Question 1

A SysOps Administrator must set up notifications for whenever combined billing exceeds a certain threshold for all AWS accounts within a company. The Administrator has set up AWS Organizations and enabled Consolidated Billing. Which additional steps must the Administrator perform to set up the billing alerts?

Accepted Answer

The correct approach is to enable billing alerts in the payer account's Billing and Cost Management console, then set up a billing alarm in Amazon CloudWatch to monitor the billing threshold and publish an SNS message when the alarm triggers.

Question 2

A SysOps Administrator at an ecommerce company discovers that several 404 errors are being sent to one IP address every minute. The Administrator suspects a bot is collecting information about products listed on the company's website. Which service should be used to block this suspected malicious activity?

Accepted Answer

AWS WAF (Web Application Firewall) can be used to block specific IP addresses and protect web applications from common web exploits, including blocking requests from bots.

Question 3

A Storage team wants all data transfers to an Amazon S3 bucket to remain within the AWS network. The team makes all changes to the AWS network infrastructure manually. An S3 VPC endpoint is created, and an endpoint policy with the proper permissions is set up. However, the application running on Amazon EC2 instances in the VPC is still unable to access the S3 bucket endpoint. What is one cause of this issue?

Accepted Answer

The answer of A Storage team wants all data transfers...

Question 4

Two companies will be working on several development projects together. Each company has an AWS account with a single VPC in us-east-1. Two companies would like to access one another's development servers. The IPv4 CIDR blocks in the two VPCs does not overlap. What can the SysOps Administrators for each company do to set up network routing?

Accepted Answer

VPC peering allows two VPCs to communicate with each other as if they are within the same network, provided their CIDR blocks do not overlap. Once the peering connection is established and accepted, routing tables can be updated to enable traffic between the VPCs.

Question 5

Development teams are maintaining several workloads on AWS. Company management is concerned about rising costs and wants the SysOps Administrator to configure alerts so teams are notified when spending approaches preset limits. Which AWS service will satisfy these requirements?

Accepted Answer

The answer of Development teams are maintaining several workloads on...

Question 6

A company wants to increase the availability and durability of a critical business application. The application currently uses a MySQL database running on an Amazon EC2 instance. The company wants to minimize application changes. How should the company meet these requirements?

Accepted Answer

The answer of A company wants to increase the availability...

Question 7

A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network. What actions should the SysOps Administrator take to meet these requirements?

Accepted Answer

Creating a VPC endpoint for the S3 bucket allows traffic to stay within the AWS private network. A bucket policy can then be used to restrict access to the bucket to only traffic coming from the VPC endpoint.

Question 8

A company is planning to deploy multiple ecommerce websites across the eu-west-1, ap-east-1, and us-west-1 Regions. The websites consist of Amazon S3 buckets, Amazon EC2 instances, Amazon RDS databases, and Elastic Load Balancers. Which method will accomplish the deployment with the LEAST amount of effort?

Accepted Answer

AWS CloudFormation stack sets allow you to deploy and manage resources across multiple AWS accounts and regions with a single operation, making it the most efficient method for deploying resources across multiple regions with minimal effort.

Question 9

A developer is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) and notices that the application is not receiving all the expected elements from HTTP requests. The developer suspects users are not sending the correct query string. How should a sysops administrator verify this?

Accepted Answer

The answer of A developer is deploying a web application...

Question 10

An application is being migrated to AWS with the requirement that archived data be retained for at least 7 years. What Amazon Glacier configuration option should be used to meet this compliance requirement?

Accepted Answer

A Glacier vault lock policy can be used to enforce compliance controls, such as retention periods, ensuring that archived data is retained for a specified duration, like 7 years, without being deleted.

Question 11

A SysOps Administrator has created a new Amazon S3 bucket named mybucket for the Operations team. Members of the team are part of an IAM group to which the following IAM policy has been assigned:  Which of the following actions will be allowed on the bucket? (Choose two.)

Accepted Answer

The answer of A SysOps Administrator has created a new...

Question 12

An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group that terminates unhealthy instances. The Auto Scaling group is configured to determine the health status of EC2 instances using both EC2 status checks and ALB health checks. The Development team wants to analyze the unhealthy instances before termination. What should the SysOps Administrator do to accomplish this?

Accepted Answer

Using an Amazon EC2 Auto Scaling lifecycle hook allows you to pause the termination process, giving you time to analyze the instance before it is terminated.

Question 13

A sysops administrator has an AWS Lambda function that performs maintenance on various AWS resources. This function must be run nightly. Which is the MOST cost-effective solution?

Accepted Answer

Scheduling a CloudWatch event to invoke the Lambda function is the most cost-effective and serverless solution, as it does not require running additional infrastructure like EC2 instances or OpsWorks stacks.

Question 14

A SysOps Administrator is receiving alerts related to high CPU utilization of a Memcached-based Amazon ElastiCache cluster. Which remediation steps should be taken to resolve this issue? (Choose two.)

Accepted Answer

The answer of A SysOps Administrator is receiving alerts related...

Question 15

An Amazon EC2 instance in a private subnet needs to copy data to an Amazon S3 bucket. For security reasons, the connection from the EC2 instance to Amazon S3 must not traverse across the Internet. What action should the SysOps Administrator take to accomplish this?

Accepted Answer

The answer of An Amazon EC2 instance in a private...

Question 16

An application running on Amazon EC2 needs login credentials to access a database. The login credentials are stored in AWS Systems Manager Parameter Store as secure string parameters. What is the MOST secure way to grant the application access to the credentials?

Accepted Answer

The answer of An application running on Amazon EC2 needs...

Question 17

A VPC is connected to a company data center by a VPN. An Amazon EC2 instance with the IP address 172.31.16.139 is within a private subnet of the VPC. A SysOps Administrator issued a ping command to the EC2 instance from an on-premises computer with the IP address 203.0.113.12 and did not receive an acknowledgment. VPC Flow Logs were enabled and showed the following:  What action will resolve the issue?

Accepted Answer

The answer of A VPC is connected to a company...

Question 18

A company's Marketing department generates gigabytes of assets each day and stores them locally. They would like to protect the files by backing them up to AWS. All the assets should be stored on the cloud, but the most recent assets should be available locally for low latency access. Which AWS service meets the requirements?

Accepted Answer

AWS Storage Gateway allows for seamless integration between on-premises environments and AWS cloud storage, enabling local caching of frequently accessed data while backing up all data to AWS.

Question 19

A Security and Compliance team is reviewing Amazon EC2 workloads for unapproved AMI usage. Which action should a SysOps Administrator recommend?

Accepted Answer

AWS Config can be used to create rules that check for compliance, such as identifying EC2 instances that are using unapproved AMIs.

Question 20

A SysOps Administrator observes a large number of rogue HTTP requests on an Application Load Balancer (ALB). The requests originate from various IP addresses. Which action should be taken to block this traffic?

Accepted Answer

AWS WAF rate-based blacklisting allows you to automatically block IP addresses that exceed a certain request threshold, effectively mitigating rogue HTTP requests.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)