Question 1

A company requires that all access from on-premises applications to AWS services go over its AWS Direct Connect connection rather than the public internet. How would a SysOps Administrator implement this requirement?
A) Implement an IAM policy that uses the aws:sourceConnection condition to allow access from the AWS Direct Connect connection ID only Implement an IAM policy that uses the aws:sourceConnection condition to allow access from the AWS Direct Connect connection ID only
B) Set up a public virtual interface on the AWS Direct Connect connection
C) Configure AWS Shield to protect the AWS Management Console from being accessed by IP addresses other than those within the data center ranges
D) Update all the VPC network ACLs to allow access from the data center IP ranges

Accepted Answer

The answer of A company requires that all access from...

Question 2

A SysOps Administrator using AWS KMS needs to rotate all customer master keys (CMKs) every week to meet Information Security guidelines. Which option would meet the requirement?
A) Create a new CMK every 7 days to manually rotate the encryption keys.
B) Enable key rotation on the CMKs and set the rotation period to 7 days.
C) Switch to using AWS CloudHSM as AWS KMS does not support key rotation.
D) Use data keys for each encryption task to avoid the need to rotate keys.

Accepted Answer

AWS KMS does not support automatic rotation of CMKs every 7 days. The administrator would need to manually create a new CMK every 7 days to meet the requirement.

Question 3

The Security team at AnyCompany discovers that some employees have been using individual AWS accounts that are not under the control of AnyCompany. The team has requested that those individual accounts be linked to the central organization using AWS Organizations. Which action should a SysOps Administrator take to accomplish this?
A) Add each existing account to the central organization using AWS IAM.
B) Create a new organization in each account and join them to the central organization.
C) Log in to each existing account an add them to the central organization.
D) Send each existing account an invitation from the central organization.

Accepted Answer

The answer of The Security team at AnyCompany discovers that...

Question 4

A company has attached the following policy to an IAM user.  Which of the following actions are allowed for the IAM user?
A) Amazon RDS DescribeDBInstances action in the us-east-1 Region Amazon RDS DescribeDBInstances action in the us-east-1 Region
B) Amazon S3 PutObject operation in a bucket named testbucket Amazon S3 PutObject operation in a bucket named testbucket
C) Amazon EC2 DescribeInstances action in the us-east-1 Region Amazon EC2 DescribeInstances action in the us-east-1 Region
D) Amazon EC2 AttachNetworkInterface action in the eu-west-1 Region AttachNetworkInterface action in the eu-west-1 Region

Accepted Answer

The answer of A company has attached the following policy...

Question 5

A company recently performed a security audit of all its internal applications developed in house. Certain business-critical applications that handle sensitive data were flagged because they use Amazon ES clusters that are open for read/write to a wider user group that intended. Who is responsible for correcting the issue?
A) AWS Premium Support
B) the Amazon ES team
C) the AWS IAM team
D) a SysOps Administrator

Accepted Answer

The answer of A company recently performed a security audit...

Question 6

An organization is measuring the latency of an application every minute and storing data inside a file in the JSON format. The organization wants to send all latency data to AWS CloudWatch. How can the organization achieve this?
A) The user has to parse the file before uploading data to CloudWatch
B) It is not possible to upload the custom data to CloudWatch
C) The user can supply the file as an input to the CloudWatch command
D) The user can use the CloudWatch Import command to import data from the file to CloudWatch

Accepted Answer

The user can use the AWS CLI or SDKs to supply the JSON file as input to the CloudWatch command to publish custom metrics.

Question 7

A user is trying to create a PIOPS EBS volume with 4000 IOPS and 100 GB size. AWS does not allow the user to create this volume. What is the possible root cause for this?
A) The ratio between IOPS and the EBS volume is higher than 30
B) The maximum IOPS supported by EBS is 3000
C) The ratio between IOPS and the EBS volume is lower than 50
D) PIOPS is supported for EBS higher than 500 GB size

Accepted Answer

The ratio between IOPS and the EBS volume size must be at least 50:1. For 4000 IOPS, the minimum volume size should be 80 GB (4000/50), so the size is not the issue. However, the ratio is higher than 30:1, which is not a valid constraint.

Question 8

A company runs a web application that users access using the domain name www.example.com. The company manages the domain name using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application though CloudFront. What is the MOST cost-effective way to achieve this?
A) Create a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL.
B) Create an ALIAS record in Amazon Route 53 that points to the CloudFront distribution URL.
C) Create an A record in Amazon Route 53 that points to the public IP address of the web application.
D) Create a PTR record in Amazon Route 53 that points to the public IP address of the web application.

Accepted Answer

An ALIAS record in Amazon Route 53 is the most cost-effective and efficient way to point a domain name to a CloudFront distribution, as it allows for seamless integration with AWS services without incurring additional DNS query charges.

Question 9

A SysOps Administrator must generate a report that provides a breakdown of all API activity by a specific user the course of a year. Given that AWS Cloud Trail was enabled, how can this report be generated?
A) Using the AWS management Console, search for the user name in the CloudTrail history. Then filter by API and download the report in CSV format.
B) Use the CloudTrail digest files stored in the company's Amazon S3 bucket. then send the logs to Amazon QuickSight to create the report.
C) Locate the monthly reports that CloudTrail sends that are emailed to the account's root user. Then forward the reports to the auditor using a secure channel.
D) Access the CloudTrail logs stored in the Amazon S3 bucket tied to Cloud Trail. Use Amazon Athena to extract the information needed to generate the report.

Accepted Answer

CloudTrail logs are stored in an S3 bucket, and Amazon Athena can be used to query these logs to extract specific information, such as API activity by a specific user.

Question 10

How often is metric data is sent to CloudWatch when detailed monitoring is enabled on an Amazon EC2 instance?
A) Every 30 seconds
B) Every 5 minutes
C) Every 15 minutes
D) Every minute

Accepted Answer

When detailed monitoring is enabled on an Amazon EC2 instance, metric data is sent to CloudWatch every minute.

Question 11

Malicious traffic is reaching company web servers from a single IP address located in another country. The SysOps Administrator is tasked with blocking this IP address. How should the Administrator implement the restriction?
A) Edit the security group for the web servers and add a deny entry for the IP address
B) Edit the network access control list for the web server subnet and add a deny entry for the IP address
C) Edit the VPC route table to route the malicious IP address to a black hole
D) Use Amazon CloudFront's geo restriction feature to block traffic from the IP address

Accepted Answer

The answer of Malicious traffic is reaching company web servers...

Question 12

A company's IT department noticed an increase in the spend of their Developer AWS account. There are over 50 Developers using the account, and the Finance team wants to determine the service costs incurred by each Developer. What should a SysOps Administrator do to collect this information? (Choose two.)
A) Activate the createdBy tag in the account
B) Activate the usage with Amazon CloudWatch dashboards
C) Analyze the usage with Cost Explorer
D) Configure AWS Trusted Advisor to track resource usage
E) Create a billing alarm in AWS Budgets

Accepted Answer

The answer of A company's IT department noticed an increase...

Question 13

An Application performs read-heavy operations on an Amazon Aurora DB instance. The SysOps Administrator monitors the CPUUtilization CloudWatch metric and has recently seen it increase to 90%. The Administrator would like to understand what is driving the CPU surge. Which of the following should be Administrator additionally monitor to understand the CPU surge?
A) FreeableMemory and DatabaseConnections to understand the amount of available RAM and number of connections to DB instance.
B) FreeableMemory and EngineUptime to understand the amount of available RAM and the amount of time the instance has been up and running.
C) DatabaseConnections and AuroraReplicaLag for the number of connections to the DB instance and the amount of lag when replicating updates from the primary instance.
D) DatabaseConnections and InsertLatency for the number of connections to the DB instance and latency for insert queries.

Accepted Answer

The answer of An Application performs read-heavy operations on an...

Question 14

A user had aggregated the CloudWatch metric data on the AMI ID. The user observed some abnormal behavior of the CPU utilization metric while viewing the last 2 weeks of data. The user wants to share that data with his manager. How can the user achieve this easily with the AWS console?
A) The user can use the copy URL functionality of CloudWatch to share the exact details
B) The user can use the export data option from the CloudWatch console to export the current data point
C) The user has to find the period and data and provide all the aggregation information to the manager
D) The user can use the CloudWatch data copy functionality to copy the current data points

Accepted Answer

The user can use the copy URL functionality of CloudWatch to share the exact details with the manager.

Question 15

A company runs an application that uses Amazon RDS for MySQL. During load testing of equivalent production volumes, the Development team noticed a significant increase in query latency. A SysOps Administrator concludes from investigating Amazon CloudWatch Logs that the CPU utilization on the RDS MySQL instance was at 100%. Which action will resolve this issue?
A) Configure AWS Database Migration Service (AWS DMS) to allow Amazon RDS for MySQL to scale and accept more requests.
B) Configure RDS for MySQL to scale horizontally by adding additional nodes to offload write requests.
C) Enable the Multi-AZ feature for the RDS instance.
D) Modify the RDS MySQL instance so it is a larger instance type.

Accepted Answer

Increasing the instance size will provide more CPU and memory resources, which can help handle the increased load and reduce query latency.

Question 16

A company's website went down for several hours. The root cause was a full disk on one of the company's Amazon EC2 instances. Which steps should the SysOps Administrator take to prevent this from happening in the future?
A) Configure Amazon CloudWatch Events to filter and forward AWS Health events for disk space utilization to an Amazon SNS topic to notify the Administrator.
B) Create an AWS Lambda function to describe the volume status for each EC2 instance. Post a notification to an Amazon SNS topic when a volume status is impaired.
C) Enable detailed monitoring for the EC2 instances. Create an Amazon CloudWatch alarm to notify the Administrator when disk space is running low.
D) Use the Amazon CloudWatch agent on the EC2 instances to collect disk metrics. Create a CloudWatch alarm to notify the Administrator when disk space is running low.

Accepted Answer

The answer of A company's website went down for several...

Question 17

A company needs to have real-time access to image data while seamlessly maintaining a copy of the images in an offsite location for disaster recovery purposes. Which solution meets the requirement?
A) Create an AWS Storage Gateway volume gateway configured as a stored volume. Mount it from clients using Internet Small Computer System Interface (iSCSI).
B) Mount an Amazon EFS volume on a local server. Share this volume with employees who need access to the images.
C) Store the images in Amazon S3, and use AWS Data Pipeline to allow for caching of S3 data on local workstations.
D) Use Amazon S3 for file storage, and enable S3 Transfer Acceleration to maintain a cache for frequently used files to increase local performance.

Accepted Answer

Amazon S3 provides scalable storage, and S3 Transfer Acceleration can speed up access to frequently used files, making it suitable for real-time access and offsite disaster recovery.

Question 18

A SysOps Administrator is receiving alerts related to high CPU utilization of a Memcached-based Amazon ElastiCache cluster. Which remediation steps should be taken to resolve this issue? (Choose two.)
A) Add a larger Amazon EBS volume to the ElastiCache cluster nodes
B) Add a load balancer to route traffic to the ElastiCache cluster
C) Add additional worker nodes to the ElastiCache cluster
D) Create an Auto Scaling group to the ElastiCache cluster
E) Vertically scale the ElastiCache cluster by changing the node type

Accepted Answer

The answer of A SysOps Administrator is receiving alerts related...

Question 19

A company has deployed a new application running on Amazon EC2 instances. The application team must verify for the Security team that all common vulnerabilities and exposures have been addressed, both now and regularly throughout the application's lifespan. How can the Application team satisfy the Security team's requirement?
A) Perform regular assessments with Amazon Inspector
B) Perform regular assessments with AWS Trusted Advisor
C) Integrate AWS Personal Health Dashboard with Amazon CloudWatch events to get security notifications
D) Grant the Administrator and Security team access to AWS Artifact

Accepted Answer

Amazon Inspector is a security assessment service that helps identify vulnerabilities and exposures in applications running on Amazon EC2 instances. Regular assessments with Amazon Inspector can help ensure that vulnerabilities are addressed throughout the application's lifespan.

Question 20

A SysOps Administrator needs to control access to groups of Amazon EC2 instances. Specific tags on the EC2 instances have already been added. Which additional actions should the Administrator take to control access? (Choose two.)
A) Attach an IAM policy to the users or groups that require access to the EC2 instances.
B) Attach an IAM role to control access to the EC2 instances.
C) Create a placement group for the EC2 instances and add a specific tag.
D) Create a service account and attach it to the EC2 instances that need to be controlled.
E) Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element. Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element.

Accepted Answer

Attaching an IAM policy to the users or groups that require access to the EC2 instances and creating an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element are both valid ways to control access to groups of Amazon EC2 instances.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)

A company requires that all access from on-premises applications to AWS services go over its AWS Direct Connect connection rather than the public internet. How would a SysOps Administrator implement this requirement?

A SysOps Administrator using AWS KMS needs to rotate all customer master keys (CMKs) every week to meet Information Security guidelines. Which option would meet the requirement?

A company has attached the following policy to an IAM user. Which of the following actions are allowed for the IAM user?

An organization is measuring the latency of an application every minute and storing data inside a file in the JSON format. The organization wants to send all latency data to AWS CloudWatch. How can the organization achieve this?

A user is trying to create a PIOPS EBS volume with 4000 IOPS and 100 GB size. AWS does not allow the user to create this volume. What is the possible root cause for this?

A SysOps Administrator must generate a report that provides a breakdown of all API activity by a specific user the course of a year. Given that AWS Cloud Trail was enabled, how can this report be generated?

How often is metric data is sent to CloudWatch when detailed monitoring is enabled on an Amazon EC2 instance?

Malicious traffic is reaching company web servers from a single IP address located in another country. The SysOps Administrator is tasked with blocking this IP address. How should the Administrator implement the restriction?

A user had aggregated the CloudWatch metric data on the AMI ID. The user observed some abnormal behavior of the CPU utilization metric while viewing the last 2 weeks of data. The user wants to share that data with his manager. How can the user achieve this easily with the AWS console?

A company's website went down for several hours. The root cause was a full disk on one of the company's Amazon EC2 instances. Which steps should the SysOps Administrator take to prevent this from happening in the future?

A company needs to have real-time access to image data while seamlessly maintaining a copy of the images in an offsite location for disaster recovery purposes. Which solution meets the requirement?

A SysOps Administrator is receiving alerts related to high CPU utilization of a Memcached-based Amazon ElastiCache cluster. Which remediation steps should be taken to resolve this issue? (Choose two.)

A SysOps Administrator needs to control access to groups of Amazon EC2 instances. Specific tags on the EC2 instances have already been added. Which additional actions should the Administrator take to control access? (Choose two.)