Question 1

InfoSec is concerned that an employee may expose sensitive data in an Amazon S3 bucket. How can this concern be addressed without putting undue restrictions on users?

Accepted Answer

A)  Apply an IAM policy on all users that denies the action s3:PutBucketPolicy 
B)  Restrict S3 bucket access to specific IAM roles managed using federated access 
C)  Activate an AWS Config rule to identify public buckets and alert InfoSec using Amazon SNS 
D)  Email the findings of AWS Personal Health Dashboard to InfoSec daily

Question 2

Your team Is excited about the use of AWS because now they have access to programmable Infrastructure" You have been asked to manage your AWS infrastructure in a manner similar to the way you might manage application code You want to be able to deploy exact copies of different versions of your infrastructure, stage changes into different environments, revert back to previous versions, and identify what versions are running at any particular time (development test QA. production). Which approach addresses this requirement?

Accepted Answer

A)  Use cost allocation reports and AWS Opsworks to deploy and manage your infrastructure. 
B)  Use AWS CloudWatch metrics and alerts along with resource tagging to deploy and manage your infrastructure. 
C)  Use AWS Beanstalk and a version control system like GIT to deploy and manage your infrastructure. 
D)  Use AWS CloudFormation and a version control system like GIT to deploy and manage your infrastructure.

Question 3

A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned security policies is supported by ELB?

Accepted Answer

A)  Dynamic Security Policy 
B)  All the other options 
C)  Predefined Security Policy 
D)  Default Security Policy

Question 4

You are tasked with the migration of a highly trafficked Node JS application to AWS in order to comply with organizational standards Chef recipes must be used to configure the application servers that host this application and to support application lifecycle events. Which deployment option meets these requirements while minimizing administrative burden?

Accepted Answer

A)  Create a new stack within Opsworks add the appropriate layers to the stack and deploy the application 
B)  Create a new application within Elastic Beanstalk and deploy this application to a new environment 
C)  Launch a Mode JS server from a community AMI and manually deploy the application to the launched EC2 instance 
D)  Launch and configure Chef Server on an EC2 instance and leverage the AWS CLI to launch application servers and configure those instances using Chef.

Question 5

Which of the following is an incorrect statement about Amazon CloudWatch?

Accepted Answer

A)  You can use CloudWatch to collect and track metrics, which are the variables you want to measure for your resources and applications. 
B)  You can set CloudWatch alarms to send notifications or automatically make changes to the resources you are monitoring, based on rules that you define. 
C)  You can control and monitor all Security Groups and their related rules. 
D)  You gain system-wide visibility into resource utilization, application performance, and operation-al health.

Question 6

A company has deployed a new application running on Amazon EC2 instances. The application team must verify for the Security team that all common vulnerabilities and exposures have been addressed, both now and regularly throughout the application's lifespan. How can the Application team satisfy the Security team's requirement?

Accepted Answer

A)  Perform regular assessments with Amazon Inspector 
B)  Perform regular assessments with AWS Trusted Advisor 
C)  Integrate AWS Personal Health Dashboard with Amazon CloudWatch events to get security notifications 
D)  Grant the Administrator and Security team access to AWS Artifact

Question 7

A SysOps Administrator deployed an AWS Elastic Beanstalk worker node environment that reads messages from an auto-generated Amazon Simple Queue Service (Amazon SQS) queue and deletes them from the queue after processing. Amazon EC2 Auto Scaling scales in and scales out the number of worker nodes based on CPU utilization. After some time, the Administrator notices that the number of messages in the SQS queue are increasing significantly. Which action will remediate this issue?

Accepted Answer

A)  Change the scaling policy to scale based upon the number of messages in the queue. 
B)  Decouple the queue from the Elastic Beanstalk worker node and create it as a separate resource. 
C)  Increase the number of messages in the queue. 
D)  Increase the retention period of the queue.

Question 8

A user has deployed an application on his private cloud. The user is using his own monitoring tool. He wants to configure that whenever there is an error, the monitoring tool should notify him via SMS. Which of the below mentioned AWS services will help in this scenario?

Accepted Answer

A)  None because the user infrastructure is in the private cloud/ 
B)  AWS SNS 
C)  AWS SES 
D)  AWS SMS

Question 9

The information within an IAM policy is described through a series of ______.

Accepted Answer

A)  elements 
B)  macros 
C)  classes 
D)  namespaces

Question 10

An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achieve this?

Accepted Answer

A)  Create an IAM policy with the security group and use that security group for AWS console login 
B)  Create an IAM policy with a condition which denies access when the IP address range is not from the organization 
C)  Configure the EC2 instance security group which allows traffic only from the organization's IP range 
D)  Create an IAM policy with VPC and allow a secure gateway between the organization and AWS Console

Question 11

A user has configured ELB with Auto Scaling. The user suspended the Auto Scaling AlarmNotification which notifies Auto Scaling for CloudWatch alarms. process for a while. What will Auto Scaling do during this period?

Accepted Answer

A)  AWS will not receive the alarms from CloudWatch 
B)  AWS will receive the alarms but will not execute the Auto Scaling policy 
C)  Auto Scaling will execute the policy but it will not launch the instances until the process is resumed 
D)  It is not possible to suspend the AlarmNotification process

Question 12

A company has created a separate AWS account for all development work to protect the production environment. In this development account, developers have permission to manipulate IAM policies and roles. Corporate policies require that developers are blocked from accessing some services. What is the BEST way to grant the developers privileges in the development account while still complying with corporate policies?

Accepted Answer

A)  Create a service control policy in AWS Organizations and apply it to the development account. 
B)  Create a customer managed policy in IAM and apply it to all users within the development account. 
C)  Create a job function policy in IAM and apply it to all users within the development account. 
D)  Create an IAM policy and apply it in API Gateway to restrict the development account.

Question 13

Amazon RDS provides Amazon CloudWatch metrics for your DB Instance deployments at no ad-ditional charge. You can use the AWS Management Console to view key operational metrics for your DB Instance deployments, including ____.

Accepted Answer

A)  I/O activity, DB Instance connections, and number of users 
B)  DB Engine Version Management 
C)  username, I/O activity, and DB Instance connections 
D)  compute/memory/storage capacity utilization, I/O activity, and DB Instance connections

Question 14

______ in VPC are stateful where return traffic is automatically allowed, regardless of any rules.

Accepted Answer

A)  Security groups 
B)  Availability Zones 
C)  Network ACLs 
D)  Geo Redundant Servers

Question 15

In Amazon S3, what is the document that defines who can access a particular bucket or object called?

Accepted Answer

A)  Access Control Record 
B)  Access Control Service 
C)  Access Control List 
D)  Access Control Server

Question 16

What does Amazon SES provide?

Accepted Answer

A)  A managed Email Server 
B)  A scalable anti-spam service 
C)  A scalable email sending and receiving service 
D)  A managed drag-and-drop interface with the AWS CloudFormation Designer

Question 17

A company needs to deploy a web application on two Amazon EC2 instances behind an Application Load Balancer (ALB). Two EC2 instances will also be deployed to host the database. The infrastructure needs to be designed across Availability Zones for high availability and must limit public access to the instances as much as possible. How should this be achieved within a VPC?

Accepted Answer

A)  Create one public subnet for the Application Load Balancer, one public subnet for the web servers, and one private subnet for the database servers. 
B)  Create one public subnet for the Application Load Balancer, two public subnets for the web servers, and two private subnets for the database servers. 
C)  Create two public subnets for the Application Load Balancer, two private subnets for the web servers, and two private subnets for the database servers. 
D)  Create two public subnets for the Application Load Balancer, two public subnets for the web servers, and two public subnets for the database servers.

Question 18

A company has a web application that runs both on-premises and on Amazon EC2 instances. Over time, both the on-premises servers and EC2 instances begin crashing. A SysOps Administrator suspects a memory leak in the application and wants a unified method to monitor memory utilization over time. How can the Administrator track both the EC2 memory utilization and on-premises server memory utilization over time?

Accepted Answer

A)  Write a script or use a third-party application to report memory utilization for both EC2 instances and on-premises servers. 
B)  Use Amazon CloudWatch agent for both Amazon EC2 instances and on-premises servers to report MemoryUtilization metrics to CloudWatch and set a CloudWatch alarm for notifications. 
C)  Use CloudWatch agent for Amazon EC2 instances to report memory utilization to CloudWatch, and set CloudWatch alarms for notifications. Use a third-party application for the on-premises servers. 
D)  Configure a load balancer to route traffic to both on-premises servers and EC2 instances, then use CloudWatch as the unified view of the metrics for the load balancer.

Question 19

A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned SSL protocols is not supported by the security policy?

Accepted Answer

A)  TLS 1.3 
B)  TLS 1.2 
C)  SSL 2.0 
D)  SSL 3.0

Question 20

The billing process for Amazon EC2 instances was updated as of October 2, 2017. Which of the following statements is true regarding how you pay for Amazon EC2 instances? (Choose two.)

Accepted Answer

A)  Payment does not vary based on the instance AMI's operating system. 
B)  You can pay per hour or per second, depending on the instance AMI's operating system. 
C)  You pay for compute capacity by the day; hours are billed in proportion. 
D)  You can pay per hour or per second, depending on the instance type.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)