AWS Certified CloudOps Engineer - Associate SOA-C03 Practice Exam
QuestionQ1
Security and Compliance
Save question
A company intends to host a public web application on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. The company’s security team wants to secure the website with AWS Certificate Manager (ACM) certificates. The load balancer must automatically redirect all HTTP requests to HTTPS.
Which solution meets these requirements?
ACreate an Application Load Balancer that has one HTTPS listener on port 80. Attach an SSL/TLS certificate to listener port 80. Create a rule to redirect requests from HTTP to HTTPS.
BCreate an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
CCreate an Application Load Balancer that has two TCP listeners on port 80 and port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
DCreate a Network Load Balancer that has two TCP listeners on port 80 and port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
0
Community Discussion
No comments yet. Be the first to start the discussion!
QuestionQ2
Deployment, Provisioning, and Automation
0
Community Discussion
No comments yet. Be the first to start the discussion!
QuestionQ3
Reliability and Business Continuity
0
Community Discussion
No comments yet. Be the first to start the discussion!
QuestionQ4
Security and Compliance
0
Community Discussion
No comments yet. Be the first to start the discussion!
QuestionQ5
Networking and Content Delivery
0
Community Discussion
No comments yet. Be the first to start the discussion!
It's free
100% of the questions are free for all users. No strings attached.
Monitoring, Logging, Analysis, Remediation, and Performance OptimizationReliability and Business ContinuityDeployment, Provisioning, and AutomationSecurity and ComplianceNetworking and Content Delivery
A CloudOps engineer is reviewing the following AWS CloudFormation template:
Why does creation of the stack fail?
AThe Outputs section of the CloudFormation template was omitted.
BThe Parameters section of the CloudFormation template was omitted.
CThe PrivateDnsName cannot be sot from a CloudFormation template.
DThe VPC was not specified in the CloudFormation template.
A company is implementing Cross-Region Replication (CRR) for its Amazon S3 buckets. The S3 buckets are in the us-east-1 Region. The company uses server-side encryption with Amazon S3 managed keys (SSE-S3) to protect the data in the buckets.
A CloudOps engineer creates a new AWS account to store backups in S3 buckets. All backup buckets are in the us-west-2 Region. The CloudOps engineer enables versioning on both the source buckets and destination buckets. The CloudOps engineer creates an IAM role in the source account for s3.amazonaws.com. The CloudOps engineer grants the IAM role permissions to perform read actions in the source buckets, replicate actions in the destination buckets, and encrypt actions using the destination bucket's key. The destination bucket policy allows the IAM role to perform replicate and read actions.
After completing the replication configuration, the CloudOps engineer notices that objects are not replicating.
What is the likely reason that the objects are not replicating?
AThe IAM role and bucket policies must have the ObjectOwnerOverrideToBucketOwner permission.
BThe objects in the source buckets and destination buckets must be encrypted by multi-Region keys.
CGateway VPC endpoints for Amazon S3 must be created in the source accounts and the destination account.
DThe destination buckets must use server-side encryption with AWS KMS keys (SSE-KMS).
A CloudOps engineer needs to create an IAM policy for a developer who requires access to particular AWS services. Based on these requirements, the CloudOps engineer creates the following policy:
Which actions are allowed by this policy?
Choose two
ACreate an AWS Storage Gateway.
BCreate an IAM role for an AWS Lambda function.
CDelete an Amazon SQS queue.
DDescribe AWS load balancers.
EInvoke an AWS Lambda function.
A CloudOps engineer created a VPC containing a public subnet and a private subnet. Amazon EC2 instances launched in the private subnet cannot reach the internet. The default network ACL is active for every subnet in the VPC, and every security group permits all outbound traffic.
Which solution will give the EC2 instances in the private subnet internet access?
ACreate a NAT gateway in the public subnet. Create a route from the private subnet to the NAT gateway.
BCreate a NAT gateway in the public subnet. Create a route from the public subnet to the NAT gateway.
CCreate a NAT gateway in the private subnet. Create a route from the public subnet to the NAT gateway.
DCreate a NAT gateway in the private subnet. Create a route from the private subnet to the NAT gateway.
QuestionQ6
Deployment, Provisioning, and Automation
0
Community Discussion
No comments yet. Be the first to start the discussion!
QuestionQ7
Monitoring, Logging, Analysis, Remediation, and Performance Optimization
QuestionQ8
Monitoring, Logging, Analysis, Remediation, and Performance Optimization
QuestionQ9
Monitoring, Logging, Analysis, Remediation, and Performance Optimization
QuestionQ10
Deployment, Provisioning, and Automation
QuestionQ11
Networking and Content Delivery
QuestionQ12
Networking and Content Delivery
QuestionQ13
Security and Compliance
QuestionQ14
Reliability and Business Continuity
QuestionQ15
Security and Compliance
QuestionQ16
Security and Compliance
QuestionQ17
Monitoring, Logging, Analysis, Remediation, and Performance Optimization
QuestionQ18
Security and Compliance
QuestionQ19
Security and Compliance
QuestionQ20
Reliability and Business Continuity
QuestionQ21
Monitoring, Logging, Analysis, Remediation, and Performance Optimization
QuestionQ22
Reliability and Business Continuity
QuestionQ23
Reliability and Business Continuity
QuestionQ24
Reliability and Business Continuity
QuestionQ25
Security and Compliance
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Ad
Want a break from the ads?
Go ad-free and unlock Learn Mode, Exam Mode, AstroTutor AI and every premium tool — everything you need to walk in prepared, and confident.
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
A CloudOps engineer has successfully deployed a VPC by using an AWS CloudFormation template. The CloudOps engineer needs to deploy that same template across multiple accounts managed through AWS Organizations.
Which solution meets this requirement with the LEAST operational overhead?
AAssume the OrganizationAccountAccessRole IAM role from the management account. Deploy the template in each of the accounts.
BCreate an AWS Lambda function to assume a role in each account. Deploy the template by using the AWS CloudFormation CreateStack API call.
CCreate an AWS Lambda function to query for a list of accounts. Deploy the template by using the AWS CloudFormation CreateStack API call.
DUse AWS CloudFormation StackSets from the management account to deploy the template in each of the accounts.
A CloudOps engineer needs to troubleshoot performance problems for a web application delivered through Amazon CloudFront. Metrics show a consistently low cache hit ratio, causing many requests to be forwarded to the origin.
Which configuration will increase the cache hit ratio?
AModify the origin's Cache-Control header to max-age=0.
BReduce the TTL for cached objects.
CReduce the number of request headers, query strings, and cookies included in the cache key.
DConfigure signed URLs or signed cookies to restrict access to content.
A company must monitor the availability of its website for end users. The company requires a solution that sends an Amazon Simple Notification Service (Amazon SNS) notification when the website's uptime falls below 99%. The monitoring must deliver an accurate representation of the website user experience.
Which solution meets these requirements?
ACreate an Amazon CloudWatch alarm that is based on the website’s logs that are published to a CloudWatch Logs log group. Configure the alarm to publish an SNS notification if the number of HTTP 4xx errors and 5xx errors exceeds a specified threshold.
BCreate an Amazon CloudWatch alarm that is based on the website's published metrics in CloudWatch. Configure the alarm to publish an SNS notification that is based on anomaly detection.
CCreate an Amazon CloudWatch Synthetics heartbeat monitoring canary. Associate the canary with the website's URL for end users. Create a CloudWatch alarm for the canary. Configure the alarm to publish an SNS notification if the value of the SuccessPercent metric is less than 99%.
DCreate an Amazon CloudWatch Synthetics broken link checker monitoring canary. Associate the canary with the website's URL for end users. Create a CloudWatch alarm for the canary. Configure the alarm to publish an SNS notification if the value of the SuccessPercent metric is less than 99%.
A company uses AWS Systems Manager to automate tasks across AWS accounts. It uses monitoring tools to identify issues and creates a Systems Manager Automation runbook that runs an AWS Lambda function to remediate those issues.
At first, the company runs the runbook manually. The company now wants the runbook to run automatically whenever its monitoring tools detect issues.
Which solution meets this requirement?
AConfigure the monitoring tools to publish findings to Amazon EventBridge. Create an EventBridge rule that invokes the runbook in response to events from the monitoring tools.
BConfigure the monitoring tools to send findings to an Amazon SNS topic. Subscribe the runbook to the SNS topic. Invoke the runbook when a message is received.
CConfigure the monitoring tools to write findings to Amazon CloudWatch Logs. Create a CloudWatch Logs subscription filter that invokes the runbook when new log entries are detected.
DConfigure AWS Config to assess the resources and publish configuration changes to Amazon EventBridge. Create a rule to invoke the runbook in response to configuration change events.
A company operates multiple Amazon EC2 instances that use the Ubuntu operating system (OS). The company must patch the OS on a regular basis. A CloudOps engineer manually installs patches each week. The company continually adds new EC2 instances running Ubuntu. The CloudOps engineer must automate the patching process.
Which solution meets this requirement in the MOST operationally efficient manner?
ACreate an AWS Lambda function to connect to the EC2 instances by using SSH and to install the patches. Configure the Lambda function to run every week.
BInstall the AWS Systems Manager Agent (SSM Agent) on the EC2 instances. Configure Systems Manager Patch Manager to install patches on the instances every week.
CUse AWS Systems Manager Inventory to identify unpatched EC2 instances and to install OS patches.
DCreate an Amazon EventBridge rule that has a cron expression to install the patches every week. Configure the EventBridge rule to target the EC2 instances. Configure an action to run OS updates on the targeted instances.
A CloudOps engineer cannot launch Amazon EC2 instances into a VPC because the VPC has no available private IPv4 addresses.
Which combination of actions must the CloudOps engineer perform to launch the instances?
Choose two
AAssociate a secondary IPv4 CIDR block with the VPC.
BAssociate a primary IPv6 CIDR block with the VPC.
CCreate a new subnet for the VPC.
DModify the CIDR block of the VPC.
EModify the CIDR block of the subnet that is associated with the instances.
A retail company operates a web application. The application uses an Application Load Balancer (ALB) to distribute traffic among multiple Amazon EC2 instances across two Availability Zones. The application receives high traffic during flash sales. The company must ensure that requests are distributed evenly across all healthy instances. In addition, the company needs session persistence for shopping cart functionality.
Which configuration satisfies these requirements with the LEAST administrative effort?
AConfigure the ALB target group to use the round robin algorithm. Enable stickiness and cross-zone load balancing.
BSwitch the ALB to a Network Load Balancer. Modify the target group to use the least outstanding requests algorithm. Enable stickiness. Disable cross-zone load balancing.
CConfigure the ALB target group to use the weighted round robin algorithm. Implement session persistence by using AWS Lambda functions to store session data in Amazon DynamoDB.
DConfigure the ALB listener with path-based routing to direct shopping cart requests to a dedicated target group with sticky sessions. Use the round robin algorithm without stickiness for a second target group.
A company operating multiple workloads on AWS wants to improve its security posture by implementing DNS-based threat protection. The company needs to block DNS-based attacks.
Which solution meets this requirement?
ADeploy AWS Shield Advanced to filter and block malicious DNS queries. Set up domain filtering policies.
BUse AWS WAF to inspect DNS traffic for malicious domains. Create custom rules to block known threats.
CConfigure Amazon Route 53 Resolver to forward DNS queries to Route 53 Resolver DNS Firewall Advanced to detect and filter threats.
DConfigure AWS Config to monitor DNS queries and DNS traffic patterns. Use an AWS Lambda function to prevent access to malicious domains.
A CloudOps engineer used AWS CloudFormation to deploy a serverless application in a production VPC. The application includes an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway API. The CloudOps engineer needs to delete the AWS CloudFormation stack while retaining the DynamoDB table.
Which action should the CloudOps engineer perform before deleting the AWS CloudFormation stack?
AAdd a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
BAdd a Snapshot deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
CEnable termination protection on the AWS CloudFormation stack.
DUpdate the application's IAM policy with a Deny statement for the dynamodb:DeleteTable action.
A company security policy requires that incoming SSH traffic be limited to a defined set of addresses. The company uses an AWS Config rule to determine whether security groups permit unrestricted incoming SSH traffic.
A CloudOps engineer identifies a noncompliant resource and manually corrects the security group. The CloudOps engineer wants to automate remediation for other noncompliant resources.
What is the MOST operationally efficient solution that fulfills these requirements?
ACreate an Amazon CloudWatch alarm for the AWS Config rule's status metric. Create an AWS Lambda function that can remove the noncompliant rule from the security group. Configure the alarm action to invoke the Lambda function.
BConfigure an automatic remediation action on the AWS Config rule. Specify the AWS-DisablolncomingSSHOnPort22 remediation action.
CConfigure an Amazon EventBridge rule for AWS Config configuration item change events. Create an AWS Lambda function that can remove the noncompliant rule from the security groupConfigure the rule to invoke the Lambda function.
DCreate an AWS Lambda function that can analyze a security group’s inbound rules to check for unrestricted SSH access. Configure the Lambda function to remove the noncompliant rule from the security group. Configure an Amazon EventBridge rule to invoke the Lambda function every hour.
A company runs an FTP server on Amazon EC2 instances. In the company’s AWS environment, AWS Security Hub sends findings about the EC2 instances to Amazon EventBridge because the FTP port has become publicly exposed in the security groups attached to the instances.
A CloudOps engineer needs an automated solution to remediate the Security Hub finding and any similar findings for exposed ports. The CloudOps engineer wants to use an event-driven approach.
Which solution meets these requirements?
AConfigure the existing EventBridge event to stop the EC2 instances that have the exposed port.
BCreate a cron job for the FTP server to invoke an AWS Lambda function. Configure the Lambda function to modify the security group of the identified EC2 instances and to remove the instances that allow public access.
CCreate a cron job for the FTP server that invokes an AWS Lambda function. Configure the Lambda function to modify the server to use SFTP instead of FTP.
DConfigure the existing EventBridge event to invoke an AWS Lambda function. Configure the function to remove the security group rule that allows public access.
A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company requires an AWS Lambda function to carry out a custom recovery procedure on the application server whenever the application returns an HTTP 500 status code.
A CloudOps engineer must design a solution that detects HTTP 500 status codes and reliably runs the Lambda function when errors occur.
Which solution meets these requirements?
AConfigure an Amazon CloudWatch alarm on the HTTPCode_Target_5XX_Count ALB target group metric. Set the alarm action to run the Lambda function.
BDeploy a new Lambda function that continuously scans the ALB access logs in Amazon S3 to detect HTTP 500 status codes and then invokes the existing lambda function.
CEnable AWS CloudTrail on the application instances. Configure Amazon CloudWatch Logs metric filters to detect HTTP 500 status codes and run the Lambda function.
DCreate an Amazon EventBridge rule for all ALB request events that invokes the Lambda function. Configure the Lambda function to filter for HTTP 500 status codes internally.
A CloudOps engineer needs to share a copy of a production database with a migration account. The production database runs on an Amazon RDS DB instance and is encrypted at rest using an AWS Key Management Service (AWS KMS) key with the alias production-rds-key.
What must the CloudOps engineer do to satisfy these requirements with the LEAST administrative overhead?
ATake a snapshot of the RDS DB instance in the production account. Amend the KMS key policy of the production-rds-key KMS key to give access to the migration account’s root user. Share the snapshot with the migration account.
BCreate an RDS read replica in the migration account. Configure the KMS key policy to replicate the production-rds-key KMS key to the migration account.
CTake a snapshot of the RDS DB instance in the production account. Share the snapshot with the migration account. In the migration account, create a new KMS key that has an identical alias.
DUse native database toolsets to export the RDS DB instance to Amazon S3. Create an S3 bucket and an S3 bucket policy for cross-account access between the production account and the migration account. Use native database toolsets to import the database from Amazon S3 to a new RDS DB instance.
A CloudOps engineer is responsible for the security and compliance of a company's AWS account. To make sure the company's Amazon EC2 instances comply with company policy, the CloudOps engineer wants to terminate every EC2 instance that lacks a department tag. Noncompliant resources must be terminated near real time.
Which solution meets these requirements?
ACreate an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS-TerminateEC2Instance automation runbook to terminate noncompliant resources.
BCreate a new Amazon EventBridge rule to monitor when new EC2 instances are created. Send the event to an Amazon SNS topic for automatic remediation.
CEnsure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance's shutdown behavior to terminate.
DEnsure AWS Systems Manager Compliance is configured to manage the EC2 instances. Call the AWS-StopEC2Instances automation runbook to stop noncompliant resources.
A company is migrating its production file server to AWS. All data stored on the file server must remain accessible if an Availability Zone becomes unavailable or during system maintenance. Users must be able to interact with the file server by using the SMB protocol. Users must also be able to manage file permissions by using Windows ACLs.
Which solution meets these requirements?
ACreate a single AWS Storage Gateway file gateway.
BCreate an Amazon FSx for Windows File Server Multi-AZ file system.
CDeploy two AWS Storage Gateway file gateways across two Availability Zones. Configure an Application Load Balancer in front of the file gateways.
DDeploy two Amazon FSx for Windows File Server Single-AZ 2 file systems Configure Microsoft Distributed File System Replication (DFSR).
An environment contains 100 Amazon EC2 Windows instances. The Amazon CloudWatch agent is deployed and running on every EC2 instance with a baseline configuration file that captures log files. A new requirement is to capture the DHCP log files that are present on 50 of the instances.
What is the MOST operationally efficient way to fulfill this new requirement?
ACreate an additional CloudWatch agent configuration filo to capture the DHCP logs. Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file.
BLog in to each EC2 instance with administrator rights. Create a PowerShell script to push the needed baseline log files and DHCP log files to CloudWatch.
CRun the CloudWatch agent configuration file wizard on each EC2 instance. Verify that the baseline log files are included and add the DHCP log files during the wizard creation process.
DRun the CloudWatch agent configuration file wizard on each EC2 instance and select the advanced detail level. This will capture the operating system log files.
A CloudOps engineer is investigating a failed AWS CloudFormation stack creation. Before the CloudOps engineer can determine the issue, the stack and its resources are deleted. For future deployments, the CloudOps engineer must retain any resources that CloudFormation creates successfully.
What should the CloudOps engineer do to satisfy this requirement?
ASet the value of the DisableRollback parameter to False during stack creation.
BSet the value of the OnFailure parameter to DO_NOTHING during stack creation.
CSpecify a rollback configuration that has a rollback trigger of DO_NOTHING during stack creation
DSet the value of the OnFailure parameter to ROLLBACK during stack creation.
A company operates an internal web application on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group within a single Availability Zone. A CloudOps engineer must make the application highly available.
Which action should the CloudOps engineer take to satisfy this requirement?
AIncrease the maximum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
BIncrease the minimum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
CUpdate the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.
DUpdate the Auto Scaling group to launch new instances in an Availability Zone in a second AWS Region.
A company uses Amazon Route 53 latency-based routing across multiple AWS Regions to provide resiliency. Route 53 latency-based routing directs traffic to the nearest Region. Within every Region, weighted A records distribute traffic across multiple Availability Zones.
During a recent update, some Availability Zone endpoints became unhealthy, but Route 53 continued routing traffic to those unhealthy endpoints. The company must prevent this issue in the future.
Which solution meets this requirement?
AAdd a Route 53 health check for each of the weighted records that received traffic during the recent update.
BIncrease the weight of Route 53 records in the Region where traffic must go during updates.
CReconfigure all records to use latency-based routing across all Regions uniformly.
DReduce the TTL value for latency-based routing to detect changes more quickly.
A company is implementing security and compliance using AWS Trusted Advisor. The company’s CloudOps team is validating the list of Trusted Advisor checks it can access.
Which factor affects the number of available Trusted Advisor checks?
AWhether at least ono Amazon EC2 instance is in the running state
BThe AWS Support plan
CAn AWS Organizations service control policy (SCP)
DWhether the AWS account root user has multi-factor authentication (MFA) enabled
Community Discussion