Question 1

A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. The ELB security policy supports various ciphers. Which of the below mentioned options helps identify the matching cipher at the client side to the ELB cipher list when client is requesting ELB DNS over SSL?
A) Cipher Protocol
B) Client Configuration Preference
C) Server Order Preference
D) Load Balancer Preference

Accepted Answer

The Server Order Preference option allows the load balancer to select the first cipher in its list that matches any one of the ciphers in the client's list, ensuring secure negotiation.

Question 2

A user wants to upload a complete folder to AWS S3 using the S3 Management console. How can the user perform this activity?
A) Just drag and drop the folder using the flash tool provided by S3
B) Use the Enable Enhanced Folder option from the S3 console while uploading objects
C) The user cannot upload the whole folder in one go with the S3 management console
D) Use the Enable Enhanced Uploader option from the S3 console while uploading objects

Accepted Answer

The "Enable Enhanced Uploader" option in the S3 console allows users to upload entire folders, as it supports folder uploads using HTML5 features.

Question 3

An AWS account owner has setup multiple IAM users. One IAM user only has CloudWatch access. He has setup the alarm action which stops the EC2 instances when the CPU utilization is below the threshold limit. What will happen in this case?
A) It is not possible to stop the instance using the CloudWatch alarm
B) CloudWatch will stop the instance when the action is executed
C) The user cannot set an alarm on EC2 since he does not have the permission
D) The user can setup the action but it will not be executed if the user does not have EC2 rights

Accepted Answer

The user can set up the action in CloudWatch, but the action to stop the EC2 instance will not be executed if the user does not have the necessary EC2 permissions.

Question 4

A user is sending the data to CloudWatch using the CloudWatch API. The user is sending data 90 minutes in the future. What will CloudWatch do in this case?
A) CloudWatch will accept the data
B) It is not possible to send data of the future
C) It is not possible to send the data manually to CloudWatch
D) The user cannot send data for more than 60 minutes in the future

Accepted Answer

CloudWatch accepts data with a timestamp up to 2 hours (120 minutes) in the future, so sending data 90 minutes in the future is allowed.

Question 5

A user has created an Auto Scaling group using CLI. The user wants to enable CloudWatch detailed monitoring for that group. How can the user configure this?
A) When the user sets an alarm on the Auto Scaling group, it automatically enables detail monitoring
B) By default detailed monitoring is enabled for Auto Scaling
C) Auto Scaling does not support detailed monitoring
D) Enable detail monitoring from the AWS console

Accepted Answer

By default, detailed monitoring is enabled for Auto Scaling groups, which provides data at 1-minute intervals.

Question 6

A user has created a VPC with CIDR 20.0.0.0/24. The user has used all the IPs of CIDR and wants to increase the size of the VPC. The user has two subnets: public (20.0.0.0/28) and private (20.0.1.0/28). How can the user change the size of the VPC?
A) The user can delete all the instances of the subnet. Change the size of the subnets to 20.0.0.0/32 and 20.0.1.0/32, respectively. Then the user can increase the size of the VPC using CLI
B) It is not possible to change the size of the VPC once it has been created
C) The user can add a subnet with a higher range so that it will automatically increase the size of the VPC
D) The user can delete the subnets first and then modify the size of the VPC

Accepted Answer

Once a VPC is created, its CIDR block size cannot be changed. The user would need to create a new VPC with a larger CIDR block and migrate resources to it.

Question 7

A user has configured Auto Scaling with the minimum capacity as 2 and the desired capacity as 2. The user is trying to terminate one of the existing instance with the command:  What will Auto Scaling do in this scenario?
A) Terminates the instance and does not launch a new instance
B) Terminates the instance and updates the desired capacity to 1
C) Terminates the instance and updates the desired capacity and minimum size to 1
D) Throws an error

Accepted Answer

The answer of A user has configured Auto Scaling with...

Question 8

A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80) and a DB server in the private subnet (port 3306). The user is configuring a security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp). Which of the below mentioned entries is required in the web server security group (WebSecGrp)?
A) Configure Destination as DB Security group ID (DbSecGrp) for port 3306 Outbound
B) 80 for Destination 0.0.0.0/0 Outbound
C) Configure port 3306 for source 20.0.0.0/24 InBound
D) Configure port 80 InBound for source 20.0.0.0/16

Accepted Answer

The answer of A user has created a VPC with...

Question 9

Which of the below mentioned AWS RDS logs cannot be viewed from the console for MySQL?
A) Error Log
B) Slow Query Log
C) Transaction Log
D) General Log

Accepted Answer

The Transaction Log is not available for direct viewing from the AWS RDS console for MySQL. It is used internally by the database engine for recovery purposes.

Question 10

A user has created a VPC with public and private subnets. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.1.0/24 and the public subnet uses CIDR 20.0.0.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306). The user is configuring a security group of the NAT instance. Which of the below mentioned entries is not required for the NAT security group?
A) For Inbound allow Source: 20.0.1.0/24 on port 80
B) For Outbound allow Destination: 0.0.0.0/0 on port 80
C) For Inbound allow Source: 20.0.0.0/24 on port 80
D) For Outbound allow Destination: 0.0.0.0/0 on port 443

Accepted Answer

The answer of A user has created a VPC with...

Question 11

A user has launched an EC2 instance from an instance store backed AMI. If the user restarts the instance, what will happen to the ephemeral storage data?
A) All the data will be erased but the ephemeral storage will stay connected
B) All data will be erased and the ephemeral storage is released
C) It is not possible to restart an instance launched from an instance store backed AMI
D) The data is preserved

Accepted Answer

The answer of A user has launched an EC2 instance...

Question 12

A user has configured ELB with Auto Scaling. The user suspended the Auto Scaling terminate process only for a while. What will happen to the availability zone rebalancing process (AZRebalance. during this period?
A) Auto Scaling will not launch or terminate any instances
B) Auto Scaling will allow the instances to grow more than the maximum size
C) Auto Scaling will keep launching instances till the maximum instance size
D) It is not possible to suspend the terminate process while keeping the launch active

Accepted Answer

When the terminate process is suspended, Auto Scaling can launch new instances but cannot terminate them, potentially allowing the number of instances to exceed the maximum size temporarily.

Question 13

A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned security policies is supported by ELB?
A) Dynamic Security Policy
B) All the other options
C) Predefined Security Policy
D) Default Security Policy

Accepted Answer

ELB supports predefined security policies, which are sets of SSL protocols and ciphers that can be used for secure negotiation between the client and the load balancer.

Question 14

A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 by mistake. The user is trying to create another subnet of CIDR 20.0.0.1/24. How can the user create the second subnet?
A) There is no need to update the subnet as VPC automatically adjusts the CIDR of the first subnet based on the second subnet's CIDR
B) The user can modify the first subnet CIDR from the console
C) It is not possible to create a second subnet as one subnet with the same CIDR as the VPC has been created
D) The user can modify the first subnet CIDR with AWS CLI

Accepted Answer

The first subnet's CIDR overlaps entirely with the VPC's CIDR, leaving no room for additional subnets. The user must delete the first subnet and create subnets with non-overlapping CIDRs within the VPC's range.

Question 15

A user has a weighing plant. The user measures the weight of some goods every 5 minutes and sends data to AWS CloudWatch for monitoring and tracking. Which of the below mentioned parameters is mandatory for the user to include in the request list?
A) Value
B) Namespace
C) Metric Name
D) Time zone

Accepted Answer

The answer of A user has a weighing plant. The...

Question 16

A user is using the AWS SQS to decouple the services. Which of the below mentioned operations is not supported by SQS?
A) SendMessageBatch
B) DeleteMessageBatch
C) CreateQueue
D) DeleteMessageQueue

Accepted Answer

The correct operation for deleting a queue in SQS is "DeleteQueue," not "DeleteMessageQueue."

Question 17

A user runs the command "dd if=/dev/zero of=/dev/xvdfbs=1M" on a fresh blank EBS volume attached to a Linux instance. Which of the below mentioned activities is the user performing with the command given above?
A) Creating a file system on the EBS volume
B) Mounting the device to the instance
C) Pre warming the EBS volume
D) Formatting the EBS volume

Accepted Answer

The command "dd if=/dev/zero of=/dev/xvdf bs=1M" writes zeros to the entire EBS volume, which is a process known as pre-warming. This is done to ensure that the volume performs optimally by eliminating the initial performance hit that can occur when accessing new blocks for the first time.

Question 18

A storage admin wants to encrypt all the objects stored in S3 using server side encryption. The user does not want to use the AES 256 encryption key provided by S3. How can the user achieve this?
A) The admin should upload his secret key to the AWS console and let S3 decrypt the objects
B) The admin should use CLI or API to upload the encryption key to the S3 bucket. When making a call to the S3 API mention the encryption key URL in each request
C) S3 does not support client supplied encryption keys for server side encryption
D) The admin should send the keys and encryption algorithm with each API call

Accepted Answer

The admin can use server-side encryption with customer-provided keys (SSE-C) by sending the encryption keys and algorithm with each API call.

Question 19

A user has created a mobile application which makes calls to DynamoDB to fetch certain data. The application is using the DynamoDB SDK and root account access/secret access key to connect to DynamoDB from mobile. Which of the below mentioned statements is true with respect to the best practice for security in this scenario?
A) The user should create a separate IAM user for each mobile application and provide DynamoDB access with it
B) The user should create an IAM role with DynamoDB and EC2 access. Attach the role with EC2 and route all calls from the mobile through EC2
C) The application should use an IAM role with web identity federation which validates calls to DynamoDB with identity providers, such as Google, Amazon, and Facebook
D) Create an IAM Role with DynamoDB access and attach it with the mobile application

Accepted Answer

Using an IAM role with web identity federation allows the application to authenticate users through identity providers and obtain temporary security credentials to access DynamoDB, enhancing security by not embedding AWS credentials in the application.

Question 20

A user has scheduled the maintenance window of an RDS DB on Monday at 3 AM. Which of the below mentioned events may force to take the DB instance offline during the maintenance window?
A) Enabling Read Replica
B) Making the DB Multi AZ
C) DB password change
D) Security patching

Accepted Answer

Security patching often requires a database instance to be taken offline to apply updates and ensure the system's security and stability.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)

A user wants to upload a complete folder to AWS S3 using the S3 Management console. How can the user perform this activity?

An AWS account owner has setup multiple IAM users. One IAM user only has CloudWatch access. He has setup the alarm action which stops the EC2 instances when the CPU utilization is below the threshold limit. What will happen in this case?

A user is sending the data to CloudWatch using the CloudWatch API. The user is sending data 90 minutes in the future. What will CloudWatch do in this case?

A user has created an Auto Scaling group using CLI. The user wants to enable CloudWatch detailed monitoring for that group. How can the user configure this?

A user has created a VPC with CIDR 20.0.0.0/24. The user has used all the IPs of CIDR and wants to increase the size of the VPC. The user has two subnets: public (20.0.0.0/28) and private (20.0.1.0/28) . How can the user change the size of the VPC?

A user has configured Auto Scaling with the minimum capacity as 2 and the desired capacity as 2. The user is trying to terminate one of the existing instance with the command: What will Auto Scaling do in this scenario?

Which of the below mentioned AWS RDS logs cannot be viewed from the console for MySQL?

A user has launched an EC2 instance from an instance store backed AMI. If the user restarts the instance, what will happen to the ephemeral storage data?

A user has configured ELB with Auto Scaling. The user suspended the Auto Scaling terminate process only for a while. What will happen to the availability zone rebalancing process (AZRebalance. during this period?

A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned security policies is supported by ELB?

A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 by mistake. The user is trying to create another subnet of CIDR 20.0.0.1/24. How can the user create the second subnet?

A user has a weighing plant. The user measures the weight of some goods every 5 minutes and sends data to AWS CloudWatch for monitoring and tracking. Which of the below mentioned parameters is mandatory for the user to include in the request list?

A user is using the AWS SQS to decouple the services. Which of the below mentioned operations is not supported by SQS?

A user runs the command "dd if=/dev/zero of=/dev/xvdfbs=1M" on a fresh blank EBS volume attached to a Linux instance. Which of the below mentioned activities is the user performing with the command given above?

A storage admin wants to encrypt all the objects stored in S3 using server side encryption. The user does not want to use the AES 256 encryption key provided by S3. How can the user achieve this?

A user has scheduled the maintenance window of an RDS DB on Monday at 3 AM. Which of the below mentioned events may force to take the DB instance offline during the maintenance window?