazon S3 bucket. For security reasons, the connection from the EC2 instance to Amazon S3 must not traverse across the Internet. What action should the SysOps Administrator take to accomplish this?
A) Create a NAT instance and route traffic destined to Amazon S3 through it.
B) Create a VPN connection between the EC2 instance and Amazon S3.
C) Create an S3 VPC endpoint in the VPC where the EC2 instance resides.
D) Use AWS Direct Connect to maximize throughput and keep the traffic private.

Accepted Answer

The answer of An Amazon EC2 instance in a private...

Question 16

An application running on Amazon EC2 needs login credentials to access a database. The login credentials are stored in AWS Systems Manager Parameter Store as secure string parameters. What is the MOST secure way to grant the application access to the credentials?
A) Create an IAM EC2 role for the EC2 instances and grant the role permission to read the Systems Manager parameters
B) Create an IAM group for the application and grant the group permissions to read the Systems Manager parameters
C) Create an IAM policy for the application and grant the policy permission to read the Systems Manager parameters
D) Create an IAM user for the application and grant the user permission to read the Systems Manager parameters

Accepted Answer

The answer of An application running on Amazon EC2 needs...

Question 17

A VPC is connected to a company data center by a VPN. An Amazon EC2 instance with the IP address 172.31.16.139 is within a private subnet of the VPC. A SysOps Administrator issued a ping command to the EC2 instance from an on-premises computer with the IP address 203.0.113.12 and did not receive an acknowledgment. VPC Flow Logs were enabled and showed the following:  What action will resolve the issue?
A) Modify the EC2 security group rules to allow inbound traffic from the on-premises computer
B) Modify the EC2 security group rules to allow outbound traffic to the on-premises computer
C) Modify the VPC network ACL rules to allow inbound traffic from the on-premises computer
D) Modify the VPC network ACL rules to allow outbound traffic to the on-premises computer

Accepted Answer

The answer of A VPC is connected to a company...

Question 18

A company's Marketing department generates gigabytes of assets each day and stores them locally. They would like to protect the files by backing them up to AWS. All the assets should be stored on the cloud, but the most recent assets should be available locally for low latency access. Which AWS service meets the requirements?
A) Amazon EBS
B) Amazon EFS
C) Amazon S3
D) AWS Storage Gateway

Accepted Answer

AWS Storage Gateway allows for seamless integration between on-premises environments and AWS cloud storage, enabling local caching of frequently accessed data while backing up all data to AWS.

Question 19

A Security and Compliance team is reviewing Amazon EC2 workloads for unapproved AMI usage. Which action should a SysOps Administrator recommend?
A) Create a custom report using AWS Systems Manager Inventory to identify unapproved AMIs
B) Run Amazon Inspector on all EC2 instances and flag instances using unapproved AMIs
C) Use an AWS Config rule to identify unapproved AMIs
D) Use AWS Trusted Advisor to identify EC2 workloads using unapproved AMIs

Accepted Answer

AWS Config can be used to create rules that check for compliance, such as identifying EC2 instances that are using unapproved AMIs.

Question 20

A SysOps Administrator observes a large number of rogue HTTP requests on an Application Load Balancer (ALB). The requests originate from various IP addresses. Which action should be taken to block this traffic?
A) Use Amazon CloudFront to cache the traffic and block access to the web servers
B) Use Amazon GuardDuty to protect the web servers from bots and scrapers
C) Use AWS Lambda to analyze the web server logs, detect bot traffic, and block the IP address in the security groups
D) Use AWS WAF rate-based blacklisting to block this traffic when it exceeds a defined threshold

Accepted Answer

AWS WAF rate-based blacklisting allows you to automatically block IP addresses that exceed a certain request threshold, effectively mitigating rogue HTTP requests.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)

Development teams are maintaining several workloads on AWS. Company management is concerned about rising costs and wants the SysOps Administrator to configure alerts so teams are notified when spending approaches preset limits. Which AWS service will satisfy these requirements?

A company wants to increase the availability and durability of a critical business application. The application currently uses a MySQL database running on an Amazon EC2 instance. The company wants to minimize application changes. How should the company meet these requirements?

A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network. What actions should the SysOps Administrator take to meet these requirements?

An application is being migrated to AWS with the requirement that archived data be retained for at least 7 years. What Amazon Glacier configuration option should be used to meet this compliance requirement?

A SysOps Administrator has created a new Amazon S3 bucket named mybucket for the Operations team. Members of the team are part of an IAM group to which the following IAM policy has been assigned: Which of the following actions will be allowed on the bucket? (Choose two.)

A sysops administrator has an AWS Lambda function that performs maintenance on various AWS resources. This function must be run nightly. Which is the MOST cost-effective solution?

A SysOps Administrator is receiving alerts related to high CPU utilization of a Memcached-based Amazon ElastiCache cluster. Which remediation steps should be taken to resolve this issue? (Choose two.)

An Amazon EC2 instance in a private subnet needs to copy data to an Amazon S3 bucket. For security reasons, the connection from the EC2 instance to Amazon S3 must not traverse across the Internet. What action should the SysOps Administrator take to accomplish this?

An application running on Amazon EC2 needs login credentials to access a database. The login credentials are stored in AWS Systems Manager Parameter Store as secure string parameters. What is the MOST secure way to grant the application access to the credentials?

A Security and Compliance team is reviewing Amazon EC2 workloads for unapproved AMI usage. Which action should a SysOps Administrator recommend?

A SysOps Administrator observes a large number of rogue HTTP requests on an Application Load Balancer (ALB) . The requests originate from various IP addresses. Which action should be taken to block this traffic?