Question 1

A company requires that all access from on-premises applications to AWS services go over its AWS Direct Connect connection rather than the public internet. How would a SysOps Administrator implement this requirement?

Accepted Answer

The answer of A company requires that all access from...

Question 2

A SysOps Administrator using AWS KMS needs to rotate all customer master keys (CMKs) every week to meet Information Security guidelines. Which option would meet the requirement?

Accepted Answer

AWS KMS does not support automatic rotation of CMKs every 7 days. The administrator would need to manually create a new CMK every 7 days to meet the requirement.

Question 3

The Security team at AnyCompany discovers that some employees have been using individual AWS accounts that are not under the control of AnyCompany. The team has requested that those individual accounts be linked to the central organization using AWS Organizations. Which action should a SysOps Administrator take to accomplish this?

Accepted Answer

The answer of The Security team at AnyCompany discovers that...

Question 4

A company has attached the following policy to an IAM user.  Which of the following actions are allowed for the IAM user?

Accepted Answer

The answer of A company has attached the following policy...

Question 5

A company recently performed a security audit of all its internal applications developed in house. Certain business-critical applications that handle sensitive data were flagged because they use Amazon ES clusters that are open for read/write to a wider user group that intended. Who is responsible for correcting the issue?

Accepted Answer

The answer of A company recently performed a security audit...

Question 6

An organization is measuring the latency of an application every minute and storing data inside a file in the JSON format. The organization wants to send all latency data to AWS CloudWatch. How can the organization achieve this?

Accepted Answer

The user can use the AWS CLI or SDKs to supply the JSON file as input to the CloudWatch command to publish custom metrics.

Question 7

A user is trying to create a PIOPS EBS volume with 4000 IOPS and 100 GB size. AWS does not allow the user to create this volume. What is the possible root cause for this?

Accepted Answer

The ratio between IOPS and the EBS volume size must be at least 50:1. For 4000 IOPS, the minimum volume size should be 80 GB (4000/50), so the size is not the issue. However, the ratio is higher than 30:1, which is not a valid constraint.

Question 8

A company runs a web application that users access using the domain name www.example.com. The company manages the domain name using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application though CloudFront. What is the MOST cost-effective way to achieve this?

Accepted Answer

An ALIAS record in Amazon Route 53 is the most cost-effective and efficient way to point a domain name to a CloudFront distribution, as it allows for seamless integration with AWS services without incurring additional DNS query charges.

Question 9

A SysOps Administrator must generate a report that provides a breakdown of all API activity by a specific user the course of a year. Given that AWS Cloud Trail was enabled, how can this report be generated?

Accepted Answer

CloudTrail logs are stored in an S3 bucket, and Amazon Athena can be used to query these logs to extract specific information, such as API activity by a specific user.

Question 10

How often is metric data is sent to CloudWatch when detailed monitoring is enabled on an Amazon EC2 instance?

Accepted Answer

When detailed monitoring is enabled on an Amazon EC2 instance, metric data is sent to CloudWatch every minute.

Question 11

Malicious traffic is reaching company web servers from a single IP address located in another country. The SysOps Administrator is tasked with blocking this IP address. How should the Administrator implement the restriction?

Accepted Answer

The answer of Malicious traffic is reaching company web servers...

Question 12

A company's IT department noticed an increase in the spend of their Developer AWS account. There are over 50 Developers using the account, and the Finance team wants to determine the service costs incurred by each Developer. What should a SysOps Administrator do to collect this information? (Choose two.)

Accepted Answer

The answer of A company's IT department noticed an increase...

Question 13

An Application performs read-heavy operations on an Amazon Aurora DB instance. The SysOps Administrator monitors the CPUUtilization CloudWatch metric and has recently seen it increase to 90%. The Administrator would like to understand what is driving the CPU surge. Which of the following should be Administrator additionally monitor to understand the CPU surge?

Accepted Answer

The answer of An Application performs read-heavy operations on an...

Question 14

A user had aggregated the CloudWatch metric data on the AMI ID. The user observed some abnormal behavior of the CPU utilization metric while viewing the last 2 weeks of data. The user wants to share that data with his manager. How can the user achieve this easily with the AWS console?

Accepted Answer

The user can use the copy URL functionality of CloudWatch to share the exact details with the manager.

Question 15

A company runs an application that uses Amazon RDS for MySQL. During load testing of equivalent production volumes, the Development team noticed a significant increase in query latency. A SysOps Administrator concludes from investigating Amazon CloudWatch Logs that the CPU utilization on the RDS MySQL instance was at 100%. Which action will resolve this issue?

Accepted Answer

Increasing the instance size will provide more CPU and memory resources, which can help handle the increased load and reduce query latency.

Question 16

A company's website went down for several hours. The root cause was a full disk on one of the company's Amazon EC2 instances. Which steps should the SysOps Administrator take to prevent this from happening in the future?

Accepted Answer

The answer of A company's website went down for several...

Question 17

A company needs to have real-time access to image data while seamlessly maintaining a copy of the images in an offsite location for disaster recovery purposes. Which solution meets the requirement?

Accepted Answer

Amazon S3 provides scalable storage, and S3 Transfer Acceleration can speed up access to frequently used files, making it suitable for real-time access and offsite disaster recovery.

Question 18

A SysOps Administrator is receiving alerts related to high CPU utilization of a Memcached-based Amazon ElastiCache cluster. Which remediation steps should be taken to resolve this issue? (Choose two.)

Accepted Answer

The answer of A SysOps Administrator is receiving alerts related...

Question 19

A company has deployed a new application running on Amazon EC2 instances. The application team must verify for the Security team that all common vulnerabilities and exposures have been addressed, both now and regularly throughout the application's lifespan. How can the Application team satisfy the Security team's requirement?

Accepted Answer

Amazon Inspector is a security assessment service that helps identify vulnerabilities and exposures in applications running on Amazon EC2 instances. Regular assessments with Amazon Inspector can help ensure that vulnerabilities are addressed throughout the application's lifespan.

Question 20

A SysOps Administrator needs to control access to groups of Amazon EC2 instances. Specific tags on the EC2 instances have already been added. Which additional actions should the Administrator take to control access? (Choose two.)

Accepted Answer

Attaching an IAM policy to the users or groups that require access to the EC2 instances and creating an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element are both valid ways to control access to groups of Amazon EC2 instances.

Exam 13: AWS Certified SysOps Administrator (SOA-C01)