Question 1

Which of the following activities is NOT performed by the Auto Scaling policy?

Accepted Answer

A)  Changing instance types 
B)  Scaling up instance counts 
C)  Maintaining current instance levels 
D)  Scaling down instance counts

Question 2

A user has created a VPC with CIDR 20.0.0.0/16. The user has created one subnet with CIDR 20.0.0.0/16 by mistake. The user is trying to create another subnet of CIDR 20.0.0.1/24. How can the user create the second subnet?

Accepted Answer

A)  There is no need to update the subnet as VPC automatically adjusts the CIDR of the first subnet based on the second subnet's CIDR 
B)  The user can modify the first subnet CIDR from the console 
C)  It is not possible to create a second subnet as one subnet with the same CIDR as the VPC has been created 
D)  The user can modify the first subnet CIDR with AWS CLI

Question 3

A SysOps Administrator is writing a utility that publishes resources from an AWS Lambda function in AWS Account A to an Amazon S3 bucket in AWS Account B. The Lambda function is able to successfully write new objects to the S3 bucket, but IAM users in Account B are unable to delete objects written to the bucket by Account A. Which step will fix this issue?

Accepted Answer

A)  Add s3:DeleteObject permission to the IAM execution role of the AWS Lambda function in Account A. Add s3:DeleteObject permission to the IAM execution role of the AWS Lambda function in Account A. 
B)  Change the bucket policy of the S3 bucket in Account B to allow s3:DeleteObject permission for Account A. Change the bucket policy of the S3 bucket in Account B to allow permission for Account A. 
C)  Disable server-side encryption for objects written to the S3 bucket by the Lambda function. 
D)  Call the S3:PutObjectAcl API operation from the Lambda function in Account A to specify bucket owner, full control. Call the S3:PutObjectAcl API operation from the Lambda function in Account A to specify bucket owner, full control.

Question 4

A company has an application running on a fleet of Microsoft Windows instances. Patches to the operating system need to be applied each month. AWS Systems Manager Patch Manager is used to apply the patches on a schedule. When the fleet is being patched, customers complain about delayed service responses.

Accepted Answer

A)  Change the number of instances patched at any one time to 100%. 
B)  Create a snapshot of each server in the fleet using a Systems Manager Automation document before starting the patch process. 
C)  Configure the maintenance window to patch 10% of the instance in the patch group at a time. 
D)  Create a patched Amazon Machine Image (AMI). Configure the maintenance window option to deploy the patched AMI on only 10% of the fleet at a time.

Question 5

Which of the following is true of Amazon CloudWatch?

Accepted Answer

A)  Amazon CloudWatch monitors Amazon Web Services (AWS) resources and the applications that run on AWS in real-time. 
B)  Amazon CloudWatch is a web service that gives businesses an easy and cost effective way to distribute content with low latency and high data transfer speeds. 
C)  Amazon CloudWatch runs code without provisioning or managing servers. 
D)  None of these are true.

Question 6

A user has created an application which will be hosted on EC2. The application makes calls to DynamoDB to fetch certain data. The application is using the DynamoDB SDK to connect with from the EC2 instance. Which of the below mentioned statements is true with respect to the best practice for security in this scenario?

Accepted Answer

A)  The user should attach an IAM role with DynamoDB access to the EC2 instance 
B)  The user should create an IAM user with DynamoDB access and use its credentials within the application to connect with DynamoDB 
C)  The user should create an IAM role, which has EC2 access so that it will allow deploying the application 
D)  The user should create an IAM user with DynamoDB and EC2 access. Attach the user with the application so that it does not use the root account credentials

Question 7

Which of the CloudWatch services mentioned below is NOT a part of the AWS free tier?

Accepted Answer

A)  10 alarms/month 
B)  1 million API request/month 
C)  10 metrics/month 
D)  15 detailed monitoring metrics

Question 8

The InfoSec team has asked the SysOps Administrator to perform some hardening on the company Amazon RDS database instances. Based on this requirement, what actions should be recommended for the start of the security review? (Choose two.)

Accepted Answer

A)  Use Amazon Inspector to present a detailed report of security vulnerabilities across the RDS database fleet 
B)  Review the security group's inbound access rules for least privilege 
C)  Export AWS CloudTrail entries detailing all SSH activity on the RDS instances 
D)  Use the cat command to enumerate the allowed SSH keys in ~/.ssh on each RDS instance 
E)  Report on the Parameter Group settings and ensure that encrypted connections are enforced

Question 9

A company runs a web application that users access using the domain name www.example.com. The company manages the domain name using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application though CloudFront. What is the MOST cost-effective way to achieve this?

Accepted Answer

A)  Create CNAME record in Amazon Route 53 that points to the CloudFront distribution URL. 
B)  Create an ALIAS record in Amazon Route 53 that points to the CloudFront distribution URL. 
C)  Create an A record in Amazon Route 53 that points to the public IP address of the web application. 
D)  Create a PTR record in Amazon Route 53 that points to the public IP address of the web application.

Question 10

A company runs a web application that users access using the domain name www.example.com. The company manages the domain name using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application through CloudFront. What is the MOST cost-effective way to achieve this?

Accepted Answer

A)  Create a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL. 
B)  Create an ALIAS record in Amazon Route 53 that points to the CloudFront distribution URL. 
C)  Create an A record in Amazon Route 53 that points to the public IP address of the web application. 
D)  Create a PTR record in Amazon Route 53 that points to the public IP address of the web application.

Question 11

An e-commerce company wants to lower costs on its nightly jobs that aggregate the current day's sales and store the results in Amazon S3. The jobs are currently run using multiple on-demand instances and the jobs take just under 2 hours to complete. If a job fails for any reason, it needs to be restarted from the beginning. What method is the MOST cost effective based on these requirements?

Accepted Answer

A)  Use a mixture of On-Demand and Spot Instances for job execution. 
B)  Submit a request for a Spot block to be used for job execution. 
C)  Purchase Reserved Instances to be used for job execution. 
D)  Submit a request for a one-time Spot Instance for job execution.

Question 12

When performing an audit on an S3 bucket, a SysOps Administrator discovered that Amazon CloudWatch reports that there are 12,345,678 objects in the bucket, whereas the AWS CLI reports that there are 98,765,432 objects in the same bucket. Which Amazon S3 feature can the SysOps Administrator use to obtain the definitive answer to the number of objects in the bucket?

Accepted Answer

A)  Amazon S3 analytics 
B)  Amazon S3 inventory 
C)  AWS Management Console 
D)  Object tags

Question 13

A user has created a mobile application which makes calls to DynamoDB to fetch certain data. The application is using the DynamoDB SDK and root account access/secret access key to connect to DynamoDB from mobile. Which of the below mentioned statements is true with respect to the best practice for security in this scenario?

Accepted Answer

A)  The user should create a separate IAM user for each mobile application and provide DynamoDB access with it 
B)  The user should create an IAM role with DynamoDB and EC2 access. Attach the role with EC2 and route all calls from the mobile through EC2 
C)  The application should use an IAM role with web identity federation which validates calls to DynamoDB with identity providers, such as Google, Amazon, and Facebook 
D)  Create an IAM Role with DynamoDB access and attach it with the mobile application

Question 14

A SysOps Administrator is tasked with deploying and managing a single CloudFormation template across multiple AWS accounts. What feature of AWS CloudFormation will accomplish this?

Accepted Answer

A)  Change sets 
B)  Nested stacks 
C)  Stack policies 
D)  StackSets

Question 15

A customer is using AWS for Dev and Test. The customer wants to setup the Dev environment with Cloudformation. Which of the below mentioned steps are not required while using Cloudformation?

Accepted Answer

A)  Create a stack 
B)  Configure a service 
C)  Create and upload the template 
D)  Provide the parameters configured as part of the template

Question 16

A SysOps Administrator needs to report on Amazon EC2 instance cost by both project and environment (production, staging, development). Which action would impact the operations team the LEAST?

Accepted Answer

A)  For each project and environment, create a new AWS account and link them to the master payer for unified management and billing 
B)  Use AWS Organizations to create a new organization for each project, then for each environment use a separate linked AWS account 
C)  Implement cost allocation tagging in the Billing and Cost Management console to implement tags to identify resources by project and environment 
D)  Add the project and environment information to the instance metadata so that the values can be queried and rolled up into reports

Question 17

Which of the following services is used to monitor the Amazon Web Services resources?

Accepted Answer

A)  AWS CloudWatch 
B)  AWS Cloudfront 
C)  AWS Monitor 
D)  AWS EC2

Question 18

A user has configured an SSL listener at ELB as well as on the back-end instances. Which of the below mentioned statements helps the user understand ELB traffic handling with respect to the SSL listener?

Accepted Answer

A)  It is not possible to have the SSL listener both at ELB and back-end instances 
B)  ELB will modify headers to add requestor details 
C)  ELB will intercept the request to add the cookie details if sticky session is enabled 
D)  ELB will not modify the headers

Question 19

A streaming company is using AWS resources in the us-east-1 Region for its production environment. The web tier of the streaming site runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group across multiple Availability Zones. The Auto Scaling group is configured to scale when the CPU utilization of the instances is greater than 75%. The user database is hosted on an Amazon RDS MySQL cluster, and video content is stored within an Amazon S3 bucket. Amazon CloudWatch metrics show that the RDS MySQL Multi-AZ DB instance has around 16 GB of memory free and an average CPU utilization of 70%. It is taking users in Asia several seconds longer to access the streaming website. Which combination of actions will improve the access load times? (Choose two.)

Accepted Answer

A)  Configure RDS MySQL Multi-AZ to reduce RDS CPU and RAM utilization and distribute queries to multiple Availability Zones. 
B)  Modify the EC2 Auto Scaling group so it will scale horizontally when CPU utilization is 50%. 
C)  Provision a second production environment in the Asia Pacific Region and use an ALB to distribute cross-Region access. 
D)  Provision a second production environment in the Asia Pacific Region and use Amazon Route 53 latency-based routing. 
E)  Set up an Amazon CloudFront distribution to handle static content for users accessing it from different geographic locations.

Question 20

An organization is using cost allocation tags to find the cost distribution of different departments and projects. One of the instances has two separate tags with the key/ value as "InstanceName/HR", "CostCenter/HR". What will AWS do in this case?

Accepted Answer

A)  InstanceName is a reserved tag for AWS. Thus, AWS will not allow this tag 
B)  AWS will not allow the tags as the value is the same for different keys 
C)  AWS will allow tags but will not show correctly in the cost allocation report due to the same value of the two separate keys 
D)  AWS will allow both the tags and show properly in the cost distribution report

Exam 13: AWS Certified SysOps Administrator (SOA-C01)