Question 1

Recently several critical files were mistakenly deleted from a shared Amazon S3 bucket. A SysOps Administrator needs to prevent accidental deletions from occurring in the future by enabling MFA Delete. Once enabled, which bucket activities will require MFA authentication? (Choose two.)

Accepted Answer

A)  Permanently removing an object version from the bucket 
B)  Disabling default object encryption for the bucket 
C)  Listing all versions of deleted objects in the bucket 
D)  Suspending versioning on the bucket 
E)  Enabling MFA Add on the bucket

Question 2

An organization has decided to consolidate storage and move all of its backups and archives to Amazon S3. With all of the data gathered into a hierarchy under a single directory, the organization determines there is 70 TB data that needs to be uploaded. The organization currently has a 150-Mbps connection with 10 people working at the location. Which service would be the MOST efficient way to transfer this data to Amazon S3?

Accepted Answer

A)  AWS Snowball 
B)  AWS Direct Connect 
C)  AWS Storage Gateway 
D)  Amazon S3 Transfer Acceleration

Question 3

What does Amazon Route53 provide?

Accepted Answer

A)  A global Content Delivery Network 
B)  A scalable DNS web service 
C)  An SSH endpoint for Amazon EC2 
D)  None of these

Question 4

Which of the following statements is true of IAM?

Accepted Answer

A)  If you are configuring MFA for a user who will use a smartphone to generate an OTP, you must have the smartphone available in order to finish the wizard. 
B)  If you are configuring MFA for a user who will use a smartphone to generate an OTP, the smartphone is not required in order to finish the wizard. 
C)  If you are configuring MFA for a user who will use a smartphone to generate an OTP, you can finish the wizard on any device and later use the smartphone for authentication. 
D)  None of these are correct.

Question 5

A company developed and now runs a memory-intensive application on multiple Amazon EC2 Linux instances. The memory utilization metrics of the EC2 Linux instances must be monitored. Which combination of actions must be taken to accomplish this? (Choose two.)

Accepted Answer

A)  Enable detailed monitoring on the instance within Amazon CloudWatch. 
B)  Implement an AWS Lambda function to track memory metrics. 
C)  Install Amazon CloudWatch agent to track memory metrics. 
D)  Publish the memory metrics to Amazon CloudWatch Events. 
E)  Publish the memory metrics using Amazon CloudWatch Logs.

Question 6

Which of the following services is offered by CloudWatch?

Accepted Answer

A)  Fixing broken links on the client's instances 
B)  Creating IAM users for all services in AWS 
C)  Monitoring estimated AWS charges 
D)  Balancing the request load between various instances

Question 7

A SysOps administrator needs to register targets for a Network Load Balancer (NLB) using IP addresses. Which prerequisite should the SysOps administrator validate to perform this task?

Accepted Answer

A)  Ensure the NLB listener security policy is set to ELBSecurityPolicy-TLS-1-2-Ext-2018-06, ELBSecurityPolicy-FS-1-2-Res-2019-08, or ELBSecurityPolicy-TLS-1-0-2015-04. 
B)  Ensure the health check setting on the NLB for the Matcher configuration is between 200 and 399. 
C)  Ensure the targets are within any of these CIDR blocks: 10.0.0.0/8 (RFC 1918), 100.64.0.0/10 (RFC 6598), 172.16.0.0/12 (RFC 1918), or 192.168.0.0/16 (RFC 1918). 
D)  Ensure the NLB is exposed as an endpoint service before registering the targets using IP addresses.

Question 8

A SysOps Administrator must evaluate storage solutions to replace a company's current user-shared drives infrastructure. Any solution must support security controls that enable Portable Operating System Interface (POSIX) permissions and Network File System protocols. Additionally, any solution must be accessible from multiple Amazon EC2 instances and on-premises servers connected to the Amazon VPC. Which AWS service meets the user drive requirements?

Accepted Answer

A)  Amazon S3 
B)  Amazon EFS 
C)  Amazon EBS 
D)  Amazon SQS

Question 9

A user wants to make so that whenever the CPU utilization of the AWS EC2 instance is above 90%, the redlight of his bedroom turns on. Which of the below mentioned AWS services is helpful for this purpose?

Accepted Answer

A)  AWS CloudWatch + AWS SES 
B)  AWS CloudWatch + AWS SNS 
C)  None. It is not possible to configure the light with the AWS infrastructure services 
D)  AWS CloudWatch and a dedicated software turning on the light

Question 10

A user is trying to understand the detailed CloudWatch monitoring concept. Which of the below mentioned services does not provide detailed monitoring with CloudWatch?

Accepted Answer

A)  AWS EMR 
B)  AWS RDS 
C)  AWS ELB 
D)  AWS Route53

Question 11

A user is running one instance for only 3 hours every day. The user wants to save some cost with the instance. Which of the below mentioned Reserved Instance categories is advised in this case?

Accepted Answer

A)  The user should not use RI; instead only go with the on-demand pricing 
B)  The user should use the AWS high utilized RI 
C)  The user should use the AWS medium utilized RI 
D)  The user should use the AWS low utilized RI

Question 12

A SysOps Administrator is in the process of setting up a new AWS Storage Gateway. The Storage Gateway activation is failing when the Administrator attempts to activate the Storage Gateway from the Storage Gateway console. What are the potential causes of this error? (Choose two.)

Accepted Answer

A)  The Storage Gateway does not have an upload buffer configured. 
B)  The Storage Gateway does not a backing Amazon S3 bucket configured. 
C)  The Storage Gateway does not a cache volume configured. 
D)  The Storage Gateway does not the correct time. 
E)  The Storage Gateway is not accessible from the Administrator's client over port 80.

Question 13

A SysOps Administrator has an AWS Direct Connect connection in place in region us-east-1, between an AWS account and a data center. The Administrator is now required to connect the data center to a VPC in another AWS Region, us-west-2, which must have consistent network performance and low-latency. What is the MOST efficient and quickest way to establish this connectivity?

Accepted Answer

A)  Create an AWS VPN CloudHub architecture, and use software VPN to connect to the VPC in region us-west-2. 
B)  Create a new Direct Connect connection between the data center and region us-west-2. 
C)  Create a VPC peering connection between the VPC in region us-east-1 and us-west-2, and access the VPC in us-west-2 from the data center. 
D)  Use Direct Connect gateway with the existing Direct Connect connection to connect to the Virtual Private Gateway of the VPC in region us-west-2.

Question 14

A user has launched an EBS backed EC2 instance. What will be the difference while performing the restart or stop/start options on that instance?

Accepted Answer

A)  For restart it does not charge for an extra hour, while every stop/start it will be charged as a separate hour 
B)  Every restart is charged by AWS as a separate hour, while multiple start/stop actions during a single hour will be counted as a single hour 
C)  For every restart or start/stop it will be charged as a separate hour 
D)  For restart it charges extra only once, while for every stop/start it will be charged as a separate hour

Question 15

After a network change, application servers cannot connect to the corresponding Amazon RDS MySQL database. What should the SysOps Administrator analyze?

Accepted Answer

A)  VPC Flow Logs 
B)  Elastic Load Balancing logs 
C)  Amazon CloudFront logs 
D)  Amazon RDS MySQL error logs

Question 16

A SysOps Administrator must ensure all Amazon EBS volumes currently in use, and those created in the future, are encrypted with a specific AWS KMS customer master key (CMK). What is the MOST efficient way for the Administrator to meet this requirement?

Accepted Answer

A)  Create an AWS Lambda function to run on a daily schedule, and have the function run the aws ec2 describe-volumes --filters encrypted command. Create an AWS Lambda function to run on a daily schedule, and have the function run the aws ec2 describe-volumes --filters encrypted command. 
B)  Within AWS Config, configure the encrypted-volumes managed rule and specify the key ID of the CMK. 
C)  Log in to the AWS Management Console on a daily schedule, then filter the list of volumes by encryption status, then export this list. 
D)  Create an AWS Lambda function to run on a daily schedule, and have the function run the aws kms describe-key command. aws kms describe-key command.

Question 17

A company is creating an application that will keep records. The application will run on Amazon EC2 instances and will use an Amazon Aurora MySQL database as its data store. To maintain compliance, the application must not retain information that is determined to be sensitive. Which technique should a SysOps administrator use to detect if sensitive data is being stored in the application?

Accepted Answer

A)  Export data from the database by using an AWS Lambda function. Store the data in Amazon S3. Use Amazon Macie to examine the stored data. Examine the report for any sensitive data that is discovered. 
B)  Install the Amazon GuardDuty plugin for Aurora. Configure GuardDuty to examine the database. Add the corresponding EC2 CIDR ranges to the trusted IP list in GuardDuty. Examine the report for any sensitive data that is discovered. 
C)  Deploy Amazon Inspector by installing the Amazon Inspector agent on all EC2 instances. Set the Amazon Inspector assessment type to HOST assessment. Include NETWORK communications with the Aurora DB cluster. Examine the report for any sensitive data that is discovered. 
D)  Use VPC Flow Logs to examine traffic between the EC2 instances and the Aurora DB cluster. Store the log files in Amazon S3. Use Amazon Detective to examine the extracted log files. Examine the report for any sensitive data that is discovered.

Question 18

A block device is a storage device that moves data in sequences. How many types of block devices does Amazon EC2 support?

Accepted Answer

A)  2 -instance store volumes and EBS volumes 
B)  5 -General Purpose SSD, Provisioned IOPS SSD, Throughput Optimized HDD, Cold HDD, and Magnetic 
C)  3 -SSD, HDD, and Magnetic 
D)  1 -instance store volumes

Question 19

A user has created a queue named "myqueue" with SQS. There are four messages published to queue which are not received by the consumer yet. If the user tries to delete the queue, what will happen?

Accepted Answer

A)  A user can never delete a queue manually. AWS deletes it after 30 days of inactivity on queue 
B)  It will delete the queue 
C)  It will initiate the delete but wait for four days before deleting until all messages are deleted automatically. 
D)  It will ask user to delete the messages first

Question 20

A sysops administrator has an AWS Lambda function that performs maintenance on various AWS resources. This function must be run nightly. Which is the MOST cost-effective solution?

Accepted Answer

A)  Launch a single t2.nano Amazon EC2 instance and create a Linux cron job to invoke the Lambda function at the same time every night. 
B)  Set up an Amazon CloudWatch metrics alarm to invoke the Lambda function at the same time every night. 
C)  Schedule a CloudWatch event to invoke the Lambda function at the same time every night. 
D)  Implement a Chef recipe in AWS OpsWorks stack to invoke the Lambda function at the same time every night.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)