Question 1

A database running on Amazon EC2 requires sustained IOPS performance. Which kind of Amazon EBS volume should an Administrator choose for this solution?

Accepted Answer

A)  Cloud HDD 
B)  General Purpose SSD 
C)  Provisioned IOPS SSD 
D)  Throughput Optimized HDD

Question 2

Amazon Cognito supports web identity federation through _____.

Accepted Answer

A)  custom sign-in code or own user identities 
B)  Facebook, Google, and Amazon 
C)  a configuration check for rules that deny access to specific ports 
D)  an AWS user group

Question 3

A company is evaluating solutions for connecting its data centers to a VPC in an AWS Region running a mission-critical application. A secondary Region has already been set up as a disaster recovery solution. The company needs a consistent, low-latency connection of at least 10 Gbps that must be highly resilient and fault tolerant. Which solution meets these requirements?

Accepted Answer

A)  Set up a 10 Gbps AWS Direct Connect connection at two Direct Connect locations. Use two customer routers and dynamically routed, active/active connections. 
B)  Set up a 10 Gbps AWS Direct Connect connection. Use a Direct Connect gateway to support both Regions. 
C)  Establish an AWS Direct Connect connection for the primary connection to the VPC with an AWS-managed VPN connection as a backup. 
D)  Establish 10 VPN connections to the VPC. Enable the VPN Equal Cost Multipath (ECMP) feature to balance traffic over the active connections.

Question 4

How can software determine the public and private IP addresses of the Amazon EC2 instance that it is running on?

Accepted Answer

A)  Query the local instance metadata. 
B)  Query the appropriate Amazon CloudWatch metric. 
C)  Query the local instance userdata. 
D)  Use ipconfig or ifconfig command.

Question 5

An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords. How can the organization achieve this?

Accepted Answer

A)  The organization should create a separate login ID but give the IAM users the same alias so that each one can login with their alias 
B)  The organization should create each user in a separate region so that they have their own URL to login 
C)  It is not possible to have the same login ID for multiple IAM users of the same account 
D)  The organization should create various groups and add each user with the same login ID to different groups. The user can login with their own group ID

Question 6

A company wants to reduce costs on jobs that can be completed at any time. The jobs are currently run using multiple On-Demand Instances, and the jobs take just under 2 hours to complete. If a job fails for any reason, it can be restarted from the beginning. Which method is the MOST cost-effective based on these requirements?

Accepted Answer

A)  Purchase Reserved Instances to be used for job execution. 
B)  Submit a request for a one-time Spot Instance for job execution. 
C)  Submit a request for a Spot block to be used for job execution. 
D)  Use a mixture of On-Demand and Spot Instances for job execution.

Question 7

What would happen to an RDS (Relational Database Service) multi-Availability Zone deployment if the primary DB instance fails?

Accepted Answer

A)  The IP of the primary DB Instance is switched to the standby DB Instance. 
B)  A new DB instance is created in the standby availability zone. 
C)  The canonical name record (CNAM
E)  is changed from primary to standby. 
D)  The RDS (Relational Database Service) DB instance reboots.

Question 8

A SysOps Administrator receives an email from AWS about a production Amazon EC2 instance backed by Amazon EBS that is on a degraded host scheduled for retirement. The scheduled retirement occurs during business-critical hours. What should be done to MINIMIZE disruption to the business?

Accepted Answer

A)  Reboot the instance as soon as possible to perform the system maintenance before the scheduled retirement. 
B)  Reboot the instance outside business hours to perform the system maintenance before the scheduled retirement. 
C)  Stop/start the instance outside business hours to move to a new host before the scheduled retirement. 
D)  Write an AWS Lambda function to restore the system when the scheduled retirement occurs.

Question 9

A Security team is concerned about the potential of intellectual property leaking to the internet. A SysOps Administrator is tasked with identifying controls to address the potential problem. The servers in question reside in a VPC and cannot be allowed to send traffic to the internet. How can these requirements be met?

Accepted Answer

A)  Edit the route for the subnet with the following entry: Destination 0.0.0.0/0 Target: igw-xxxxxxxx 
B)  Ensure that the servers do not have Elastic IP addresses. 
C)  Enable Enhanced Networking on the instances to control traffic flows. 
D)  Put the servers in a private subnet.

Question 10

A kernel patch for AWS Linux has been released, and systems need to be updated to the new version. A SysOps administrator must apply an in-place update to an existing Amazon EC2 instance without replacing the instance. How should the SysOps administrator apply the new software version to the instance?

Accepted Answer

A)  Add the instance to a patch group and patch baseline containing the desired patch by using AWS Systems Manager Patch Manager. 
B)  Develop a new version of the instance's Amazon Machine Image (AMI). Apply that new AMI to the instance. 
C)  Develop a new user data script containing the patch. Configure the instance with the new script. 
D)  Run commands on the instance remotely using the AWS CLI.

Question 11

What does the Server-side encryption provide in Amazon S3?

Accepted Answer

A)  Server-side encryption doesn't exist for Amazon S3, but only for Amazon EC2. 
B)  Server-side encryption protects data at rest using Amazon S3-managed encryption keys (SSE-S3). 
C)  Server-side encryption provides an encrypted virtual disk in the cloud. 
D)  Server-side encryption allows to upload files using an SSL endpoint for a secure transfer.

Question 12

An organization has setup consolidated billing with 3 different AWS accounts. Which of the below mentioned advantages will organization receive in terms of the AWS pricing?

Accepted Answer

A)  The consolidated billing does not bring any cost advantage for the organization 
B)  All AWS accounts will be charged for S3 storage by combining the total storage of each account 
C)  The EC2 instances of each account will receive a total of 750*3 micro instance hours free 
D)  The free usage tier for all the 3 accounts will be 3 years and not a single year

Question 13

A company has several business units that want to use Amazon EC2. The company wants to require all business units to provision their EC2 instances by using only approved EC2 instance configurations. What should a SysOps administrator do to implement this requirement?

Accepted Answer

A)  Create an EC2 instance launch configuration. Allow the business units to launch EC2 instances by specifying this launch configuration in the AWS Management Console. 
B)  Develop an IAM policy that limits the business units to provision EC2 instances only. Instruct the business units to launch instances by using an AWS CloudFormation template. 
C)  Publish a product and launch constraint role for EC2 instances by using AWS Service Catalog. Allow the business units to perform actions in AWS Service Catalog only. 
D)  Share an AWS CloudFormation template with the business units. Instruct the business units to pass a role to AWS CloudFormation to allow the service to manage EC2 instances.

Question 14

A SysOps Administrator attempting to delete an Amazon S3 bucket ran the following command: aws s3 rb s3://my bucket The command failed and bucket still exists. The administrator validated that no files existed in the bucket by running aws s3 1s s3://mybucket and getting an empty response. Why is the Administrator unable to delete the bucket, and what must be done to accomplish this task?

Accepted Answer

A)  The bucket has MFA Delete enabled, and the Administrator must turn it off. 
B)  The bucket has versioning enabled, and the Administrator must permanently delete the objects' delete markers. 
C)  The bucket is storing files in Amazon Glacier, and the Administrator must wait 3-5 hours for the files to delete. 
D)  The bucket has server-side encryption enabled, and the Administrator must run the aws s3 rb s3://my bucket -- sse command. The bucket has server-side encryption enabled, and the Administrator must run the aws s3 rb s3://my bucket -- sse command.

Question 15

A company uses LDAP-based credentials and has a Security Assertion Markup Language (SAML) 2.0 identity provider. A SysOps administrator has configured various federated roles in a new AWS account to provide AWS Management Console access for groups of users that use the existing LDAP-based credentials. Several groups want to use the AWS CLI on their workstations to automate daily tasks. To enable them to do so, the SysOps administrator has created an application that authenticates a user and generates a SAML assertion Which API call should be used to retrieve credentials for federated programmatic access?

Accepted Answer

A)  sts:AssumeRole 
B)  sts:AssumeRoleWithSAML 
C)  sts:AssumeRoleWithWebIdentity 
D)  sts:GetFederationToken

Question 16

A company wants to store sensitive data in Amazon S3. The S3 bucket and its contents must be accessible only from the on-premises corporate network. What should a SysOps administrator do to configure the S3 bucket policy statement?

Accepted Answer

A)  Use a Deny effect with a condition based on the aws:sourceVpc key. 
B)  Use a Deny effect with a condition based on the NotIpAddress key. 
C)  Use an Allow effect with a condition based on the IpAddress key. 
D)  Use an Allow effect with a condition based on the s3:LocationConstraint key.

Question 17

A user has created a subnet with VPC and launched an EC2 instance in that subnet with only default settings. Which of the below mentioned options is ready to use on the EC2 instance as soon as it is launched?

Accepted Answer

A)  Elastic IP 
B)  Private IP 
C)  Public IP 
D)  Internet gateway

Question 18

A SysOps Administrator must generate a report that provides a breakdown of all API activity by a specific user the course of a year. Given that AWS Cloud Trail was enabled, how can this report be generated?

Accepted Answer

A)  Using the AWS management Console, search for the user name in the CloudTrail history. Then filter by API and download the report in CSV format. 
B)  Use the CloudTrail digest files stored in the company's Amazon S3 bucket. then send the logs to Amazon QuickSight to create the report. 
C)  Locate the monthly reports that CloudTrail sends that are emailed to the account's root user. Then forward the reports to the auditor using a secure channel. 
D)  Access the CloudTrail logs stored in the Amazon S3 bucket tied to Cloud Trail. Use Amazon Athena to extract the information needed to generate the report.

Question 19

A customer has a web application that uses cookie Based sessions to track logged in users. It is deployed on AWS using ELB and Auto Scaling. The customer observes that when load increases. Auto Scaling launches new Instances but the load on the easting Instances does not decrease, causing all existing users have a sluggish experience. Which two answer choices independently describe a behavior that could be the cause of the sluggish user experience? (Choose two.)

Accepted Answer

A)  ELB's normal behavior sends requests from the same user to the same backend instance 
B)  ELB's behavior when sticky sessions are enabled causes ELB to send requests in the same session to the same backend instance 
C)  A faulty browser is not honoring the TTL of the ELB DNS name 
D)  The web application uses long polling such as comet or websockets. Thereby keeping a connection open to a web server tor a long time

Question 20

A company is running critical applications on Amazon EC2 instances. The company needs to ensure its resources are automatically recovered if they become impaired due to an underlying hardware failure. Which service can be used to monitor and recover the EC2 instances?

Accepted Answer

A)  Amazon EC2 Systems Manager 
B)  Amazon Inspector 
C)  AWS CloudFormation 
D)  Amazon CloudWatch

Exam 13: AWS Certified SysOps Administrator (SOA-C01)