Question 1

A sys admin is using server side encryption with AWS S3. Which of the below mentioned statements helps the user understand the S3 encryption functionality?
A) The server side encryption with the user supplied key works when versioning is enabled
B) The user can use the AWS console, SDK and APIs to encrypt or decrypt the content for server side encryption with the user supplied key
C) The user must send an AES-128 encrypted key
D) The user can upload his own encryption key to the S3 console

Accepted Answer

Server-side encryption with user-supplied keys (SSE-C) works with versioning enabled, but AWS does not store the encryption key. The user must provide the key for each request.

Question 2

A user is configuring a CloudWatch alarm on RDS to receive a notification when the CPU utilization of RDS is higher than 50%. The user has setup an alarm when there is some inactivity on RDS, such as RDS unavailability. How can the user configure this?
A) Setup the notification when the CPU is more than 75% on RDS
B) Setup the notification when the state is Insufficient Data
C) Setup the notification when the CPU utilization is less than 10%
D) It is not possible to setup the alarm on RDS

Accepted Answer

CloudWatch alarms can be configured to send notifications when the state is "Insufficient Data," which can indicate inactivity or unavailability of the RDS instance.

Question 3

A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned SSL protocols is not supported by the security policy?
A) TLS 1.3
B) TLS 1.2
C) SSL 2.0
D) SSL 3.0

Accepted Answer

The answer of A user has configured ELB with SSL...

Question 4

An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achieve this?
A) Create an IAM policy with the security group and use that security group for AWS console login
B) Create an IAM policy with a condition which denies access when the IP address range is not from the organization
C) Configure the EC2 instance security group which allows traffic only from the organization's IP range
D) Create an IAM policy with VPC and allow a secure gateway between the organization and AWS Console

Accepted Answer

An IAM policy can be created with a condition that denies access when the request comes from an IP address range that is not within the organization's specified range. This ensures that IAM users can only access the console from within the organization.

Question 5

A user wants to find the particular error that occurred on a certain date in the AWS MySQL RDS DB. Which of the below mentioned activities may help the user to get the data easily?
A) It is not possible to get the log files for MySQL RDS
B) Find all the transaction logs and query on those records
C) Direct the logs to the DB table and then query that table
D) Download the log file to DynamoDB and search for the record

Accepted Answer

Directing the logs to a DB table allows the user to query the table directly to find specific error records, making it easier to locate the error on a certain date.

Question 6

A user has launched an EC2 instance. The instance got terminated as soon as it was launched. Which of the below mentioned options is not a possible reason for this?
A) The user account has reached the maximum EC2 instance limit
B) The snapshot is corrupt
C) The AMI is missing. It is the required part
D) The user account has reached the maximum volume limit

Accepted Answer

The maximum EC2 instance limit being reached would prevent the instance from being launched, not cause it to terminate immediately after launch.

Question 7

A user has launched an EC2 Windows instance from an instance store backed AMI. The user has also set the Instance initiated shutdown behavior to stop. What will happen when the user shuts down the OS?
A) It will not allow the user to shutdown the OS when the shutdown behavior is set to Stop
B) It is not possible to set the termination behavior to Stop for an Instance store backed AMI instance
C) The instance will stay running but the OS will be shutdown
D) The instance will be terminated

Accepted Answer

The answer of A user has launched an EC2 Windows...

Question 8

A user has setup a VPC with CIDR 20.0.0.0/16. The VPC has a private subnet (20.0.1.0/24. and a public subnet (20.0.0.0/24.. The user's data center has CIDR of 20.0.54.0/24 and 20.1.0.0/24. If the private subnet wants to communicate with the data center, what will happen?
A) It will allow traffic communication on both the CIDRs of the data center
B) It will not allow traffic with data center on CIDR 20.1.0.0/24 but allows traffic communication on 20.0.54.0/24
C) It will not allow traffic communication on any of the data center CIDRs
D) It will allow traffic with data center on CIDR 20.1.0.0/24 but does not allow on 20.0.54.0/24

Accepted Answer

The answer of A user has setup a VPC with...

Question 9

George has shared an EC2 AMI created in the US East region from his AWS account with Stefano. George copies the same AMI to the US West region. Can Stefano access the copied AMI of George's account from the US West region?
A) No, copy AMI does not copy the permission
B) It is not possible to share the AMI with a specific account
C) Yes, since copy AMI copies all private account sharing permissions
D) Yes, since copy AMI copies all the permissions attached with the AMI

Accepted Answer

Copying an AMI does not copy the permissions. George would need to explicitly share the copied AMI in the US West region with Stefano's account.

Question 10

A user has launched an RDS MySQL DB with the Multi AZ feature. The user has scheduled the scaling of instance storage during maintenance window. What is the correct order of events during maintenance window? Perform maintenance on standby Promote standby to primary Perform maintenance on original primary Promote original master back as primary
A) 1, 2, 3, 4
B) 1, 2, 3
C) 2, 3, 1, 4

Accepted Answer

The answer of A user has launched an RDS MySQL...

Question 11

An organization has applied the below mentioned policy on an IAM group which has selected the IAM users. What entitlements do the IAM users avail with this policy? 
A) The policy is not created correctly. It will throw an error for wrong resource name
B) The policy is for the group. Thus, the IAM user cannot have any entitlement to this
C) It allows full access to all AWS services for the IAM users who are a part of this group
D) If this policy is applied to the EC2 resource, the users of the group will have full access to the EC2 Resources

Accepted Answer

The answer of An organization has applied the below mentioned...

Question 12

A user has setup a CloudWatch alarm on the EC2 instance for CPU utilization. The user has setup to receive a notification on email when the CPU utilization is higher than 60%. The user is running a virus scan on the same instance at a particular time. The user wants to avoid receiving an email at this time. What should the user do?
A) Remove the alarm
B) Disable the alarm for a while using CLI
C) Modify the CPU utilization by removing the email alert
D) Disable the alarm for a while using the console

Accepted Answer

The answer of A user has setup a CloudWatch alarm...

Question 13

A user has launched 5 instances in EC2-CLASSIC and attached 5 elastic IPs to the five different instances in the US East region. The user is creating a VPC in the same region. The user wants to assign an elastic IP to the VPC instance. How can the user achieve this?
A) The user has to request AWS to increase the number of elastic IPs associated with the account
B) AWS allows 10 EC2 Classic IPs per region; so it will allow to allocate new Elastic IPs to the same region
C) The AWS will not allow to create a new elastic IP in VPC; it will throw an error
D) The user can allocate a new IP address in VPC as it has a different limit than EC2

Accepted Answer

The user can allocate a new IP address in VPC as it has a different limit than EC2-CLASSIC. Each VPC has its own limit for elastic IPs.

Question 14

A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL. When the IAM user logs in to the S3 console, which actions can he perform?
A) He can just view the content of the bucket
B) He can do all the operations on the bucket
C) It is not possible to give access to an IAM user using ACL
D) The IAM user can perform all operations on the bucket using only API/SDK

Accepted Answer

ACLs (Access Control Lists) are used to grant access to AWS accounts, not IAM users. To give an IAM user access to an S3 bucket, you would typically use bucket policies or IAM policies.

Question 15

A user has configured ELB with a TCP listener at ELB as well as on the back-end instances. The user wants to enable a proxy protocol to capture the source and destination IP information in the header. Which of the below mentioned statements helps the user understand a proxy protocol with TCP configuration?
A) If the end user is requesting behind a proxy server then the user should not enable a proxy protocol on ELB
B) ELB does not support a proxy protocol when it is listening on both the load balancer and the back-end instances
C) Whether the end user is requesting from a proxy server or directly, it does not make a difference for the proxy protocol
D) If the end user is requesting behind the proxy, then the user should add the "isproxy" flag to the ELB Configuration

Accepted Answer

The answer of A user has configured ELB with a...

Question 16

A sys admin is planning to subscribe to the RDS event notifications. For which of the below mentioned source categories the subscription cannot be configured?
A) DB security group
B) DB snapshot
C) DB options group
D) DB parameter group

Accepted Answer

RDS event notifications can be configured for DB instances, DB security groups, DB snapshots, and DB parameter groups, but not for DB options groups.

Question 17

A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306). The user is configuring a security group for the public subnet (WebSecGrp. and the private subnet (DBSecGrp). Which of the below mentioned entries is required in the private subnet database security group (DBSecGrp)?
A) Allow Inbound on port 3306 for Source Web Server Security Group (WebSecGrp)
B) Allow Inbound on port 3306 from source 20.0.0.0/16
C) Allow Outbound on port 3306 for Destination Web Server Security Group (WebSecGrp)
D) Allow Outbound on port 80 for Destination NAT Instance IP

Accepted Answer

The database server in the private subnet needs to allow inbound traffic on port 3306 from the web server in the public subnet. Therefore, the security group for the database should allow inbound traffic on port 3306 from the web server's security group (WebSecGrp).

Question 18

A user is trying to setup a security policy for ELB. The user wants ELB to meet the cipher supported by the client by configuring the server order preference in ELB security policy. Which of the below mentioned preconfigured policies supports this feature?
A) ELBSecurity Policy-2014-01
B) ELBSecurity Policy-2011-08
C) ELBDefault Negotiation Policy
D) ELBSample- OpenSSLDefault Cipher Policy

Accepted Answer

ELBSecurity Policy-2014-01 supports server order preference, allowing ELB to prioritize its preferred cipher suite over the client's preference.

Question 19

George has launched three EC2 instances inside the US-East-1a zone with his AWS account. Ray has launched two EC2 instances in the US-East-1a zone with his AWS account. Which of the below mentioned statements will help George and Ray understand the availability zone (AZ) concept better?
A) The instances of George and Ray will be running in the same data center
B) All the instances of George and Ray can communicate over a private IP with a minimal cost
C) All the instances of George and Ray can communicate over a private IP without any cost
D) The US-East-1a region of George and Ray can be different availability zones

Accepted Answer

Each AWS account can map availability zones to different physical locations, so US-East-1a for George might not be the same physical location as US-East-1a for Ray.

Question 20

A user has created a VPC with a subnet and a security group. The user has launched an instance in that subnet and attached a public IP. The user is still unable to connect to the instance. The Internet gateway has also been created. What can be the reason for the error?
A) The internet gateway is not configured with the route table
B) The private IP is not present
C) The outbound traffic on the security group is disabled
D) The internet gateway is not configured with the security group

Accepted Answer

The internet gateway must be associated with the route table to allow traffic to flow between the VPC and the internet. Without this configuration, the instance will not be accessible from the internet.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)

A sys admin is using server side encryption with AWS S3. Which of the below mentioned statements helps the user understand the S3 encryption functionality?

A user is configuring a CloudWatch alarm on RDS to receive a notification when the CPU utilization of RDS is higher than 50%. The user has setup an alarm when there is some inactivity on RDS, such as RDS unavailability. How can the user configure this?

A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned SSL protocols is not supported by the security policy?

An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achieve this?

A user wants to find the particular error that occurred on a certain date in the AWS MySQL RDS DB. Which of the below mentioned activities may help the user to get the data easily?

A user has launched an EC2 instance. The instance got terminated as soon as it was launched. Which of the below mentioned options is not a possible reason for this?

A user has launched an EC2 Windows instance from an instance store backed AMI. The user has also set the Instance initiated shutdown behavior to stop. What will happen when the user shuts down the OS?

A user has setup a VPC with CIDR 20.0.0.0/16. The VPC has a private subnet (20.0.1.0/24. and a public subnet (20.0.0.0/24.. The user's data center has CIDR of 20.0.54.0/24 and 20.1.0.0/24. If the private subnet wants to communicate with the data center, what will happen?

George has shared an EC2 AMI created in the US East region from his AWS account with Stefano. George copies the same AMI to the US West region. Can Stefano access the copied AMI of George's account from the US West region?

An organization has applied the below mentioned policy on an IAM group which has selected the IAM users. What entitlements do the IAM users avail with this policy?

A user has launched 5 instances in EC2-CLASSIC and attached 5 elastic IPs to the five different instances in the US East region. The user is creating a VPC in the same region. The user wants to assign an elastic IP to the VPC instance. How can the user achieve this?

A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL. When the IAM user logs in to the S3 console, which actions can he perform?

A sys admin is planning to subscribe to the RDS event notifications. For which of the below mentioned source categories the subscription cannot be configured?

A user is trying to setup a security policy for ELB. The user wants ELB to meet the cipher supported by the client by configuring the server order preference in ELB security policy. Which of the below mentioned preconfigured policies supports this feature?

George has launched three EC2 instances inside the US-East-1a zone with his AWS account. Ray has launched two EC2 instances in the US-East-1a zone with his AWS account. Which of the below mentioned statements will help George and Ray understand the availability zone (AZ) concept better?

A user has created a VPC with a subnet and a security group. The user has launched an instance in that subnet and attached a public IP. The user is still unable to connect to the instance. The Internet gateway has also been created. What can be the reason for the error?