Question 1

A Systems Administrator is responsible for maintaining custom, approved AMIs for a company. These AMIs must be shared with each of the company's AWS accounts. How can the Administrator address this issue?

Accepted Answer

A)  Contact AWS Support for sharing AMIs with other AWS accounts. 
B)  Modify the permissions on the AMIs so that they are publicly accessible. 
C)  Modify the permissions on the IAM role that are associated with the AMI. 
D)  Share the AMIs with each AWS account using the console or CLI.

Question 2

A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80) and a DB server in the private subnet (port 3306). The user is configuring a security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp). Which of the below mentioned entries is required in the web server security group (WebSecGrp)?

Accepted Answer

A)  Configure Destination as DB Security group ID (DbSecGrp) for port 3306 Outbound 
B)  80 for Destination 0.0.0.0/0 Outbound 
C)  Configure port 3306 for source 20.0.0.0/24 InBound 
D)  Configure port 80 InBound for source 20.0.0.0/16

Question 3

A user is trying to setup a security policy for ELB. The user wants ELB to meet the cipher supported by the client by configuring the server order preference in ELB security policy. Which of the below mentioned preconfigured policies supports this feature?

Accepted Answer

A)  ELBSecurity Policy-2014-01 
B)  ELBSecurity Policy-2011-08 
C)  ELBDefault Negotiation Policy 
D)  ELBSample- OpenSSLDefault Cipher Policy

Question 4

A security policy allows instances in the Production and Development accounts to write application logs to an Amazon S3 bucket belonging to the Security team's account. Only the Security team should be allowed to delete logs from the S3 bucket. Using the "myAppRole" EC2 role, the production and development teams report that the application servers are not able to write to the S3 bucket. Which changes need to be made to the policy to allow the application logs to be written to the S3 bucket? Production Account: 111111111111 Dev Account: 222222222222 Security Account: 555555555555

Accepted Answer

A)  Update the Action for the Allow policy from "s3:*" to "s3:PutObject" 
B)  Change the order of the statements in the bucket policy, moving the Deny policy above the Allow policy. 
C)  Update the Action for the Deny policy from "s3:*" to "s3: Delete*". 
D)  Remove the bucket policy, because the default security behavior will not allow objects to be deleted by non bucket owners.

Question 5

A company has deployed a NAT instance to allow web servers to obtain software updates from the internet. There is high latency on the NAT instance as the network grows. A SysOps Administrator needs to reduce latency on the instance in a manner that is efficient, cost-effective, and allows for scaling with future demand. Which action should be taken to accomplish this?

Accepted Answer

A)  Add a second NAT instance and place both instances behind a load balancer 
B)  Convert the NAT instance to a larger instance size 
C)  Replace the NAT instance with a NAT gateway 
D)  Replace the NAT instance with a virtual private gateway

Question 6

How can an EBS volume that is currently attached to an EC2 instance be migrated from one Availability Zone to another?

Accepted Answer

A)  Simply create a new volume in the other AZ and specify the original volume as the source. 
B)  Detach the volume, then use the ec2-migrate-volume command to move it to another AZ. 
C)  Create a snapshot of the volume, and create a new volume from the snapshot in the other AZ. 
D)  Detach the volume and attach it to another EC2 instance in the other AZ.

Question 7

A user has created a VPC with CIDR 20.0.0.0/24. The user has created a public subnet with CIDR 20.0.0.0/25 and a private subnet with CIDR 20.0.0.128/25. The user has launched one instance each in the private and public subnets. Which of the below mentioned options cannot be the correct IP address (private IP. assigned to an instance in the public or private subnet?

Accepted Answer

A)  20.0.0.255 
B)  20.0.0.132 
C)  20.0.0.122 
D)  20.0.0.55

Question 8

Can you configure multiple Load Balancers with a single Auto Scaling group?

Accepted Answer

A)  Yes, you can provide the ELB is configured with Amazon AppStream. 
B)  No 
C)  Yes 
D)  Yes, you can but only if it is configured with Amazon Redshift.

Question 9

A company needs to migrate an on-premises asymmetric key management system into AWS. Which AWS service should be used to accomplish this?

Accepted Answer

A)  AWS Certificate Manager 
B)  AWS CloudHSM 
C)  AWS KMS 
D)  AWS Secrets Manager

Question 10

A local agency plans to deploy 500 Raspberry Pi devices throughout a city. All the devices need to be managed centrally, and their configurations need to be consistent. What is the BEST service for managing these devices?

Accepted Answer

A)  AWS Config 
B)  AWS Systems Manager 
C)  Amazon Inspector 
D)  AWS Service Catalog

Question 11

Can you use CloudWatch to monitor memory and disk utilization usage for your Amazon EC2 Linux instances?

Accepted Answer

A)  CloudWatch can only measure memory usage. 
B)  CloudWatch can only collect memory and disk usage metrics when an instance is running. 
C)  It is possible only on Linux EC2 instances using the CloudWatch Monitoring scripts for Linux. 
D)  CloudWatch can only measure disk usage.

Question 12

You have two Elastic Compute Cloud (EC2) instances inside a Virtual Private Cloud (VPC) in the same Availability Zone (AZ) but in different subnets. One instance is running a database and the other instance an application that will interface with the database. You want to confirm that they can talk to each other for your application to work properly. Which two things do we need to confirm in the VPC settings so that these EC2 instances can communicate inside the VPC? (Choose two.)

Accepted Answer

A)  A network ACL that allows communication between the two subnets. 
B)  Both instances are the same instance class and using the same Key-pair. 
C)  That the default route is set to a NAT instance or internet Gateway (IGW) for them to communicate. 
D)  Security groups are set to allow the application host to talk to the database on the right port/protocol.

Question 13

A photo-sharing site delivers content worldwide from a library on Amazon S3 using Amazon CloudFront. Users are trying to access photos that either do not exist or they are not authorized to view. What should be monitored to better understand the extent of this issue?

Accepted Answer

A)  GetRequests S3 metric on Amazon CloudWatch GetRequests S3 metric on Amazon CloudWatch 
B)  4XXErrorRate CloudFront metric on CloudWatch 4XXErrorRate CloudFront metric on CloudWatch 
C)  5XXErrorRate CloudFront metric on CloudWatch 5XXErrorRate 
D)  PostRequests S3 metric on CloudWatch PostRequests S3 metric on CloudWatch

Question 14

A user has configured the Auto Scaling group with the minimum capacity as 3 and the maximum capacity as 5. When the user configures the AS group, how many instances will Auto Scaling launch?

Accepted Answer

A)  3 
B)  0 
C)  5 
D)  2

Question 15

A user has setup Auto Scaling with ELB on the EC2 instances. The user wants to configure that whenever the CPU utilization is below 10%, Auto Scaling should remove one instance. How can the user configure this?

Accepted Answer

A)  The user can get an email using SNS when the CPU utilization is less than 10%. The user can use the desired capacity of Auto Scaling to remove the instance 
B)  Use CloudWatch to monitor the data and Auto Scaling to remove the instances using scheduled actions 
C)  Configure CloudWatch to send a notification to Auto Scaling Launch configuration when the CPU utilization is less than 10% and configure the Auto Scaling policy to remove the instance 
D)  Configure CloudWatch to send a notification to the Auto Scaling group when the CPU Utilization is less than 10% and configure the Auto Scaling policy to remove the instance

Question 16

A user is planning to set up the Multi AZ feature of RDS. Which of the below mentioned conditions won't take advantage of the Multi AZ feature?

Accepted Answer

A)  Availability zone outage 
B)  A manual failover of the DB instance using Reboot with failover option 
C)  Region outage 
D)  When the user changes the DB instance's server type

Question 17

A user has launched an EC2 instance store backed instance in the US-East-1a zone. The user created AMI #1 and copied it to the Europe region. After that, the user made a few updates to the application running in the US-East-1a zone. The user makes an AMI#2 after the changes. If the user launches a new instance in Europe from the AMI #1 copy, which of the below mentioned statements is true?

Accepted Answer

A)  The new instance will have the changes made after the AMI copy as AWS just copies the reference of the original AMI during the copying. Thus, the copied AMI will have all the updated data 
B)  The new instance will have the changes made after the AMI copy since AWS keeps updating the AMI 
C)  It is not possible to copy the instance store backed AMI from one region to another 
D)  The new instance in the EU region will not have the changes made after the AMI copy

Question 18

A SysOps administrator needs a secure way to connect to AWS Key Management Service (AWS KMS) within a VPC. The SysOps administrator must ensure that connections to AWS KMS do not traverse the internet. What is the MOST secure solution that meets these requirements?

Accepted Answer

A)  Use a bastion host to connect to AWS KMS. 
B)  Use a NAT gateway to connect to AWS KMS. 
C)  Use a VPC gateway endpoint for Amazon S3 to connect to AWS KMS. 
D)  Use a VPC interface endpoint to connect to AWS KMS.

Question 19

A company has a web application that is deployed in a VPC. Inbound traffic to this web application comes in through an internet gateway and arrives at a Network Load Balancer (NLB). From there, the traffic travels to multiple Amazon EC2 instances in two private subnets. The company wants to perform deep packet inspection on the inbound traffic to identify potential hacking attempts. Which solution meets these requirements?

Accepted Answer

A)  Configure AWS Shield for the VPC. 
B)  Use AWS Network Firewall on the VPC. Configure Network Firewall to perform deep packet inspection. 
C)  Use AWS Network Firewall on the subnets. Configure Network Firewall to perform deep packet inspection. 
D)  Set up Traffic Mirroring on an inbound port of the NLB.

Question 20

A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. The bucket has both AWS. j p g and index.html objects. What does this policy define?

Accepted Answer

A)  It will make all the objects as well as the bucket public 
B)  It will throw an error for the wrong action and does not allow to save the policy 
C)  It will make the AWS. j p g object as public 
D)  It will make the AWS. j p g as well as the cloudacademy bucket as public

Exam 13: AWS Certified SysOps Administrator (SOA-C01)