Question 1

A sys admin is using server side encryption with AWS S3. Which of the below mentioned statements helps the user understand the S3 encryption functionality?

Accepted Answer

Server-side encryption with user-supplied keys (SSE-C) works with versioning enabled, but AWS does not store the encryption key. The user must provide the key for each request.

Question 2

A user is configuring a CloudWatch alarm on RDS to receive a notification when the CPU utilization of RDS is higher than 50%. The user has setup an alarm when there is some inactivity on RDS, such as RDS unavailability. How can the user configure this?

Accepted Answer

CloudWatch alarms can be configured to send notifications when the state is "Insufficient Data," which can indicate inactivity or unavailability of the RDS instance.

Question 3

A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned SSL protocols is not supported by the security policy?

Accepted Answer

The answer of A user has configured ELB with SSL...

Question 4

An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achieve this?

Accepted Answer

An IAM policy can be created with a condition that denies access when the request comes from an IP address range that is not within the organization's specified range. This ensures that IAM users can only access the console from within the organization.

Question 5

A user wants to find the particular error that occurred on a certain date in the AWS MySQL RDS DB. Which of the below mentioned activities may help the user to get the data easily?

Accepted Answer

Directing the logs to a DB table allows the user to query the table directly to find specific error records, making it easier to locate the error on a certain date.

Question 6

A user has launched an EC2 instance. The instance got terminated as soon as it was launched. Which of the below mentioned options is not a possible reason for this?

Accepted Answer

The maximum EC2 instance limit being reached would prevent the instance from being launched, not cause it to terminate immediately after launch.

Question 7

A user has launched an EC2 Windows instance from an instance store backed AMI. The user has also set the Instance initiated shutdown behavior to stop. What will happen when the user shuts down the OS?

Accepted Answer

The answer of A user has launched an EC2 Windows...

Question 8

A user has setup a VPC with CIDR 20.0.0.0/16. The VPC has a private subnet (20.0.1.0/24. and a public subnet (20.0.0.0/24.. The user's data center has CIDR of 20.0.54.0/24 and 20.1.0.0/24. If the private subnet wants to communicate with the data center, what will happen?

Accepted Answer

The answer of A user has setup a VPC with...

Question 9

George has shared an EC2 AMI created in the US East region from his AWS account with Stefano. George copies the same AMI to the US West region. Can Stefano access the copied AMI of George's account from the US West region?

Accepted Answer

Copying an AMI does not copy the permissions. George would need to explicitly share the copied AMI in the US West region with Stefano's account.

Question 10

A user has launched an RDS MySQL DB with the Multi AZ feature. The user has scheduled the scaling of instance storage during maintenance window. What is the correct order of events during maintenance window? Perform maintenance on standby Promote standby to primary Perform maintenance on original primary Promote original master back as primary

Accepted Answer

The answer of A user has launched an RDS MySQL...

Question 11

An organization has applied the below mentioned policy on an IAM group which has selected the IAM users. What entitlements do the IAM users avail with this policy?

Accepted Answer

The answer of An organization has applied the below mentioned...

Question 12

A user has setup a CloudWatch alarm on the EC2 instance for CPU utilization. The user has setup to receive a notification on email when the CPU utilization is higher than 60%. The user is running a virus scan on the same instance at a particular time. The user wants to avoid receiving an email at this time. What should the user do?

Accepted Answer

The answer of A user has setup a CloudWatch alarm...

Question 13

A user has launched 5 instances in EC2-CLASSIC and attached 5 elastic IPs to the five different instances in the US East region. The user is creating a VPC in the same region. The user wants to assign an elastic IP to the VPC instance. How can the user achieve this?

Accepted Answer

The user can allocate a new IP address in VPC as it has a different limit than EC2-CLASSIC. Each VPC has its own limit for elastic IPs.

Question 14

A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL. When the IAM user logs in to the S3 console, which actions can he perform?

Accepted Answer

ACLs (Access Control Lists) are used to grant access to AWS accounts, not IAM users. To give an IAM user access to an S3 bucket, you would typically use bucket policies or IAM policies.

Question 15

A user has configured ELB with a TCP listener at ELB as well as on the back-end instances. The user wants to enable a proxy protocol to capture the source and destination IP information in the header. Which of the below mentioned statements helps the user understand a proxy protocol with TCP configuration?

Accepted Answer

The answer of A user has configured ELB with a...

Question 16

A sys admin is planning to subscribe to the RDS event notifications. For which of the below mentioned source categories the subscription cannot be configured?

Accepted Answer

RDS event notifications can be configured for DB instances, DB security groups, DB snapshots, and DB parameter groups, but not for DB options groups.

Question 17

A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306). The user is configuring a security group for the public subnet (WebSecGrp. and the private subnet (DBSecGrp). Which of the below mentioned entries is required in the private subnet database security group (DBSecGrp)?

Accepted Answer

The database server in the private subnet needs to allow inbound traffic on port 3306 from the web server in the public subnet. Therefore, the security group for the database should allow inbound traffic on port 3306 from the web server's security group (WebSecGrp).

Question 18

A user is trying to setup a security policy for ELB. The user wants ELB to meet the cipher supported by the client by configuring the server order preference in ELB security policy. Which of the below mentioned preconfigured policies supports this feature?

Accepted Answer

ELBSecurity Policy-2014-01 supports server order preference, allowing ELB to prioritize its preferred cipher suite over the client's preference.

Question 19

George has launched three EC2 instances inside the US-East-1a zone with his AWS account. Ray has launched two EC2 instances in the US-East-1a zone with his AWS account. Which of the below mentioned statements will help George and Ray understand the availability zone (AZ) concept better?

Accepted Answer

Each AWS account can map availability zones to different physical locations, so US-East-1a for George might not be the same physical location as US-East-1a for Ray.

Question 20

A user has created a VPC with a subnet and a security group. The user has launched an instance in that subnet and attached a public IP. The user is still unable to connect to the instance. The Internet gateway has also been created. What can be the reason for the error?

Accepted Answer

The internet gateway must be associated with the route table to allow traffic to flow between the VPC and the internet. Without this configuration, the instance will not be accessible from the internet.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)