Question 1

What is an Auto Scaling group?

Accepted Answer

A)  It is a group of ELBs that are used to add instances from various regions. 
B)  It is a logical grouping of EC2 instances that share similar characteristics for scaling and man-agement. 
C)  It is a collection of EC2 instance launch parameters with different characteristics for scaling and management. 
D)  It is a group of launch configurations for Elastic load balancers in the same region. 
A)  It is a group of ELBs that are used to add instances from various regions. 
B)  It is a logical grouping of EC2 instances that share similar characteristics for scaling and man-agement. 
C)  It is a collection of EC2 instance launch parameters with different characteristics for scaling and management. 
D)  It is a group of launch configurations for Elastic load balancers in the same region.

Question 2

A security officer has requested that internet access be removed from subnets in a VPC. The subnets currently route internet-bound traffic to a NAT gateway. A SysOps administrator needs to remove this access while allowing access to Amazon S3. Which solution will meet these requirements?

Accepted Answer

A)  Set up an internet gateway. Update the route table on the subnets to use the internet gateway to route traffic to Amazon S3. 
B)  Set up an S3 VPC gateway endpoint. Update the route table on the subnets to use the gateway endpoint to route traffic to Amazon S3. 
C)  Set up additional NAT gateways in each Availability Zone. Update the route table on the subnets to use the NAT gateways to route traffic to Amazon S3. 
D)  Set up an egress-only internet gateway. Update the route table on the subnets to use the egress-only internet gateway to route traffic to Amazon S3. 
A)  Set up an internet gateway. Update the route table on the subnets to use the internet gateway to route traffic to Amazon S3. 
B)  Set up an S3 VPC gateway endpoint. Update the route table on the subnets to use the gateway endpoint to route traffic to Amazon S3. 
C)  Set up additional NAT gateways in each Availability Zone. Update the route table on the subnets to use the NAT gateways to route traffic to Amazon S3. 
D)  Set up an egress-only internet gateway. Update the route table on the subnets to use the egress-only internet gateway to route traffic to Amazon S3.

Question 3

A fleet of servers must send local logs to Amazon CloudWatch. How should the servers be configured to meet this requirement?

Accepted Answer

A)  Configure AWS Config to forward events to CloudWatch. 
B)  Configure a Simple Network Management Protocol (SNMP) agent to forward events to CloudWatch. 
C)  Install and configure the unified CloudWatch agent. 
D)  Install and configure the Amazon Inspector agent. 
A)  Configure AWS Config to forward events to CloudWatch. 
B)  Configure a Simple Network Management Protocol (SNMP) agent to forward events to CloudWatch. 
C)  Install and configure the unified CloudWatch agent. 
D)  Install and configure the Amazon Inspector agent.

Question 4

A company is planning to expand into an additional AWS Region for disaster recovery purposes. The company uses AWS CloudFormation, and its infrastructure is well-defined as code. The company would like to reuse as much of its existing code as possible when deploying resources to additional Regions. A SysOps Administrator is reviewing how Amazon Machine Images (AMIs) are selected in AWS CloudFormation, but is having trouble making the same stack work in the new Region. Which action would make it easier to manage multiple Regions?

Accepted Answer

A)  Name each AMI in the new Region exactly the same as the equivalent AMI in the first Region. 
B)  Duplicate the stack so unique AMI names can be coded into the appropriate stack. 
C)  Create an alias for each AMI so that an AMI can be referenced by a common name across Regions. 
D)  Create a Mappings section in the stack, and define the Region to AMI associations. 
A)  Name each AMI in the new Region exactly the same as the equivalent AMI in the first Region. 
B)  Duplicate the stack so unique AMI names can be coded into the appropriate stack. 
C)  Create an alias for each AMI so that an AMI can be referenced by a common name across Regions. 
D)  Create a Mappings section in the stack, and define the Region to AMI associations.

Question 5

A user has setup connection draining with ELB to allow in-flight requests to continue while the instance is being deregistered through Auto Scaling. If the user has not specified the draining time, how long will ELB allow inflight requests traffic to continue?

Accepted Answer

A)  600 seconds 
B)  3600 seconds 
C)  300 seconds 
D)  0 seconds 
A)  600 seconds 
B)  3600 seconds 
C)  300 seconds 
D)  0 seconds

Question 6

Fill in the blanks: One of the basic characteristics of security groups for your VPC is that you ______ .

Accepted Answer

A)  can specify allow rules as well as deny rules 
B)  can neither specify allow rules nor deny rules 
C)  can specify allow rules, but not deny rules 
D)  can specify deny rules, but not allow rules 
A)  can specify allow rules as well as deny rules 
B)  can neither specify allow rules nor deny rules 
C)  can specify allow rules, but not deny rules 
D)  can specify deny rules, but not allow rules

Question 7

An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants a particular group of IAM users to access only the test instances and not the production ones. They want to deploy the instances in various locations based on the factors that will change from time to time, especially in the test group. They expect instances will often need to be churned, i.e. deleted and replaced, especially in the testing group. This means the five instances they have created now will soon be replaced by a different set of five instances. The members of each group, produc-tion and testing, will not change in the foreseeable future. Given the situation, what choice below is the most efficient and time-saving strategy to define the IAM policy?

Accepted Answer

A)  By creating an IAM policy with a condition that allows access to only small instances 
B)  By defining the IAM policy that allows access based on the instance ID 
C)  By launching the test and production instances in separate regions and allowing region wise ac-cess to the group 
D)  By defining the tags on the test and production team members IAM user IDs, and adding a con-dition to the IAM policy that allows access to specific tags 
A)  By creating an IAM policy with a condition that allows access to only small instances 
B)  By defining the IAM policy that allows access based on the instance ID 
C)  By launching the test and production instances in separate regions and allowing region wise ac-cess to the group 
D)  By defining the tags on the test and production team members IAM user IDs, and adding a con-dition to the IAM policy that allows access to specific tags

Question 8

A SysOps Administrator must secure AWS CloudTrail logs. The Security team is concerned that an employee may modify or attempt to delete CloudTrail log files from its Amazon S3 bucket. Which practices will ensure that the log files are available and unaltered? (Choose two.)

Accepted Answer

A)  Enable the CloudTrail log file integrity check in AWS Config Rules. 
B)  Use CloudWatch Events to scan log files hourly. 
C)  Enable CloudTrail log file integrity validation. 
D)  Turn on Amazon S3 MFA Delete for the CloudTrail bucket. 
E)  Implement a DENY ALL bucket policy on the CloudTrail bucket. 
A)  Enable the CloudTrail log file integrity check in AWS Config Rules. 
B)  Use CloudWatch Events to scan log files hourly. 
C)  Enable CloudTrail log file integrity validation. 
D)  Turn on Amazon S3 MFA Delete for the CloudTrail bucket. 
E)  Implement a DENY ALL bucket policy on the CloudTrail bucket.

Question 9

A user is checking the CloudWatch metrics from the AWS console. The user notices that the CloudWatch data is coming in UTC. The user wants to convert the data to a local time zone. How can the user perform this?

Accepted Answer

A)  In the CloudWatch dashboard the user should set the local time zone so that CloudWatch shows the data only in the local time zone 
B)  In the CloudWatch console select the local time zone under the Time Range tab to view the data as per the local timezone 
C)  The CloudWatch data is always in UTC; the user has to manually convert the data 
D)  The user should have send the local time zone while uploading the data so that CloudWatch will show the data only in the local time zone 
A)  In the CloudWatch dashboard the user should set the local time zone so that CloudWatch shows the data only in the local time zone 
B)  In the CloudWatch console select the local time zone under the Time Range tab to view the data as per the local timezone 
C)  The CloudWatch data is always in UTC; the user has to manually convert the data 
D)  The user should have send the local time zone while uploading the data so that CloudWatch will show the data only in the local time zone

Question 10

A user has launched five instances and have registered them with an ELB. How can the user add the sixth EC2 instance to the ELB?

Accepted Answer

A)  The user must stop the ELB and add the sixth instance. 
B)  The user can add the sixth instance on the fly through API, CLI or the AWS Management Con-sole. 
C)  The user can add the instance and change the ELB config file. 
D)  The ELB can only have a maximum of five instances. 
A)  The user must stop the ELB and add the sixth instance. 
B)  The user can add the sixth instance on the fly through API, CLI or the AWS Management Con-sole. 
C)  The user can add the instance and change the ELB config file. 
D)  The ELB can only have a maximum of five instances.

Question 11

Spot instances are ideally designed for which purpose below?

Accepted Answer

A)  Running database instances that can scale up and down based on a specific workload. 
B)  Running long duration and highly transactional applications. 
C)  For building distributed fault tolerant databases under a tight deadline. 
D)  Taking advantage of excess EC2 capacity at prices below standard on-demand rates, for short duration jobs. 
A)  Running database instances that can scale up and down based on a specific workload. 
B)  Running long duration and highly transactional applications. 
C)  For building distributed fault tolerant databases under a tight deadline. 
D)  Taking advantage of excess EC2 capacity at prices below standard on-demand rates, for short duration jobs.

Question 12

A company uses multiple accounts for its applications. Account A manages the company's Amazon Route 53 domains and hosted zones. Account B uses a load balancer fronting the company's web servers. How can the company use Route 53 to point to the load balancer in the MOST cost-effective and efficient manner?

Accepted Answer

A)  Create an Amazon EC2 proxy in Account A that forwards requests to Account B 
B)  Create a load balancer in Account A that points to the load balancer in Account B 
C)  Create a CNAME record in Account A pointing to an alias record for the load balancer in Account B 
D)  Create an alias record in Account A pointing to the DNS name for the load balancer in Account B 
A)  Create an Amazon EC2 proxy in Account A that forwards requests to Account B 
B)  Create a load balancer in Account A that points to the load balancer in Account B 
C)  Create a CNAME record in Account A pointing to an alias record for the load balancer in Account B 
D)  Create an alias record in Account A pointing to the DNS name for the load balancer in Account B

Question 13

A user is displaying the CPU utilization, and Network in and Network out CloudWatch metrics data of a single instance on the same graph. The graph uses one Y-axis for CPU utilization and Network in and another Y-axis for Network out. Since Network in is too high, the CPU utilization data is not visible clearly on graph to the user. How can the data be viewed better on the same graph?

Accepted Answer

A)  It is not possible to show multiple metrics with the different units on the same graph 
B)  Add a third Y-axis with the console to show all the data in proportion 
C)  Change the axis of Network by using the Switch command from the graph 
D)  Change the units of CPU utilization so it can be shown in proportion with Network 
A)  It is not possible to show multiple metrics with the different units on the same graph 
B)  Add a third Y-axis with the console to show all the data in proportion 
C)  Change the axis of Network by using the Switch command from the graph 
D)  Change the units of CPU utilization so it can be shown in proportion with Network

Question 14

A SysOps Administrator manages an Amazon RDS MySQL DB instance in production. The database is accessed by several applications. The Administrator needs to ensure minimal downtime of the applications in the event the database suffers a failure. This change must not impact customer use during regular business hours. Which action will make the database MORE highly available?

Accepted Answer

A)  Contact AWS Support to pre-warm the database to ensure that it can handle any unexpected spikes in traffic 
B)  Create a new Multi-AZ RDS DB instance. Migrate the data to the new DB instance and delete the old one 
C)  Create a read replica from the existing database outside of business hours 
D)  Modify the DB instance to outside of business hours be a Multi-AZ deployment 
A)  Contact AWS Support to pre-warm the database to ensure that it can handle any unexpected spikes in traffic 
B)  Create a new Multi-AZ RDS DB instance. Migrate the data to the new DB instance and delete the old one 
C)  Create a read replica from the existing database outside of business hours 
D)  Modify the DB instance to outside of business hours be a Multi-AZ deployment

Question 15

A company's audit shows that users have been changing cost-related tags on Amazon EC2 instances after deployment. The company has an organization in AWS Organizations with many AWS accounts. The company needs a solution to detect the EC2 instances automatically. The solution must require the least possible operational overhead. Which solution meets these requirements?

Accepted Answer

A)  Use service control policies (SCPs) to track EC2 instances that do not have the required tags. 
B)  Use Amazon Inspector to run a report to identify EC2 instances that do not have the required tags. 
C)  Use an AWS Config rule to track EC2 instances that do not have the required tags. 
D)  Use AWS Well-Architected Tool (AWS WA Tool) to run a report to identify EC2 instances that do not have the required tags. 
A)  Use service control policies (SCPs) to track EC2 instances that do not have the required tags. 
B)  Use Amazon Inspector to run a report to identify EC2 instances that do not have the required tags. 
C)  Use an AWS Config rule to track EC2 instances that do not have the required tags. 
D)  Use AWS Well-Architected Tool (AWS WA Tool) to run a report to identify EC2 instances that do not have the required tags.

Question 16

A SysOps Administrator is configuring AWS SSO for the first time. The Administrator has already created a directory in the master account using AWS Directory Service and enabled full access in AWS Organizations. What should the Administrator do next to configure the service?

Accepted Answer

A)  Create IAM roles in each account to be used by AWS SSO, and associate users with these roles using AWS SSO. 
B)  Create IAM users in the master account, and use AWS SSO to associate the users with the accounts they will access. 
C)  Create permission sets in AWS SSO, and associate the permission sets with Directory Service users or groups. 
D)  Create service control policies (SCPs) in Organizations, and associate the SCPs with Directory Service users or groups. 
A)  Create IAM roles in each account to be used by AWS SSO, and associate users with these roles using AWS SSO. 
B)  Create IAM users in the master account, and use AWS SSO to associate the users with the accounts they will access. 
C)  Create permission sets in AWS SSO, and associate the permission sets with Directory Service users or groups. 
D)  Create service control policies (SCPs) in Organizations, and associate the SCPs with Directory Service users or groups.

Question 17

The Statement element, of an AWS IAM policy, contains an array of individual statements. Each individual statement is a(n) ______ block enclosed in braces { }.

Accepted Answer

A)  JSON 
B)  AJAX 
C)  JavaScript 
D)  jQuery 
A)  JSON 
B)  AJAX 
C)  JavaScript 
D)  jQuery

Question 18

A SysOps Administrator manages a website running on Amazon EC2 instances behind an ELB Application Load Balancer. Users visiting the load balancer's DNS address in a browser are reporting errors. The administrator has confirmed: The security groups and network ACLs are correctly configured. The load balancer target group shows no healthy instances. What should the Administrator do to resolve this issue?

Accepted Answer

A)  Review the application's logs for requests originating from the VPC DNS address. 
B)  Review the load balancer access logs, looking for any issues or errors. 
C)  Review the load balancer target group health check configuration. 
D)  Review the load balancer listener configuration. 
A)  Review the application's logs for requests originating from the VPC DNS address. 
B)  Review the load balancer access logs, looking for any issues or errors. 
C)  Review the load balancer target group health check configuration. 
D)  Review the load balancer listener configuration.

Question 19

A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. What does this policy define?

Accepted Answer

A)  It will make the cloudacademy bucket as well as all its objects as public 
B)  It will allow everyone to view the ACL of the bucket 
C)  It will give an error as no object is defined as part of the policy while the action defines the rule about the object 
D)  It will make the cloudacademy bucket as public 
A)  It will make the cloudacademy bucket as well as all its objects as public 
B)  It will allow everyone to view the ACL of the bucket 
C)  It will give an error as no object is defined as part of the policy while the action defines the rule about the object 
D)  It will make the cloudacademy bucket as public

Question 20

A user is sending a custom metric to CloudWatch. If the call to the CloudWatch APIs has different dimensions, but the same metric name, how will CloudWatch treat all the requests?

Accepted Answer

A)  It will treat each unique combination of dimensions as a separate metric. 
B)  It will group all the calls into a single call. 
C)  It will overwrite the previous dimension data with the new dimension data. 
D)  It will reject the request as there cannot be a separate dimension for a single metric. 
A)  It will treat each unique combination of dimensions as a separate metric. 
B)  It will group all the calls into a single call. 
C)  It will overwrite the previous dimension data with the new dimension data. 
D)  It will reject the request as there cannot be a separate dimension for a single metric.

What is an Auto Scaling group?

A security officer has requested that internet access be removed from subnets in a VPC. The subnets currently route internet-bound traffic to a NAT gateway. A SysOps administrator needs to remove this access while allowing access to Amazon S3. Which solution will meet these requirements?

A fleet of servers must send local logs to Amazon CloudWatch. How should the servers be configured to meet this requirement?

A user has setup connection draining with ELB to allow in-flight requests to continue while the instance is being deregistered through Auto Scaling. If the user has not specified the draining time, how long will ELB allow inflight requests traffic to continue?

Fill in the blanks: One of the basic characteristics of security groups for your VPC is that you ______ .

A SysOps Administrator must secure AWS CloudTrail logs. The Security team is concerned that an employee may modify or attempt to delete CloudTrail log files from its Amazon S3 bucket. Which practices will ensure that the log files are available and unaltered? (Choose two.)

A user is checking the CloudWatch metrics from the AWS console. The user notices that the CloudWatch data is coming in UTC. The user wants to convert the data to a local time zone. How can the user perform this?

A user has launched five instances and have registered them with an ELB. How can the user add the sixth EC2 instance to the ELB?

Spot instances are ideally designed for which purpose below?

A SysOps Administrator is configuring AWS SSO for the first time. The Administrator has already created a directory in the master account using AWS Directory Service and enabled full access in AWS Organizations. What should the Administrator do next to configure the service?

The Statement element, of an AWS IAM policy, contains an array of individual statements. Each individual statement is a(n) ______ block enclosed in braces { }.

A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. What does this policy define?

A user is sending a custom metric to CloudWatch. If the call to the CloudWatch APIs has different dimensions, but the same metric name, how will CloudWatch treat all the requests?

AWS Certified Advanced Networking - Specialty (ANS-C00)

AWS Certified Alexa Skill Builder - Specialty

AWS Certified Cloud Practitioner (CLF-C01)

AWS Certified Data Analytics - Specialty (DAS-C01)

AWS Certified Database - Specialty

AWS Certified Developer Associate (DVA-C01)

AWS Certified Machine Learning - Specialty (MLS-C01)

AWS Certified Security - Specialty (SCS-C01)

AWS Certified Solutions Architect - Associate SAA-C02

AWS Certified Solutions Architect - Professional (SAP-C01)

AWS Certified SysOps Administrator - Associate (SOA-C02)

AWS DevOps Engineer - Professional (DOP-C01)

Filters

Exam 13: AWS Certified SysOps Administrator (SOA-C01)

What is an Auto Scaling group?

A security officer has requested that internet access be removed from subnets in a VPC. The subnets currently route internet-bound traffic to a NAT gateway. A SysOps administrator needs to remove this access while allowing access to Amazon S3. Which solution will meet these requirements?

A fleet of servers must send local logs to Amazon CloudWatch. How should the servers be configured to meet this requirement?

A user has setup connection draining with ELB to allow in-flight requests to continue while the instance is being deregistered through Auto Scaling. If the user has not specified the draining time, how long will ELB allow inflight requests traffic to continue?

Fill in the blanks: One of the basic characteristics of security groups for your VPC is that you ______ .

A SysOps Administrator must secure AWS CloudTrail logs. The Security team is concerned that an employee may modify or attempt to delete CloudTrail log files from its Amazon S3 bucket. Which practices will ensure that the log files are available and unaltered? (Choose two.)

A user is checking the CloudWatch metrics from the AWS console. The user notices that the CloudWatch data is coming in UTC. The user wants to convert the data to a local time zone. How can the user perform this?

A user has launched five instances and have registered them with an ELB. How can the user add the sixth EC2 instance to the ELB?

Spot instances are ideally designed for which purpose below?

A SysOps Administrator is configuring AWS SSO for the first time. The Administrator has already created a directory in the master account using AWS Directory Service and enabled full access in AWS Organizations. What should the Administrator do next to configure the service?

The Statement element, of an AWS IAM policy, contains an array of individual statements. Each individual statement is a(n) ______ block enclosed in braces { }.

A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. What does this policy define?

A user is sending a custom metric to CloudWatch. If the call to the CloudWatch APIs has different dimensions, but the same metric name, how will CloudWatch treat all the requests?

AWS Certified Advanced Networking - Specialty (ANS-C00)

AWS Certified Alexa Skill Builder - Specialty

AWS Certified Cloud Practitioner (CLF-C01)

AWS Certified Data Analytics - Specialty (DAS-C01)

AWS Certified Database - Specialty

AWS Certified Developer Associate (DVA-C01)

AWS Certified Machine Learning - Specialty (MLS-C01)

AWS Certified Security - Specialty (SCS-C01)

AWS Certified Solutions Architect - Associate SAA-C02

AWS Certified Solutions Architect - Professional (SAP-C01)

AWS Certified SysOps Administrator - Associate (SOA-C02)

AWS DevOps Engineer - Professional (DOP-C01)

Filters