Question 1

A company has a new requirement stating that all resources In AWS must be tagged according to a set policy.
Which AWS service should be used to enforce and continually Identify all resources that are not in compliance with the policy?

Options :

A : AWS CloudTrail

B : Amazon Inspector

C : AWS Config

D : AWS Systems Manager

Answer: C

Question 2

A SysOps administrator is troubleshooting a VPC with public and private subnets that leverage custom network ACLs. Instances in the private subnet are unable to access the internet. There is an internet gateway attached to the public subnet. The private subnet has a route to a NAT gateway that is also attached to the public subnet. The Amazon EC2 instances are associated with the default security group for the VPC.

What is causing the issue in this scenario?

Options :

A : There is a network ACL on the private subnet set to deny all outbound traffic.

B : There is no NAT gateway deployed in the private subnet of the VPC.

C : The default security group for the VPC blocks all inbound traffic to the EC2 instances.

D : The default security group for the VPC blocks all outbound traffic from the EC2 instances.

Answer: A

Question 3

A company is storing media content in an Amazon S3 bucket and uses Amazon CloudFront to distribute the content to its users. Due to licensing terms, the company is not authorized to distribute the content in some countries. A SysOps administrator must restrict access to certain countries.
What is the MOST operationally efficient solution that meets these requirements?

Options :

A : Configure the S3 bucket policy to deny the GetObject operation based on the S3:LocationConstraint condition.

B : Create a secondary origin access identity (OAI). Configure the S3 bucket policy to prevent access from unauthorized countries.

C : Enable the geo restriction feature in the CloudFront distribution to prevent access from unauthorized countries.

D : Update the application to generate signed CloudFront URLs only for IP addresses in authorized countries.

Answer: C

Question 4

A company’s SysOps administrator must ensure that all Amazon EC2 Windows instances that are launched in an AWS account have a third-party agent installed. The third-party agent has an .msi package. The company uses AWS Systems Manager for patching, and the Windows instances are tagged appropriately. The third-party agent requires periodic updates as new versions are released. The SysOps administrator must deploy these updates automatically.

Which combination of steps will meet these requirements with the LEAST operational effort? (Choose two.)

Options :

A : Create a Systems Manager Distributor package for the third-party agent.

B : Make sure that Systems Manager Inventory is configured. If Systems Manager Inventory is not configured, set up a new inventory for instances that is based on the appropriate tag value for Windows.

C : Create a Systems Manager State Manager association to run the AWS-RunRemoteScript document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windows with a schedule of 1 day.

D : Create a Systems Manager State Manager association to run the AWS-ConfigureAWSPackage document. Populate the details of the third-party agent package. Specify instance tags based on the appropriate tag value for Windows with a schedule of 1 day.

E : Create a Systems Manager OpsItem with the tag value for Windows. Attach the Systems Manager Distributor package to the OpsItem. Create a maintenance window that is specific to the package deployment. Configure the maintenance window to cover 24 hours a day.

Answer: A,B

Question 5

A company has scientists who upload large data objects to an Amazon S3 bucket. The scientists upload the objects as multipart uploads. The multipart uploads often fail because of poor end-client connectivity.

The company wants to optimize storage costs that are associated with the data. A SysOps administrator must implement a solution that presents metrics for incomplete uploads. The solution also must automatically delete any incomplete uploads after 7 days.

Which solution will meet these requirements?

Options :

A : Review the Incomplete Multipart Upload Bytes metric in the S3 Storage Lens dashboard. Create an S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days.

B : Implement S3 Intelligent-Tiering to move data into lower-cost storage classes after 7 days. Create an S3 Storage Lens policy to automatically delete any incomplete multipart uploads after 7 days.

C : Access the S3 console. Review the Metrics tab to check the storage that incomplete multipart uploads are consuming. Create an AWS Lambda function to delete any incomplete multipart uploads after 7 days.

D : Use the S3 analytics storage class analysis tool to identify and measure incomplete multipart uploads. Configure an S3 bucket policy to enforce restrictions on multipart uploads to delete incomplete multipart uploads after 7 days.

Answer: A

Higher Test Marks with Free Online SOA-C02 Exam Practice

Buying Options: