Question 1

A gaming application is deployed on four Amazon EC2 instances in a default VPC. The SysOps Administrator has noticed consistently high latency in responses as data is transferred among the four instances. There is no way for the Administrator to alter the application code. The MOST effective way to reduce latency is to relaunch the EC2 instances in:

Accepted Answer

A)  a dedicated VPC. 
B)  a single subnet inside the VPC. 
C)  a placement group. 
D)  a single Availability Zone.

Question 2

A company has an application that is running on an Amazon EC2 instance in one Availability Zone. A SysOps administrator needs to make the application highly available. The SysOps administrator has created a launch configuration from the running EC2 instance. The SysOps administrator also has properly configured a load balancer. What should the SysOps administrator do next to make the application highly available?

Accepted Answer

A)  Create an Auto Scaling group by using the launch configuration across at least two Availability Zones. Configure a minimum capacity of 1, a desired capacity of 1, and a maximum capacity of 1. 
B)  Create an Auto Scaling group by using the launch configuration across at least three Availability Zones. Configure a minimum capacity of 2, a desired capacity of 2, and a maximum capacity of 2. 
C)  Create an Auto Scaling group by using the launch configuration across at least two AWS Regions. Configure a minimum capacity of 1, a desired capacity of 1, and a maximum capacity of 1. 
D)  Create an Auto Scaling group by using the launch configuration across at least three AWS Regions. Configure a minimum capacity of 2, a desired capacity of 2, and a maximum capacity of 2.

Question 3

A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other?

Accepted Answer

A)  Destination : 20.0.0.0/24 and Target : VPC 
B)  Destination : 20.0.0.0/16 and Target : ALL 
C)  Destination : 20.0.0.0/0 and Target : ALL 
D)  Destination : 20.0.0.0/24 and Target : Local

Question 4

You need to set up security for your VPC and you know that Amazon VPC provides two features that you can use to increase security for your VPC: Security groups and network access control lists (ACLs). You start to look into security groups first. Which statement below is incorrect in relation to security groups?

Accepted Answer

A)  Are stateful: Return traffic is automatically allowed, regardless of any rules. 
B)  Support addition of individual allow and deny rules in both inbound and outbound. 
C)  Security Groups can be added or removed from EC2 instances in a VPC at any time. 
D)  Evaluate all rules before deciding whether to allow traffic.

Question 5

An organization (account ID 123412341234) has configured the IAM policy to allow the user to modify his credentials. What will the below mentioned statement allow the user to perform?

Accepted Answer

A)  The IAM policy will throw an error due to an invalid resource name 
B)  The IAM policy will allow the user to subscribe to any IAM group 
C)  Allow the IAM user to update the membership of the group called TestingGroup 
D)  Allow the IAM user to delete the TestingGroup

Question 6

A developer created a new application that uses Spot Fleet for a variety of instance families across multiple Availability Zones. What should the developer do to ensure that the Spot Fleet is configured for cost optimization?

Accepted Answer

A)  Deploy a capacityOptimized allocation strategy for provisioning Spot Instances. 
B)  Ensure instance capacity by specifying the desired target capacity and how much of that capacity must be On-Demand. 
C)  Use the lowestPrice allocation strategy with InstancePoolsToUseCount in the Spot Fleet request. 
D)  Launch instances up to the Spot Fleet target capacity or the maximum acceptable payment amount.

Question 7

A sysops administrator must monitor a fleet of Amazon EC2 Linux instances with the constraint that no agents be installed. The sysops administrator chooses Amazon CloudWatch as the monitoring tool. Which metrics can be measured given the constraints? (Choose three.)

Accepted Answer

A)  CPU Utilization 
B)  Disk Read Operations 
C)  Memory Utilization 
D)  Network Packets In 
E)  Network Packets Dropped
F) CPU Ready Time

Question 8

A user has created a VPC with the public subnet. The user has created a security group for that VPC. Which of the below mentioned statements is true when a security group is created?

Accepted Answer

A)  It can connect to the AWS services, such as S3 and RDS by default 
B)  It will have all the inbound traffic by default 
C)  It will have all the outbound traffic by default 
D)  It will by default allow traffic to the internet gateway

Question 9

A company has an asynchronous nightly process that feeds the results to a data warehouse system for weekly and monthly reporting. The process is running on a fleet of Amazon EC2 instances. A SysOps Administrator has been asked to identify ways to reduce the cost of running this process. What is the MOST cost-effective solution?

Accepted Answer

A)  Use On-Demand EC2 instances in an Auto Scaling group 
B)  Use Spot Instances to bid for the EC2 instances 
C)  Use Reserved Instances to ensure the capacity 
D)  Put the EC2 instances in a placement group

Question 10

A user has enabled the CloudWatch alarm to estimate the usage charges. If the user disables moni-toring of the estimated charges but does not delete the billing alert from the AWS account, what will happen?

Accepted Answer

A)  The user cannot edit the existing billing alarm. 
B)  The data collection on estimated charges is stopped. 
C)  It is not possible to disable monitoring of the estimated charges. 
D)  AWS will stop sending the billing alerts to the user.

Question 11

A SysOps administrator wants to encrypt an existing Amazon RDS DB instance with AWS Key Management Service (AWS KMS). How should the SysOps administrator accomplish this goal?

Accepted Answer

A)  Copy the data volumes of the unencrypted instance. Apply the KMS key to the copied data volumes. Start the instance with the encrypted volumes. 
B)  Create a read replica of the unencrypted instance. Encrypt the read replica with the KMS key. Promote the read replica to become the primary instance. 
C)  Take a snapshot of the unencrypted instance. Apply the KMS key to the existing instance using the modify-db-instance command. Restart the instance. 
D)  Take a snapshot of the unencrypted instance. Create an encrypted copy of the snapshot with the KMS key. Restore the instance from the encrypted snapshot.

Question 12

An application is being developed that will be served across a fleet of Amazon EC2 instances, which require a consistent view of persistent data. Items stored vary in size from 1KB to 300MB; the items are read frequently, created occasionally, and often require partial changes without conflict. The data store is not expected to grow beyond 2TB, and items will be expired according to age and content type. Which AWS service solution meets these requirements?

Accepted Answer

A)  Amazon S3 buckets with lifecycle policies to delete old objects. 
B)  Amazon RDS PostgreSQL and a job that deletes rows based on age and file type columns. 
C)  Amazon EFS and a scheduled process to delete files based on age and extension. 
D)  An EC2 instance store synced on boot from a central Amazon EBS-backed instance.

Question 13

You have been asked to design a layered security solution for protecting your organization's net-work infrastructure. You research several options and decide to deploy a network-level security con-trol appliance, inline, where traffic is intercepted and analyzed prior to being forwarded to its final destination, such as an application server. Which of the following is NOT considered an inline threat protection technology?

Accepted Answer

A)  Intrusion prevention systems 
B)  Third-party firewall devices installed on Amazon EC2 instances 
C)  Data loss management gateways 
D)  Augmented security groups with Network ACLs

Question 14

An Amazon S3 bucket in a SysOps Administrator's account can be accesses by users in other SWS accounts. How can the Administrator ensure that the bucket is only accessible to members of the Administrator's AWS account?

Accepted Answer

A)  Move the S3 bucket from a public subnet to a private subnet in the Amazon VPC. 
B)  Change the bucket access control list (ACL) to restrict access to the bucket owner. 
C)  Enable server-side encryption for all objects in the bucket. 
D)  Use only Amazon S3 presigned URLs for accessing objects in the bucket.

Question 15

A SysOps Administrator has configured health checks on a load balancer. An Amazon EC2 instance attached to this load balancer fails the health check. What will happen next? (Choose two.)

Accepted Answer

A)  The load balancer will continue to perform the health check on the EC2 instance. 
B)  The EC2 instance will be terminated based on the health check failure. 
C)  The EC2 instance will be rebooted. 
D)  The load balancer will stop sending traffic to the EC2 instance. 
E)  A new EC2 instance will be deployed to replace the unhealthy instance.

Question 16

A company website hosts patches for software that is sold globally. The website runs in AWS and performs well until a large software patch is released. The flood of downloads puts a strain on the web servers and leads to a poor customer experience. What can the Sysops Administrator propose to enhance customer experience, create a more available web platform, and keep costs low?

Accepted Answer

A)  Use an Amazon CloudFront distribution to cache static content, including software patches. 
B)  Increase the size of the NAT instance to improve throughput. 
C)  Scale out the web servers in advance of patch releases to reduce Auto Scaling delays. 
D)  Move the content to IO1 and provision additional IOPS to the volume that contains the software patches.

Question 17

A user is configuring a CloudWatch alarm on RDS to receive a notification when the CPU utilization of RDS is higher than 50%. The user has setup an alarm when there is some inactivity on RDS, such as RDS unavailability. How can the user configure this?

Accepted Answer

A)  Setup the notification when the CPU is more than 75% on RDS 
B)  Setup the notification when the state is Insufficient Data 
C)  Setup the notification when the CPU utilization is less than 10% 
D)  It is not possible to setup the alarm on RDS

Question 18

You have private video content in S3 that you want to serve to subscribed users on the Internet. User IDs, credentials, and subscriptions are stored in an Amazon RDS database. Which configuration will allow you to securely serve private content to your users?

Accepted Answer

A)  Generate pre-signed URLs for each user as they request access to protected S3 content 
B)  Create an IAM user for each subscribed user and assign the GetObject permission to each IAM user 
C)  Create an S3 bucket policy that limits access to your private content to only your subscribed users' credentials 
D)  Create a CloudFront Origin Identity user for your subscribed users and assign the GetObject permission to this user

Question 19

An organization is measuring the latency of an application every minute and storing data inside a file in the JSON format. The organization wants to send all latency data to AWS CloudWatch. How can the organization achieve this?

Accepted Answer

A)  The user has to parse the file before uploading data to CloudWatch 
B)  It is not possible to upload the custom data to CloudWatch 
C)  The user can supply the file as an input to the CloudWatch command 
D)  The user can use the CloudWatch Import command to import data from the file to CloudWatch

Question 20

A user is collecting 1000 records per second. The user wants to send the data to CloudWatch using a custom namespace. Which of the below mentioned options is recommended for this activi-ty?

Accepted Answer

A)  Create one csv file of all the data and send a single file to CloudWatch 
B)  Aggregate the data with statistics, such as Min, max, Average, Sum and Sample data and send the data to CloudWatch 
C)  It is not possible to send all the data in one call. Thus, it should be sent one by one. CloudWatch will aggregate the data automatically 
D)  Send all the data values to CloudWatch in a single command by separating them with a comma. CloudWatch will parse automatically

Exam 13: AWS Certified SysOps Administrator (SOA-C01)