AWS Certified SysOps Administrator – Associate practice questions

1. Question 1 of 25

   Select 2

   A SysOps administrator needs to control access to groups of Amazon EC2 instances using AWS Systems Manager Session Manager. Specific tags on the EC2 instances have already been added. Which additional actions should the administrator take to control access? (Choose two.)

   • AAttach an IAM policy to the users or groups that require access to the EC2 instances.
   • BAttach an IAM role to control access to the EC2 instances.
   • CCreate a placement group for the EC2 instances and add a specific tag.
   • DCreate a service account and attach it to the EC2 instances that need to be controlled.
   • ECreate an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element.

   Show answer

   Correct answer: A, E

   How others answered

   • AE57%
   • BE40%

   Only 57% agreed on this answer — treat it as contested rather than settled.

   Explanation

   A. Attach an IAM policy to the users or groups that require access to the EC2 instances: IAM policies can be used to control access to resources in AWS. The policy can specify which actions are allowed or denied and which resources the user or group can access. In this case, the policy should include permissions to use the Session Manager service. E. Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element: This policy can specify that access is granted only to instances with specific tags. For example, a policy could specify that users or groups can only access instances that have a specific tag, such as "Environment=Prod". This helps to ensure that only the appropriate instances are accessed.

   Adapted from community discussion by Vivec · 2023-09-09 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. V

      Vivec

      2023-09-09

      Selected A, E7 upvotes

      A. Attach an IAM policy to the users or groups that require access to the EC2 instances: IAM policies can be used to control access to resources in AWS. The policy can specify which actions are allowed or denied and which resources the user or group can access. In this case, the policy should include permissions to use the Session Manager service. E. Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element: This policy can specify that access is granted only to instances with specific tags. For example, a policy could specify that users or groups can only access instances that have a specific tag, such as "Environment=Prod". This helps to ensure that only the appropriate instances are accessed.

   2. P

      Phinx

      2023-08-18

      Selected A, E4 upvotes

      The question is "A SysOps Administrator needs to control access __to__ groups of Amazon EC2 instances.", not the control access of EC2 instances (or from them), so B is not applicable here.

   3. B

      Bonzai90210

      2023-03-16

      Selected A, E3 upvotes

      B does not make sense because the Admin is granting access via session manager. Since IAM Users or Groups are more likely to use session manager than an AWS service or federated identity would be, A makes more sense than B.

   4. A

      AgboolaKun

      2024-11-21

      Selected A, E2 upvotes

      Control access to smaller deployments of Amazon EC2 instances as follows: 1. Add a specific tag to the instances that you want to grant the users or groups access to. 2. Create an IAM policy that grants access to any instances with the specific tag. 3. Attach the IAM policy to the users or groups that you want to access the instances. Please refer to this link for more information - https://repost.aws/knowledge-center/iam-ec2-resource-tags

2. Question 2 of 25

   A SysOps administrator is creating two AWS CloudFormation templates. The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway. The second template will deploy application resources within the VPC that was created by the first template. The second template should refer to the resources created by the first template. How can this be accomplished with the LEAST amount of administrative effort?

   • AAdd an export field to the outputs of the first template and import the values in the second template.
   • BCreate a custom resource that queries the stack created by the first template and retrieves the required values.
   • CCreate a mapping in the first template that is referenced by the second template.
   • DInput the names of resources in the first template and refer to those names in the second template as a parameter.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Note: To reference a resource in another AWS CloudFormation stack, you must first create cross-stack references. To create a cross-stack reference, use the export field to flag the value of a resource output for export. Ref link: https://repost.aws/knowledge-center/cloudformation-reference-resource Ref link: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/walkthrough-crossstackref.html

   Adapted from community discussion by wooyourdaddy · 2023-11-01 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • repost.aws documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. W

      wooyourdaddy

      2023-11-01

      Selected A5 upvotes

      Note: To reference a resource in another AWS CloudFormation stack, you must first create cross-stack references. To create a cross-stack reference, use the export field to flag the value of a resource output for export. Ref link: https://repost.aws/knowledge-center/cloudformation-reference-resource Ref link: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/walkthrough-crossstackref.html

   2. J

      james2033

      2024-08-25

      Selected A3 upvotes

      'Export' output fields and 'Fn::ImportValue' , see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/walkthrough-crossstackref.html (1) https://s3.amazonaws.com/cloudformation-examples/user-guide/cross-stack/SampleNetworkCrossStack.template --> 'Export' (2) https://s3.amazonaws.com/cloudformation-examples/user-guide/cross-stack/SampleWebAppCrossStack.template --> 'Fn::ImportValue' "Export": { "Name": { "Fn::Sub": "${AWS::StackName}-VPCID" } } then "GroupSet": [ { "Fn::ImportValue": { "Fn::Sub": "${NetworkStackName}-SecurityGroupID" } } ],

   3. B

      BugsBunny9998666

      2023-06-07

      1 upvote

      here are some old comments A is correct! The optional Mappings section matches a key to a corresponding set of named values. For example, if you want to set values based on a region, you can create a mapping that uses the region name as a key and contains the values you want to specify for each specific region. You use the Fn::FindInMap intrinsic function to retrieve values in a map. You can't include parameters, pseudo parameters, or intrinsic functions in the Mappings section. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/mappings-section-structure.html A is correct, mappings have nothing to do in referencing from one stack to the other

   4. N

      noahsark

      2023-08-02

      Selected A2 upvotes

      https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-reference-resource/

3. Question 3 of 25

   A company has a high-performance Windows workload. The workload requires a storage volume that provides consistent performance of 10,000 IOPS. The company does not want to pay for additional unneeded capacity to achieve this performance. Which solution will meet these requirements with the LEAST cost?

   • AUse a Provisioned IOPS SSD (io1) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10,000 provisioned IOPS.
   • BUse a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10,000 provisioned IOPS.
   • CUse an Amazon Elastic File System (Amazon EFS) file system in Max I/O mode.
   • DUse an Amazon FSx for Windows File Server file system that is configured with 10,000 IOPS.

   Show answer

   Correct answer: B

   How others answered

   • B79%

   Explanation

   I'm no storage or math guru, but I did find links with formulas to calculate required minimum volume size to achieve 10,000 IOPS: 20 GiB for gp3 volume (10,000 IOPS / 500 IOPS per GiB = 20 GiB) and 200 GiB for io1 volume (10,000 IOPS / 50 = 200 GiB). https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/general-purpose.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/provisioned-iops.html If my math is wrong, correct me. However, since the question states that size matters, since 20 GiB is less than 200 GiB, I'd have to vote "B." gp3.

   Adapted from community discussion by Gomer · 2023-10-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. J

      JamesF92

      2024-02-13

      Selected B5 upvotes

      Use the official AWS cost calculator to compare. B costs way less than A or D for 10,000 IOPS. https://calculator.aws/

   2. G

      Gomer

      2023-10-11

      Selected B3 upvotes

      I'm no storage or math guru, but I did find links with formulas to calculate required minimum volume size to achieve 10,000 IOPS: 20 GiB for gp3 volume (10,000 IOPS / 500 IOPS per GiB = 20 GiB) and 200 GiB for io1 volume (10,000 IOPS / 50 = 200 GiB). https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/general-purpose.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/provisioned-iops.html If my math is wrong, correct me. However, since the question states that size matters, since 20 GiB is less than 200 GiB, I'd have to vote "B." gp3.

   3. C

      csG13

      2023-09-10

      Selected B3 upvotes

      B - gp3 provides a consistent IOPS baseline performance that is not linearly dependent on the amount of storage we provision. It provides an initial 3000 IOPS baseline regardless and any IOPS above it costs 0.005$. As an example, assuming a size of 1TB and 10000 IOPS using a gp3 volume the monthly cost would be ~165$. Using io1 the same would cost 825$. Evidently, the most cost effective solution is gp3.

   4. R

      Rabbit117

      2024-07-29

      Selected B1 upvote

      General Purpose SSD (gp3) volumes are the latest generation of General Purpose SSD volumes, and the lowest cost SSD volume offered by Amazon EBS. This volume type helps to provide the right balance of price and performance for most applications. It also helps you to scale volume performance independently of volume size. This means that you can provision the required performance without needing to provision additional block storage capacity. Additionally, gp3 volumes offer a 20 percent lower price per GiB than General Purpose SSD (gp2) volumes. gp3 volumes provide single-digit millisecond latency and 99.8 percent to 99.9 percent volume durability with an annual failure rate (AFR) no higher than 0.2 percent, which translates to a maximum of two volume failures per 1,000 running volumes over a one-year period. AWS designs gp3 volumes to deliver their provisioned performance 99 percent of the time.

4. Question 4 of 25

   A SysOps administrator is setting up an automated process to recover an Amazon EC2 instance in the event of an underlying hardware failure. The recovered instance must have the same private IP address and the same Elastic IP address that the original instance had. The SysOps team must receive an email notification when the recovery process is initiated. Which solution will meet these requirements?

   • ACreate an Amazon CloudWatch alarm for the EC2 instance, and specify the StatusCheckFailed_Instance metric. Add an EC2 action to the alarm to recover the instance. Add an alarm notification to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the SysOps team email address to the SNS topic.
   • BCreate an Amazon CloudWatch alarm for the EC2 instance, and specify the StatusCheckFailed_System metric. Add an EC2 action to the alarm to recover the instance. Add an alarm notification to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the SysOps team email address to the SNS topic.
   • CCreate an Auto Scaling group across three different subnets in the same Availability Zone with a minimum, maximum, and desired size of 1. Configure the Auto Scaling group to use a launch template that specifies the private IP address and the Elastic IP address. Add an activity notification for the Auto Scaling group to send an email message to the SysOps team through Amazon Simple Email Service (Amazon SES).
   • DCreate an Auto Scaling group across three Availability Zones with a minimum, maximum, and desired size of 1. Configure the Auto Scaling group to use a launch template that specifies the private IP address and the Elastic IP address. Add an activity notification for the Auto Scaling group to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the SysOps team email address to the SNS topic.

   Show answer

   Correct answer: B

   How others answered

   • B93%

   Explanation

   Answer is B You can create an Amazon CloudWatch alarm that monitors an Amazon EC2 instance and automatically recovers the instance if it becomes impaired due to an underlying hardware failure or a problem that requires AWS involvement to repair. Terminated instances cannot be recovered. A recovered instance is identical to the original instance, including the instance ID, private IP addresses, Elastic IP addresses, and all instance metadata. If the impaired instance has a public IPv4 address, the instance retains the public IPv4 address after recovery. If the impaired instance is in a placement group, the recovered instance runs in the placement group. When the StatusCheckFailed_System alarm is triggered, and the recover action is initiated, you will be notified by the Amazon SNS topic that you selected when you created the alarm and associated the recover action. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-recover.html

   Adapted from community discussion by tyfta6 · 2023-06-01 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. T

      tyfta6

      2023-06-01

      Selected B8 upvotes

      Answer is B You can create an Amazon CloudWatch alarm that monitors an Amazon EC2 instance and automatically recovers the instance if it becomes impaired due to an underlying hardware failure or a problem that requires AWS involvement to repair. Terminated instances cannot be recovered. A recovered instance is identical to the original instance, including the instance ID, private IP addresses, Elastic IP addresses, and all instance metadata. If the impaired instance has a public IPv4 address, the instance retains the public IPv4 address after recovery. If the impaired instance is in a placement group, the recovered instance runs in the placement group. When the StatusCheckFailed_System alarm is triggered, and the recover action is initiated, you will be notified by the Amazon SNS topic that you selected when you created the alarm and associated the recover action. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-recover.html

   2. J

      james2033

      2024-08-25

      Selected B5 upvotes

      Option A like Option B so much, I read many time to see the different. Read careful at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-system-instance-status-check.html 'StatusCheckFailed_System' and 'Hardware issues on the physical host that impact network reachability' --> Related to hardware --> Choose B. Option A: 'StatusCheckFailed_Instance' related to kernal (Operation system software), networking, memory, file system.

   3. X

      Xelnak

      2023-05-18

      Selected B4 upvotes

      To automatically recover an instance when a system status check failure occurs, you can use the default configuration of the instance or create an Amazon CloudWatch alarm. If an instance becomes unreachable because of an underlying hardware failure or a problem that requires AWS involvement to repair, the instance is automatically recovered. A recovered instance is identical to the original instance, including the instance ID, private IP addresses, Elastic IP addresses, and all instance metadata. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Managing.Backtrack.html

   4. C

      Christina666

      2024-01-24

      3 upvotes

      Instance status checks monitor the software and network configuration of your individual instance. Amazon EC2 checks the health of the instance by sending an address resolution protocol (ARP) request to the network interface (NIC). These checks detect problems that require your involvement to repair. When an instance status check fails, you typically must address the problem yourself (for example, by rebooting the instance or by making instance configuration changes). The following are examples of problems that can cause instance status checks to fail: Failed system status checks Incorrect networking or startup configuration Exhausted memory Corrupted file system Incompatible kernel If an instance status check fails, we increment the StatusCheckFailed_Instance metric.

5. Question 5 of 25

   A team is managing an AWS account that is a member of an organization in AWS Organizations. The organization has consolidated billing features enabled. The account hosts several applications. A SysOps administrator has applied tags to resources within the account to reflect the environment. The team needs a report of the breakdown of charges by environment. What should the SysOps administrator do to meet this requirement?

   • AFilter, map, and categorize resource groups in Tag Editor.
   • BEnsure that the organization's service control policies (SCPs) allow access to cost allocation tags.
   • CEnsure that the IAM credentials that are used to access Cost Explorer have permissions to group cost by tags.
   • DActivate the tag keys for cost allocation on the organization's management account.

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   D You must activate both types of tags separately before they can appear in Cost Explorer or on a cost allocation report. https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

   Adapted from community discussion by moonwalkeryj · 2022-08-31 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • aws.amazon.com documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. M

      moonwalkeryj

      2022-08-31

      15 upvotes

      D You must activate both types of tags separately before they can appear in Cost Explorer or on a cost allocation report. https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html

   2. S

      Surferbolt

      2022-10-10

      Selected D10 upvotes

      D. You need to activate the tags. It's not A because the question already said that resources has been tagged.

   3. J

      james2033

      2024-02-25

      Selected D5 upvotes

      To activate your tag keys 1) Sign in to the AWS Management Console and open the AWS Billing and Cost Management console at https://console.aws.amazon.com/billing/. 2) In the navigation pane, choose Cost allocation tags. 3) Select the tag keys that you want to activate. 4) Choose Activate. See: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/activating-tags.html

   4. S

      SebastianPlaiasu

      2023-07-05

      2 upvotes

      A. Filter, map, and categorize resource groups in Tag Editor. By using the Tag Editor, the administrator can filter resources based on specific tags, map those resources to resource groups, and then categorize them according to the desired environment. This will allow them to visualize and analyze the cost allocation based on the tagged environments. Option D is incorrect because activating tag keys for cost allocation on the organization's management account is not a valid option. Tag activation is done on individual resources to enable cost allocation tagging, but it does not address the requirement of generating a breakdown of charges by environment.

6. Question 6 of 25

   Select 2

   A company creates a new member account by using AWS Organizations. A SysOps administrator needs to add AWS Business Support to the new account. Which combination of steps must the SysOps administrator take to meet this requirement? (Choose two.)

   • ASign in to the new account by using IAM credentials. Change the support plan.
   • BSign in to the new account by using root user credentials. Change the support plan.
   • CUse the AWS Support API to change the support plan.
   • DReset the password of the account root user.
   • ECreate an IAM user that has administrator privileges in the new account.

   Show answer

   Correct answer: A, E

   How others answered

   • AE47%
   • BD28%
   • BE23%

   Only 47% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Correct answers are A and E. The combination of option B and D also works, but the best practice is using an IAM user, not the root user. https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html

   Adapted from community discussion by Untamables · 2023-02-13 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. U

      Untamables

      2023-02-13

      Selected A, E12 upvotes

      Correct answers are A and E. The combination of option B and D also works, but the best practice is using an IAM user, not the root user. https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html

   2. N

      noahsark

      2023-03-29

      Selected A, E5 upvotes

      Create an IAM user that has administrator privileges in the new account. Sign in to the new account by using IAM credentials. Change the support plan. https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html https://docs.aws.amazon.com/awssupport/latest/user/security-support-plans.html

   3. X

      xSohox

      2023-08-20

      Selected A, E4 upvotes

      It is a tricky question. Support plan can be changed by root account or if you have enough IAM permissions. https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html We need to provide a COMBINATION of actions. So we can either update Support plan with root account or we can create new IAM user with admin access and update Support plan with it. Creating new IAM user with admin access doesn't make sense if you have already updated Support plan with your root account. I vote for AE.

   4. B

      beznika

      2022-12-17

      5 upvotes

      My choice B&E. You have to sign it with a root to change it. And then you should create a user with admin permissions as it is not a good practice to use root access for any administrative tasks.

7. Question 7 of 25

   A company uses an Amazon S3 bucket to store data files. The S3 bucket contains hundreds of objects. The company needs to replace a tag on all the objects in the S3 bucket with another tag. What is the MOST operationally efficient way to meet this requirement?

   • AUse S3 Batch Operations. Specify the operation to replace all object tags.
   • BUse the AWS CLI to get the tags for each object. Save the tags in a list. Use S3 Batch Operations. Specify the operation to delete all object tags. Use the AWS CLI and the list to retag the objects.
   • CUse the AWS CLI to get the tags for each object. Save the tags in a list. Use the AWS CLI and the list to remove the object tags. Use the AWS CLI and the list to retag the objects.
   • DUse the AWS CLI to copy the objects to another S3 bucket. Add the new tag to the copied objects. Delete the original objects.

   Show answer

   Correct answer: A

   How others answered

   • A95%

   Explanation

   A is the correct answer. The question is asking to replace existing tag with another, not adding new tags. Therefore, batch operations is correct (A). Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-put-object-tagging.html

   Adapted from community discussion by Gil80 · 2023-08-25 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. L

      Liongeek

      2023-05-16

      16 upvotes

      Ans: A Ref. https://aws.amazon.com/es/blogs/storage/adding-and-removing-object-tags-with-s3-batch-operations/

   2. R

      r2c3po

      2024-06-27

      Selected A4 upvotes

      S3 Batch Operations is the most operationally efficient way to meet the requirement of replacing a tag on all objects in an S3 bucket. S3 Batch Operations allows you to perform large-scale batch operations on Amazon S3 objects, including updating tags on objects. Here's why option A is the best choice: S3 Batch Operations: Allows you to perform actions, such as tagging, on a large number of objects at once. Is designed for efficiency and scalability when dealing with large-scale operations. Is a native AWS service specifically built for performing batch operations on S3 objects.

   3. G

      Gil80

      2023-08-25

      Selected A5 upvotes

      A is the correct answer. The question is asking to replace existing tag with another, not adding new tags. Therefore, batch operations is correct (A). Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-put-object-tagging.html

   4. G

      Gomer

      2023-10-18

      Selected A5 upvotes

      "With this feature, you can make changes to object metadata and properties, or perform other storage management tasks, such as" "replacing object tag sets" https://aws.amazon.com/s3/features/batch-operations/

8. Question 8 of 25

   A company runs hundreds of Amazon EC2 instances in a single AWS Region. Each EC2 instance has two attached 1 GiB General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volumes. A critical workload is using all the available IOPS capacity on the EBS volumes. According to company policy, the company cannot change instance types or EBS volume types without completing lengthy acceptance tests to validate that the company’s applications will function properly. A SysOps administrator needs to increase the I/O performance of the EBS volumes as quickly as possible. Which action should the SysOps administrator take to meet these requirements?

   • AIncrease the size of the 1 GiB EBS volumes.
   • BAdd two additional elastic network interfaces on each EC2 instance.
   • CTurn on Transfer Acceleration on the EBS volumes in the Region.
   • DAdd all the EC2 instances to a cluster placement group.

   Show answer

   Correct answer: A

   How others answered

   • A84%

   Explanation

   A. 100% positive. "With Amazon EBS Elastic Volumes, you can increase the volume size, change the volume type, or adjust the performance of your EBS volumes. If your instance supports Elastic Volumes, you can do so without detaching the volume or restarting the instance. This enables you to continue using your application while the changes take effect." https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modify-volume.html They have Elastic Volumes in place (per the question) and that's exactly why it is specified in the question. As others have mentioned, increasing the volume size increases IOPS, up to the volume type max. For gp2, you can have a volume size of 1 GiB - 16 TiB with a max IOPS of 16,000 for the 16 TiB volume size. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

   Adapted from community discussion by Domdom120 · 2023-09-01 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. D

      Domdom120

      2023-09-01

      Selected A8 upvotes

      A. 100% positive. "With Amazon EBS Elastic Volumes, you can increase the volume size, change the volume type, or adjust the performance of your EBS volumes. If your instance supports Elastic Volumes, you can do so without detaching the volume or restarting the instance. This enables you to continue using your application while the changes take effect." https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modify-volume.html They have Elastic Volumes in place (per the question) and that's exactly why it is specified in the question. As others have mentioned, increasing the volume size increases IOPS, up to the volume type max. For gp2, you can have a volume size of 1 GiB - 16 TiB with a max IOPS of 16,000 for the 16 TiB volume size. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

   2. J

      jipark

      2024-02-16

      5 upvotes

      I don't know why, but "By increasing the size of the EBS volumes, you can effectively increase the IOPS capacity available to your instances. "

   3. B

      Brokdar

      2023-08-08

      Selected A4 upvotes

      A is correct, since increasing the size of the EBS volume doesn't change the volume type and it will definitely increase the IOPS. B, C and D don't make sense for this question.

   4. V

      Vivec

      2023-09-10

      Selected A3 upvotes

      The IOPS performance of Amazon EBS volumes is directly proportional to the size of the volume. Therefore, increasing the size of the EBS volumes is the most straightforward way to increase the IOPS performance of the volumes.

9. Question 9 of 25

   A company is managing many accounts by using a single organization in AWS Organizations. The organization has all features enabled. The company wants to turn on AWS Config in all the accounts of the organization and in all AWS Regions. What should a SysOps administrator do to meet these requirements in the MOST operationally efficient way?

   • AUse AWS CloudFormation Stack Sets to deploy stack instances that turn on AWS Config in all accounts and in all Regions.
   • BUse AWS CloudFormation Stack Sets to deploy stack policies that turn on AWS Config in all accounts and in all Regions.
   • CUse service control policies (SCPs) to configure AWS Config in all accounts and in all Regions.
   • DCreate a script that uses the AWS CLI to turn on AWS Config in all accounts in the organization. Run the script from the organization's management account.

   Show answer

   Correct answer: A

   How others answered

   • A96%

   Explanation

   Option A (Use AWS CloudFormation Stack Sets to deploy stack instances that turn on AWS Config in all accounts and in all Regions) is the best option for achieving the goal in a highly efficient and scalable manner. AWS CloudFormation Stack Sets allow you to deploy CloudFormation stacks across multiple accounts and Regions in a single operation. By defining a stack that enables AWS Config and using Stack Sets, you can easily enable AWS Config in all accounts and Regions within the AWS organization. Option B (Use AWS CloudFormation Stack Sets to deploy stack policies that turn on AWS Config in all accounts and in all Regions) is not the correct option. Stack policies are used to control what actions can be performed on a CloudFormation stack, but they are not suitable for enabling AWS Config across multiple accounts and Regions.

   Adapted from community discussion by Christina666 · 2024-07-25 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

   1. C

      Christina666

      2024-07-25

      Selected A6 upvotes

      Option A (Use AWS CloudFormation Stack Sets to deploy stack instances that turn on AWS Config in all accounts and in all Regions) is the best option for achieving the goal in a highly efficient and scalable manner. AWS CloudFormation Stack Sets allow you to deploy CloudFormation stacks across multiple accounts and Regions in a single operation. By defining a stack that enables AWS Config and using Stack Sets, you can easily enable AWS Config in all accounts and Regions within the AWS organization. Option B (Use AWS CloudFormation Stack Sets to deploy stack policies that turn on AWS Config in all accounts and in all Regions) is not the correct option. Stack policies are used to control what actions can be performed on a CloudFormation stack, but they are not suitable for enabling AWS Config across multiple accounts and Regions.

   2. D

      Domdom120

      2024-03-03

      Selected A4 upvotes

      A. https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-prereq-config.html Stackset policies are not used for this purpose. https://aws.amazon.com/blogs/mt/managing-aws-organizations-accounts-using-aws-config-and-aws-cloudformation stacksets/#:~:text=AWS%20CloudFormation%20StackSets%20helps%20enable,the%20CloudFormation%20console%2C%20choose%20StackSets. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html https://aws.amazon.com/blogs/mt/managing-aws-organizations-accounts-using-aws-config-and-aws-cloudformation-stacksets/#:~:text=AWS%20CloudFormation%20StackSets%20helps%20enable,the%20CloudFormation%20console%2C%20choose%20StackSets.

   3. D

      defmania00

      2024-02-27

      Selected A4 upvotes

      https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html#stacksets-concepts-stackinstances

   4. G

      Gomer

      2024-04-25

      Selected A3 upvotes

      If you read and understand the following link, there is no question what the answer is (A.) https://aws.amazon.com/blogs/mt/managing-aws-organizations-accounts-using-aws-config-and-aws-cloudformation-stacksets/

10. Question 10 of 25

    A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A SysOps administrator notices that some of these EC2 instances show up as healthy in the Auto Scaling group but show up as unhealthy in the ALB target group. What is a possible reason for this issue?

    • ASecurity groups are not allowing traffic between the ALB and the failing EC2 instances.
    • BThe Auto Scaling group health check is configured for EC2 status checks.
    • CThe EC2 instances are failing to launch and failing EC2 status checks.
    • DThe target group health check is configured with an incorrect port or path.

    Show answer

    Correct answer: D

    How others answered

    • D54%
    • B37%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    No, the correct answer is D. You need to pay more attention to how the question is worded. It says health checks in TARGET GROUPS. So based on this doc: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html "The load balancer sends a health check request to each registered target every HealthCheckIntervalSeconds seconds, using the specified port, protocol, and ping path."

    Adapted from community discussion by xSohox · 2023-08-21 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. X

       xSohox

       2023-08-21

       4 upvotes

       No, the correct answer is D. You need to pay more attention to how the question is worded. It says health checks in TARGET GROUPS. So based on this doc: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html "The load balancer sends a health check request to each registered target every HealthCheckIntervalSeconds seconds, using the specified port, protocol, and ping path."

    2. A

       a1971h

       2023-02-25

       Selected D4 upvotes

       D. The target group health check is configured with an incorrect port or path.

    3. V

       Vivec

       2023-03-09

       3 upvotes

       I agree on this one, it is B. This is the typical question with EC2 and ALB Health Checks, that comes on exams all the time. EC2 Health checks, check the Operating system that runs the EC2 and does it run properly, but ALB Health checks, check the application that runs on it. Maybe EC2 is running as it should, but the application on it is failing. Because of that, it is the best practice to put ALB HP checks and not EC2 Health Checks.

    4. X

       xSohox

       2023-08-21

       Selected D2 upvotes

       Health checks are in a ALB target group. "The load balancer sends a health check request to each registered target every HealthCheckIntervalSeconds seconds, using the specified port, protocol, and ping path." https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html

11. Question 11 of 25

    A SysOps administrator is required to monitor free space on Amazon EBS volumes attached to Microsoft Windows-based Amazon EC2 instances within a company's account. The administrator must be alerted to potential issues. What should the administrator do to receive email alerts before low storage space affects EC2 instance performance?

    • AUse built-in Amazon CloudWatch metrics, and configure CloudWatch alarms and an Amazon SNS topic for email notifications.
    • BUse AWS CloudTrail logs and configure the trail to send notifications to an Amazon SNS topic.
    • CUse the Amazon CloudWatch agent to send disk space metrics, then set up CloudWatch alarms using an Amazon SNS topic.
    • DUse AWS Trusted Advisor and enable email notification alerts for EC2 disk space.

    Show answer

    Correct answer: C

    How others answered

    • C77%
    • A23%

    Explanation

    Free disk space is available from Linux OS directly, but you'd have to connect to each machine one by one. For Windows, or to monitor across multiple instances simultaneously (Linux and/or Windows) you need the CloudWatch Agent per this page. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-describing-volumes.html#ebs-view-free-disk-space which states " If you need to monitor disk space usage for multiple instances, you can install and configure the CloudWatch agent on those instances using Systems Manager. For more information, see Installing the CloudWatch agent using Systems Manager."

    Adapted from community discussion by JamesF92 · 2024-08-11 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. C

       csG13

       2024-03-08

       Selected C8 upvotes

       Free disk metric requires CloudWatch agent both on Linux and Windows instances. Thus, the right answer is C.

    2. J

       JamesF92

       2024-08-11

       Selected C4 upvotes

       Free disk space is available from Linux OS directly, but you'd have to connect to each machine one by one. For Windows, or to monitor across multiple instances simultaneously (Linux and/or Windows) you need the CloudWatch Agent per this page. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-describing-volumes.html#ebs-view-free-disk-space which states " If you need to monitor disk space usage for multiple instances, you can install and configure the CloudWatch agent on those instances using Systems Manager. For more information, see Installing the CloudWatch agent using Systems Manager."

    3. C

       Christina666

       2024-07-25

       3 upvotes

       Option C (Use the Amazon CloudWatch agent to send disk space metrics, then set up CloudWatch alarms using an Amazon SNS topic) is not the most suitable option for monitoring EBS volumes on Microsoft Windows-based EC2 instances. While the CloudWatch agent can be used to collect additional custom metrics, Amazon CloudWatch already provides built-in metrics for monitoring EBS volumes' free space without the need for additional configuration on Windows EC2 instances.

    4. W

       walala97

       2024-10-29

       Selected C3 upvotes

       CloudWatch agent allows you to collect more system-level metrics from your EC2 and on-premises servers than just the standard CloudWatch metrics.while cloudwatch has no bulit in metric for disk space,so A is out

12. Question 12 of 25

    A company has a critical serverless application that uses multiple AWS Lambda functions. Each Lambda function generates 1 GB of log data daily in its own Amazon CloudWatch Logs log group. The company's security team asks for a count of application errors, grouped by type, across all of the log groups. What should a SysOps administrator do to meet this requirement?

    • APerform a CloudWatch Logs Insights query that uses the stats command and count function.
    • BPerform a CloudWatch Logs search that uses the groupby keyword and count function.
    • CPerform an Amazon Athena query that uses the SELECT and GROUP BY keywords.
    • DPerform an Amazon RDS query that uses the SELECT and GROUP BY keywords.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A - https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html CloudWatch Logs Insights includes a purpose-built query language with a few simple but powerful commands. CloudWatch Logs Insights provides sample queries, command descriptions, query autocompletion, and log field discovery to help you get started. Sample queries are included for several types of AWS service logs.

    Adapted from community discussion by fahadadnan · 2023-08-23 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. F

       fahadadnan

       2023-08-23

       Selected A9 upvotes

       A - https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html CloudWatch Logs Insights includes a purpose-built query language with a few simple but powerful commands. CloudWatch Logs Insights provides sample queries, command descriptions, query autocompletion, and log field discovery to help you get started. Sample queries are included for several types of AWS service logs.

    2. R

       rdiaz

       2023-12-18

       Selected A3 upvotes

       A https://aws.amazon.com/about-aws/whats-new/2019/07/cloudwatch-logs-insights-adds-cross-log-group-querying/

    3. J

       james2033

       2024-09-06

       2 upvotes

       Using the console to enable Lambda Insights on an existing Lambda function - https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Lambda-Insights-Getting-Started-console.html Operating Lambda: Using CloudWatch Logs Insights - https://aws.amazon.com/blogs/compute/operating-lambda-using-cloudwatch-logs-insights/

    4. J

       jipark

       2024-02-18

       1 upvote

       CloudWatch Insight - "stat" and "count" command support log group

13. Question 13 of 25

    A SysOps administrator is investigating issues on an Amazon RDS for MariaDB DB instance. The SysOps administrator wants to display the database load categorized by detailed wait events. How can the SysOps administrator accomplish this goal?

    • ACreate an Amazon CloudWatch dashboard.
    • BEnable Amazon RDS Performance Insights.
    • CEnable and configure Enhanced Monitoring.
    • DReview the database logs in Amazon CloudWatch Logs.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Correct answer B "With the Performance Insights dashboard, you can visualize the database load on your Amazon RDS DB instance load and filter the load by waits, SQL statements, hosts, or users." https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.html Instead Enhance monitoring Amazon RDS provides metrics in real time for the operating system (OS) that your DB instance runs on. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.overview.html

    Adapted from community discussion by TwinSpark · 2023-10-17 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. C

       CodePoet

       2022-05-24

       Selected B9 upvotes

       Performance Insight is the right answer https://aws.amazon.com/rds/performance-insights/

    2. T

       TwinSpark

       2023-10-17

       Selected B4 upvotes

       Correct answer B "With the Performance Insights dashboard, you can visualize the database load on your Amazon RDS DB instance load and filter the load by waits, SQL statements, hosts, or users." https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.html Instead Enhance monitoring Amazon RDS provides metrics in real time for the operating system (OS) that your DB instance runs on. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.overview.html

    3. F

       Finger41

       2022-05-24

       Selected B3 upvotes

       B - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.Overview.ActiveSessions.html

    4. C

       Christina666

       2023-07-29

       Selected B1 upvote

       https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.UsingDashboard.AnalyzeDBLoad.html DB load grouped by waits and top SQL queries is the default Performance Insights dashboard view. This combination typically provides the most insight into performance issues. DB load grouped by waits shows if there are any resource or concurrency bottlenecks in the database. In this case, the SQL tab of the top load items table shows which queries are driving that load.

14. Question 14 of 25

    A SysOps administrator needs to collect the content of log files from a custom application that is deployed across hundreds of Amazon EC2 instances running Ubuntu. The log files need to be stored in Amazon CloudWatch Logs. How should the SysOps administrator collect the application log files with the LOWEST operational overhead?

    • AConfigure the syslogd service on each EC2 instance to collect and send the application log files to CloudWatch Logs.
    • BInstall the CloudWatch agent by using the Amazon Linux package manager on each EC2 instance. Configure each agent to collect the application log files.
    • CInstall the CloudWatch agent on each EC2 instance by using AWS Systems Manager. Create an agent configuration on each instance by using the CloudWatch configuration wizard. Configure each agent to collect the application log files.
    • DStore a CloudWatch agent configuration in the AWS Systems Manager Parameter Store. Install the CloudWatch agent on each EC2 instance by using Systems Manager. Configure each agent to collect the application log files.

    Show answer

    Correct answer: D

    How others answered

    • D86%

    Explanation

    At first reading I chose "C". However, in doing a little research its clear Amazon suggests using parameter store to a config centrally so you don't have to run the wizard a bunch of ties. I couldn't find a link to document exact steps, but the following links outline that it can be done: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file-wizard.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-on-EC2-Instance-fleet.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-commandline-fleet.html

    Adapted from community discussion by Gomer · 2023-11-01 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. G

       Gomer

       2023-11-01

       Selected D9 upvotes

       At first reading I chose "C". However, in doing a little research its clear Amazon suggests using parameter store to a config centrally so you don't have to run the wizard a bunch of ties. I couldn't find a link to document exact steps, but the following links outline that it can be done: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file-wizard.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-on-EC2-Instance-fleet.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-commandline-fleet.html

    2. L

       Learning4life

       2024-08-04

       Selected D3 upvotes

       After you have created a configuration file, you can save it manually as a JSON file and then use this file when installing the agent on your servers. Alternatively, you can store it in Systems Manager Parameter Store if you're going to use Systems Manager when you install the agent on servers. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-cloudwatch-agent-configuration-file.html

    3. N

       noahsark

       2023-12-20

       Selected D2 upvotes

       maybe Store a CloudWatch agent configuration in the AWS Systems Manager Parameter Store. Install the CloudWatch agent on each EC2 instance by using Systems Manager. Configure each agent to collect the application log files. Notes: The CloudWatch agent configuration file can be stored in AWS Systems Manager Parameter Store parameters. You can create separate Parameter Store parameters if you have multiple CloudWatch agent configuration files. https://docs.aws.amazon.com/prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/create-store-cloudwatch-configurations.html

    4. C

       Christina666

       2024-01-26

       2 upvotes

       I am voting for D, however chatgpt answer is A. A. Configure the syslogd service on each EC2 instance to collect and send the application log files to CloudWatch Logs. Explanation: Configuring the syslogd service on each EC2 instance to send logs to CloudWatch Logs is the most straightforward and efficient approach, especially when dealing with hundreds of Amazon EC2 instances running Ubuntu. The syslogd service is a built-in logging facility available in most Linux distributions, including Ubuntu, and it can be easily configured to forward logs to CloudWatch Logs without the need for additional installations or complex setups.

15. Question 15 of 25

    A SysOps administrator needs to provision a new fleet of Amazon EC2 Spot Instances in an Amazon EC2 Auto Scaling group. The Auto Scaling group will use a wide range of instance types. The configured fleet must come from pools that have the most availability for the number of instances that are launched. Which solution will meet these requirements?

    • ALaunch the Spot Instances up to the maximum capacity of the Auto Scaling group.
    • BLaunch the Spot Instances by using the diversified strategy.
    • CLaunch the Spot Instances by using the capacity optimized strategy.
    • DUse the Spot Instance advisor to help determine the best Spot allocation strategy.

    Show answer

    Correct answer: C

    How others answered

    • C79%
    • D21%

    Explanation

    capacity-optimized strategy automatically analyzes the available Spot capacity pools and selects the pool that provides the highest chance of launching the desired number of instances. Spot Instance Advisor can provide guidance on Spot instance pricing and interruption history, but it does not specifically address the goal of selecting pools with the most availabilit https://aws.amazon.com/about-aws/whats-new/2019/08/new-capacity-optimized-allocation-strategy-for-provisioning-amazon-ec2-spot-instances/

    Adapted from community discussion by rev2211 · 2024-05-26 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. R

       rev2211

       2024-05-26

       Selected C7 upvotes

       capacity-optimized strategy automatically analyzes the available Spot capacity pools and selects the pool that provides the highest chance of launching the desired number of instances. Spot Instance Advisor can provide guidance on Spot instance pricing and interruption history, but it does not specifically address the goal of selecting pools with the most availabilit https://aws.amazon.com/about-aws/whats-new/2019/08/new-capacity-optimized-allocation-strategy-for-provisioning-amazon-ec2-spot-instances/

    2. K

       kondratyevmn

       2024-05-11

       Selected C3 upvotes

       https://docs.aws.amazon.com/whitepapers/latest/cost-optimization-leveraging-ec2-spot-instances/spot-best-practices.html Use the price and capacity optimized allocation strategy. Allocation strategies in EC2 Auto Scaling groups help you to provision your target capacity without the need to manually look for the Spot Instance pools with spare capacity. We recommend using the price-capacity-optimized strategy because this strategy automatically provisions instances from the most-available Spot Instance pools that also have the lowest possible price. Because your Spot Instance capacity is sourced from pools with optimal capacity, this decreases the possibility that your Spot Instances are interrupted. For more information about allocation strategies, see Spot Instances in the Amazon EC2 Auto Scaling User Guide.

    3. N

       noahsark

       2024-06-21

       Selected C4 upvotes

       https://aws.amazon.com/blogs/compute/introducing-price-capacity-optimized-allocation-strategy-for-ec2-spot-instances/

    4. G

       Gomer

       2024-05-23

       3 upvotes

       I'd like to clarify my answer. After looking at this again, I'd have to conclude that both "C" and "D" could be correct, and I'm leaning towards "C" just because the ONLY criteria is to use pools with the most availability (even if they cost more). Capacity-Optimized: "Strictly selects the deepest pools, but sometimes it can pick high-priced pools even when there are low-priced pools available with marginally less capacity" https://aws.amazon.com/blogs/compute/introducing-price-capacity-optimized-allocation-strategy-for-ec2-spot-instances/

16. Question 16 of 25

    A company manages its multi-account environment by using AWS Organizations. The company needs to automate the creation of daily incremental backups of any Amazon Elastic Block Store (Amazon EBS) volume that is marked with a Lifecycle: Production tag in one of its primary AWS accounts. The company wants to prevent users from using Amazon EC2 * permissions to delete any of these production snapshots. What should a SysOps administrator do to meet these requirements?

    • ACreate a daily snapshot of all EBS volumes by using Amazon Data Lifecycle Manager. Specify Lifecycle as the tag key. Specify Production as the tag value.
    • BAssociate a service control policy (SCP) with the account to deny users the ability to delete EBS snapshots. Create an Amazon EventBridge rule with a 24-hour cron schedule. Configure EBS Create Snapshot as the target. Target all EBS volumes with the specified tags.
    • CCreate a daily snapshot of all EBS volumes by using AWS Backup. Specify Lifecycle as the tag key. Specify Production as the tag value.
    • DCreate a daily Amazon Machine Image (AMI) of every production EC2 instance within the AWS account by using Amazon Data Lifecycle Manager.

    Show answer

    Correct answer: C

    How others answered

    • C39%
    • B39%
    • A23%

    Only 39% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think answer is "C" because using AWS backup is the established method/tool for this, and EC2 instance role/profile would not be allow to control or delete backups unless explicitly allowed. The word "cron" in en answer "B" is red flag that is is the wrong answer. I know all about cron, and it's invaluable and bullet proof on a system. However, it's anathema to AWS Cloud way of doing things. Wherever you see the word "cron" in AWS response, you know its the wrong answer (IMHO).

    Adapted from community discussion by Gomer · 2023-05-03 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • repost.aws documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. G

       Gomer

       2023-05-03

       Selected C11 upvotes

       I think answer is "C" because using AWS backup is the established method/tool for this, and EC2 instance role/profile would not be allow to control or delete backups unless explicitly allowed. The word "cron" in en answer "B" is red flag that is is the wrong answer. I know all about cron, and it's invaluable and bullet proof on a system. However, it's anathema to AWS Cloud way of doing things. Wherever you see the word "cron" in AWS response, you know its the wrong answer (IMHO).

    2. T

       TareDHakim

       2024-01-07

       Selected C5 upvotes

       The question mentioned the solution requirements are: 1. Automated EBS backups 2. Incremental EBS backups 3. Lifecycle policy 4. Prevent deletion by users (with Permission to delete snapshots) AWS Backup is smarter than DLM, they both automatically create AMIs and Incremental Snapshots. However, AWS BACKUP comes with features to manage access to the created AMIs and snapshots, and protect them from deletion with a vault lock. https://repost.aws/questions/QU8o5m88yhQk6UVAgQA3Mnng/aws-backup-vs-aws-data-lifecycle-management.

    3. C

       Christina666

       2023-07-28

       5 upvotes

       Option C (Creating a daily snapshot of all EBS volumes by using AWS Backup) is incorrect because AWS Backup is a different service for managing backup and recovery of various AWS resources, including EBS volumes. It does not use the "Lifecycle" tag for EBS snapshots, and it does not inherently prevent users from deleting the snapshots using EC2 permissions.

    4. T

       Tarsmandaturd

       2024-05-15

       Selected C2 upvotes

       For me the answer has to be C. Cron is usually a red herring that it's the wrong answer. Whilst B makes sense in the fact that it's using SCP controls alongside organizations, Cron just feels like bad practice in the context of AWS exams. Consider in backup controls that you are not able to delete unless specifically allowed and to really prevent deletion at an organizational level you can apply compliance mode which after a cooling off period, will not allow any users to delete the resource: https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html#:~:text=AWS%20Backup%20ensures%20that%20your%20backups%20are%20available,locked%20vault%2C%20AWS%20Backup%20will%20deny%20the%20operation.

17. Question 17 of 25

    A company hosts a Windows-based file server on a fleet of Amazon EC2 instances across multiple Availability Zones. The current setup does not allow application servers to access files simultaneously from the EC2 fleet. Which solution will allow this access in the MOST operationally efficient way?

    • ACreate an Amazon Elastic File System (Amazon EFS) Multi-AZ file system. Copy the files to the EFS file system. Connect the EFS file system to mount points on the application servers.
    • BCreate an Amazon FSx for Windows File Server Multi-AZ file system. Copy the files to the Amazon FSx file system. Adjust the connections from the application servers to use the share that the Amazon FSx file system exposes.
    • CCreate an Amazon Elastic Block Store (Amazon EBS) volume that has EBS Multi-Attach enabled. Create an Auto Scaling group for the Windows file server. Use a script in the file server's user data to attach the SharedFileAccess tag to the EBS volume during launch.
    • DCreate two Amazon FSx for Windows File Server file systems. Configure Distributed File System (DFS) replication between the file systems. Copy the files to the Amazon FSx file systems. Adjust the connections from the application servers to use the shares that the Amazon FSx file systems expose.

    Show answer

    Correct answer: B

    How others answered

    • B89%

    Explanation

    A is incorrect because talks about EFS in general. C is incorrect because EBS Multi-Attach only works for instances in the same AZ. D is incorrect because Distributed File System (DFS) replication applies only for regions. B is the correct answer. https://aws.amazon.com/blogs/storage/how-to-replicate-amazon-fsx-file-server-data-across-aws-regions/ https://aws.amazon.com/blogs/storage/delivering-instant-data-sharing-with-multi-attach-enabled-amazon-ebs/

    Adapted from community discussion by Zotarix · 2024-01-24 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion3

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. K

       kondratyevmn

       2023-11-12

       Selected B8 upvotes

       https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html

    2. Z

       Zotarix

       2024-01-24

       3 upvotes

       A is incorrect because talks about EFS in general. C is incorrect because EBS Multi-Attach only works for instances in the same AZ. D is incorrect because Distributed File System (DFS) replication applies only for regions. B is the correct answer. https://aws.amazon.com/blogs/storage/how-to-replicate-amazon-fsx-file-server-data-across-aws-regions/ https://aws.amazon.com/blogs/storage/delivering-instant-data-sharing-with-multi-attach-enabled-amazon-ebs/

    3. K

       kondratyevmn

       2023-11-12

       4 upvotes

       https://docs.aws.amazon.com/fsx/latest/WindowsGuide/high-availability-multiAZ.html

18. Question 18 of 25

    A company is running a website on Amazon EC2 instances behind an Application Load Balancer (ALB). The company configured an Amazon CloudFront distribution and set the ALB as the origin. The company created an Amazon Route 53 CNAME record to send all traffic through the CloudFront distribution. As an unintended side effect, mobile users are now being served the desktop version of the website. Which action should a SysOps administrator take to resolve this issue?

    • AConfigure the CloudFront distribution behavior to forward the User-Agent header.
    • BConfigure the CloudFront distribution origin settings. Add a User-Agent header to the list of origin custom headers.
    • CEnable IPv6 on the ALB. Update the CloudFront distribution origin settings to use the dualstack endpoint.
    • DEnable IPv6 on the CloudFront distribution. Update the Route 53 record to use the dualstack endpoint.

    Show answer

    Correct answer: A

    How others answered

    • A77%
    • B23%

    Explanation

    I agree it is A because: 1. B is wrong, since you are modifying origin custom headers that are values that you set unilaterally, independent of the Header of the request that you received from client. As the documentation states, the uses cases for for origin custom headers are: Identifying requests from CloudFront Determining which requests come from a particular distribution Enabling cross-origin resource sharing (CORS) Controlling access to content (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html)

    Adapted from community discussion by Pepepep · 2022-06-01 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • repost.aws documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. P

       Pepepep

       2022-06-01

       Selected A20 upvotes

       I agree it is A because: 1. B is wrong, since you are modifying origin custom headers that are values that you set unilaterally, independent of the Header of the request that you received from client. As the documentation states, the uses cases for for origin custom headers are: Identifying requests from CloudFront Determining which requests come from a particular distribution Enabling cross-origin resource sharing (CORS) Controlling access to content (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html)

    2. P

       Pepepep

       2024-09-25

       15 upvotes

       2. A is correct. If you want CloudFront to cache different versions of your objects based on the device that a user is using to view your content, we recommend that you configure CloudFront to forward one or more of the following headers to your custom origin: CloudFront-Is-Desktop-Viewer CloudFront-Is-Mobile-Viewer CloudFront-Is-SmartTV-Viewer CloudFront-Is-Tablet-Viewer As you can see based on what comes in the request received by CF, It is going to set the value to true before forwarding the request to your origin. The resume, with origin custom headers you are the one that decide what is going to be on the header, there is no way to match what it comes on the request received on CF and what is going to be sent to the origin. On the other hand with User-Agent header, CF inspects the header and determines what type of device is used (Smart TV, Tablet, Desktop, Mobile).

    3. D

       dontcomplain

       2022-04-22

       10 upvotes

       Why would this not be B? It would serve the same function more efficiently?

    4. C

       Christina666

       2024-09-25

       Selected A5 upvotes

       User-Agent header If you want CloudFront to cache different versions of your objects based on the device that a user is using to view your content, we recommend that you configure CloudFront to forward one or more of the following headers to your custom origin: CloudFront-Is-Desktop-Viewer CloudFront-Is-Mobile-Viewer CloudFront-Is-SmartTV-Viewer CloudFront-Is-Tablet-Viewer https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-user-agent-header

19. Question 19 of 25

    A SysOps administrator must analyze Amazon CloudWatch logs across 10 AWS Lambda functions for historical errors. The logs are in JSON format and are stored in Amazon S3. Errors sometimes do not appear in the same field, but all errors begin with the same string prefix. What is the MOST operationally efficient way for the SysOps administrator to analyze the log files?

    • AUse S3 Select to write a query to search for errors. Run the query across all log groups of interest.
    • BCreate an AWS Glue processing job to index the logs of interest. Run a query in Amazon Athena to search for errors.
    • CUse Amazon CloudWatch Logs Insights to write a query to search for errors. Run the query across all log groups of interest.
    • DUse Amazon CloudWatch Contributor Insights to create a rule. Apply the rule across all log groups of interest.

    Show answer

    Correct answer: B

    How others answered

    • B63%
    • C34%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I vote for B. Seems to me this is the right answer. https://docs.aws.amazon.com/athena/latest/ug/glue-athena.html Why not A Looks like S3 select has several limitations. https://docs.aws.amazon.com/AmazonS3/latest/userguide/selecting-content-from-objects.html According to the question "Errors sometimes do not appear in the same field". So I assume we need more advanced tool. Why not C,D Both Amazon CloudWatch Logs Insights and Amazon CloudWatch Contributor Insights process logs from AWS CloudWatch log groups. But in our case we have logs stored on S3. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContributorInsights-CreateRule.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html

    Adapted from community discussion by xSohox · 2024-02-23 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. X

       xSohox

       2024-02-23

       Selected B8 upvotes

       I vote for B. Seems to me this is the right answer. https://docs.aws.amazon.com/athena/latest/ug/glue-athena.html Why not A Looks like S3 select has several limitations. https://docs.aws.amazon.com/AmazonS3/latest/userguide/selecting-content-from-objects.html According to the question "Errors sometimes do not appear in the same field". So I assume we need more advanced tool. Why not C,D Both Amazon CloudWatch Logs Insights and Amazon CloudWatch Contributor Insights process logs from AWS CloudWatch log groups. But in our case we have logs stored on S3. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContributorInsights-CreateRule.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html

    2. T

       TwinSpark

       2024-03-27

       Selected B5 upvotes

       "AWS Glue is a serverless data integration service that can discover, prepare, and combine data for analytics, machine learning, and application development. Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL." from Freshtimi down here To query logs stored in Amazon S3, you may need to use Amazon Athena, which is a service designed for querying data in S3. You can use AWS Glue to catalog and prepare the logs in S3, and then query them using Athena. https://docs.aws.amazon.com/athena/latest/ug/glue-athena.html

    3. F

       Freshtimi

       2023-12-14

       3 upvotes

       B. Create an AWS Glue processing job to index the logs of interest. Run a query in Amazon Athena to search for errors. Since the logs are stored in Amazon S3, using AWS Glue to create a processing job to index the logs and then querying them using Amazon Athena is the most operationally efficient way to analyze the log files. AWS Glue is a serverless data integration service that can discover, prepare, and combine data for analytics, machine learning, and application development. Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. This combination allows the SysOps administrator to efficiently search for errors across the logs from multiple AWS Lambda functions.

    4. M

       mestule

       2024-10-29

       Selected B3 upvotes

       CloudWatch Logs Insights cannot directly analyze Lambda logs stored in S3. CloudWatch Logs Insights works with logs stored within CloudWatch Logs service, not S3 buckets.

20. Question 20 of 25

    A company has applications that process transaction requests multiple times each minute. The applications write transaction data to a single Amazon RDS DB instance. As the company begins to process more transactions, the company becomes concerned that it has no failover solution in place for disaster recovery (DR). The company needs the DB instance to fail over automatically without losing any committed transactions. Which solution will meet these requirements?

    • ACreate an RDS read replica in the same AWS Region. Configure an AWS Lambda function to promote the replica as the primary DB instance during a DR scenario.
    • BCreate an RDS read replica in a different AWS Region. Configure an AWS Lambda function to promote the replica as the primary DB instance during a DR scenario.
    • CModify the DB instance to be a Multi-AZ deployment.
    • DSetup an Amazon CloudWatch alarm that monitors the DB instance memory utilization with a threshold greater than 90%. Invoke an AWS Lambda function to restart the DB instance.

    Show answer

    Correct answer: C

    How others answered

    • C79%
    • B21%

    Explanation

    Keyword is "Without losing any committed transactions." AWS Lambda function will need time to process the DB promotion. Multi-AZ is design for HA.

    Adapted from community discussion by [Removed] · 2024-02-17 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. [

       [Removed]

       2024-02-17

       4 upvotes

       Keyword is "Without losing any committed transactions." AWS Lambda function will need time to process the DB promotion. Multi-AZ is design for HA.

    2. C

       callspace

       2024-04-16

       Selected C2 upvotes

       C It is. can't be B. Because the company needs the DB instance to fail over automatically without losing any committed transactions.

    3. C

       Creature

       2024-01-06

       Selected C2 upvotes

       Concur with C. Refer to this document: https://aws.amazon.com/rds/features/multi-az/

    4. T

       TwinSpark

       2024-03-30

       1 upvote

       with multi AZ failover support is automatic https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html the guied on aws Blobg are just guide, they can be not the best solution, but just a solution. I Go for multi az: https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-is-different-in-the-cloud.html https://aws.amazon.com/rds/features/multi-az/?nc1=h_ls

21. Question 21 of 25

    A company has a private Amazon S3 bucket that contains sensitive information. A SysOps administrator needs to keep logs of the IP addresses from authentication failures that result from attempts to access objects in the bucket. The logs must be stored so that they cannot be overwritten or deleted for 90 days. Which solution will meet these requirements?

    • ACreate an AWS CloudTrail trail. Configure the log files to be saved to Amazon CloudWatch Logs. Configure the log group with a retention period of 90 days.
    • BCreate an AWS CloudTrail trail. Configure the log files to be saved to a different S3 bucket. Turn on CloudTrail log file integrity validation for 90 days.
    • CTurn on access logging for the S3 bucket. Configure the access logs to be saved to Amazon CloudWatch Logs. Configure the log group with a retention period of 90 days.
    • DTurn on access logging for the S3 bucket. Configure the access logs to be saved in a second S3 bucket. Turn on S3 Object Lock on the second S3 bucket, and configure a default retention period of 90 days.

    Show answer

    Correct answer: D

    How others answered

    • D74%

    Only 74% agreed on this answer — treat it as contested rather than settled.

    Explanation

    NOT A: Can't configure CloudTrail to store logs in CloudWatch Logs. CloudTrail uses S3 bucket. CloudWatch Logs is not applicable. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/get-and-view-cloudtrail-log-files.html NOT B: "Integrity validation" is only designed to detect changes or deletions of CloudTrail logs. It depends on other security measures to block this. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html NOT C: Server access logging only delivers access logs for a source bucket to a target bucket. CloudWatch log group is not applicable. https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.htm NOT D: "S3 buckets with S3 Object Lock can't be used as destination buckets for server access logs." https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html

    Adapted from community discussion by Gomer · 2023-05-04 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. K

       kati2k22cz

       2022-09-02

       Selected D11 upvotes

       D. Learn more here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html

    2. P

       princajen

       2022-09-01

       10 upvotes

       I would have thought is A, but after reading I found this: "CloudTrail does not deliver logs for requests that fail authentication (in which the provided credentials are not valid). However, it does include logs for requests in which authorization fails (AccessDenied) and requests that are made by anonymous users." https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html

    3. C

       Christina666

       2023-07-29

       Selected D8 upvotes

       Option D is the most appropriate solution because it covers the specific requirements mentioned in the question. By turning on access logging for the S3 bucket, you can capture the IP addresses from authentication failures. You then configure these access logs to be saved in a separate S3 bucket, ensuring data durability and separation from the source bucket. By enabling S3 Object Lock on the second S3 bucket and setting a default retention period of 90 days, you ensure that the logs cannot be deleted or overwritten for the specified duration.

    4. G

       Gomer

       2023-05-04

       4 upvotes

       NOT A: Can't configure CloudTrail to store logs in CloudWatch Logs. CloudTrail uses S3 bucket. CloudWatch Logs is not applicable. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/get-and-view-cloudtrail-log-files.html NOT B: "Integrity validation" is only designed to detect changes or deletions of CloudTrail logs. It depends on other security measures to block this. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html NOT C: Server access logging only delivers access logs for a source bucket to a target bucket. CloudWatch log group is not applicable. https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.htm NOT D: "S3 buckets with S3 Object Lock can't be used as destination buckets for server access logs." https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html

22. Question 22 of 25

    Select 2

    A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 to route traffic. The company also has a static website that is configured in an Amazon S3 bucket. A SysOps administrator must use the static website as a backup to the web application. The failover to the static website must be fully automated. Which combination of actions will meet these requirements? (Choose two.)

    • ACreate a primary failover routing policy record. Configure the value to be the ALB.
    • BCreate an AWS Lambda function to switch from the primary website to the secondary website when the health check fails.
    • CCreate a primary failover routing policy record. Configure the value to be the ALB. Associate the record with a Route 53 health check.
    • DCreate a secondary failover routing policy record. Configure the value to be the static website. Associate the record with a Route 53 health check.
    • ECreate a secondary failover routing policy record. Configure the value to be the static website.

    Show answer

    Correct answer: C, E

    How others answered

    • CE75%
    • CD16%

    Explanation

    Create the failover endpoint Open the Amazon Route 53 console, and then choose Hosted zones. Choose the hosted zone that you want to create the record for. Choose Create record, and input the following: For Record name, use the same value that you entered for the primary record. For Record type, choose A – Routes traffic to an IPV4 address and some AWS resources. For Alias, choose Yes. Note: Aliases automatically use a time to live (TTL) that matches the alias target. For Alias Target, choose the S3 bucket that you created previously. For Routing Policy, choose Failover. For Failover Record Type, choose Secondary. For Set ID, enter a name. Note: The name for the Set ID on your failover endpoint must be different from the name of the Set ID on your primary endpoint. For Associate with Health Check, choose No. Choose Create records.

    Adapted from community discussion by princajen · 2022-09-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • repost.aws documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. N

       Nono90

       2022-11-07

       Selected C, E8 upvotes

       https://aws.amazon.com/pt/premiumsupport/knowledge-center/fail-over-s3-r53/

    2. X

       XAvenger

       2022-09-17

       6 upvotes

       CE. It cannot be "CD" Please read your link: Create the failover endpoint ... For Failover Record Type, choose Secondary. ... For Associate with Health Check, choose No.

    3. P

       princajen

       2022-09-08

       Selected C, E2 upvotes

       Create the failover endpoint Open the Amazon Route 53 console, and then choose Hosted zones. Choose the hosted zone that you want to create the record for. Choose Create record, and input the following: For Record name, use the same value that you entered for the primary record. For Record type, choose A – Routes traffic to an IPV4 address and some AWS resources. For Alias, choose Yes. Note: Aliases automatically use a time to live (TTL) that matches the alias target. For Alias Target, choose the S3 bucket that you created previously. For Routing Policy, choose Failover. For Failover Record Type, choose Secondary. For Set ID, enter a name. Note: The name for the Set ID on your failover endpoint must be different from the name of the Set ID on your primary endpoint. For Associate with Health Check, choose No. Choose Create records.

    4. B

       Bragg

       2022-09-08

       Selected C, E4 upvotes

       In the Create the failover endpoint section : For Associate with Health Check, choose No https://aws.amazon.com/pt/premiumsupport/knowledge-center/fail-over-s3-r53/

23. Question 23 of 25

    Select 2

    A company must ensure that any objects uploaded to an S3 bucket are encrypted. Which of the following actions will meet this requirement? (Choose two.)

    • AImplement AWS Shield to protect against unencrypted objects stored in S3 buckets.
    • BImplement Object access control list (ACL) to deny unencrypted objects from being uploaded to the S3 bucket.
    • CImplement Amazon S3 default encryption to make sure that any object being uploaded is encrypted before it is stored.
    • DImplement Amazon Inspector to inspect objects uploaded to the S3 bucket to make sure that they are encrypted.
    • EImplement S3 bucket policies to deny unencrypted objects from being uploaded to the buckets.

    Show answer

    Correct answer: C, E

    How others answered

    • CE100%

    Explanation

    Its encrypted at the time of writing to disk. :). Ensures all objects are encrypted when data is stored in S3, if using Amazon S3 default encryption ie server side encryption. Looking at an extension of your link : https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it.

    Adapted from community discussion by Finger41 · 2022-05-23 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. C

       CVDON

       2023-02-08

       9 upvotes

       C and E. S3 encryption and S3 bucket policy with deny S3 Put request whithout x-amz-server-side-encryption header

    2. F

       Finger41

       2022-05-10

       Selected C, E3 upvotes

       C & E - https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/

    3. B

       by116549

       2022-05-10

       1 upvote

       Sorry @Finger41 and @Mecdrox I am bit confused by C as the question states: "verify that all items uploaded to an S3 bucket are encrypted prior to uploading them" Option C from what I can see states: "With Amazon S3 default encryption, you can set the default encryption behaviuor for an S3 bucket so that all new objects are encrypted when they are stored in the bucket. The objects are encrypted using server-side encryption with either Amazon S3-managed keys (SSE-S3) or AWS KMS keys stored in AWS Key Management Service (AWS KMS) (SSE-KMS)." https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html Does the data not need to be encrypted prior to being uploaded?

    4. F

       Finger41

       2022-05-23

       2 upvotes

       Its encrypted at the time of writing to disk. :). Ensures all objects are encrypted when data is stored in S3, if using Amazon S3 default encryption ie server side encryption. Looking at an extension of your link : https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it.

24. Question 24 of 25

    A company is planning to host its stateful web-based applications on AWS. A SysOps administrator is using an Auto Scaling group of Amazon EC2 instances. The web applications will run 24 hours a day, 7 days a week throughout the year. The company must be able to change the instance type within the same instance family later in the year based on the traffic and usage patterns. Which EC2 instance purchasing option will meet these requirements MOST cost-effectively?

    • AConvertible Reserved Instances
    • BOn-Demand Instances
    • CSpot Instances
    • DStandard Reserved Instances

    Show answer

    Correct answer: A

    How others answered

    • A60%
    • D38%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The questions says: "must be able to change the instance TYPE within the SAME instance FAMILY". Note that the question says TYPE, and not SIZE. According to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ri-modifying.html, You can "Change the instance SIZE within the same instance family and generation" and "For example, you can modify a Reserved Instance from t2.small to t2.large because they're both in the same T2 family and generation. But you can't modify a Reserved Instance from T2 to M2 or from T2 to T3, because in both these examples, the target instance family and generation are not the same as the original Reserved Instance." In the above example: General Purpose Family, TYPE T, Generation 2, SIZE small (T2.large) (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#AvailableInstanceTypes) Convert it to T2.large. This is same TYPE (T2), different SIZE (large). Hence, Standard would cover it. However, if I want to change T3.small, this would be a different TYPE (T3) within the same family (General Purpose). Hope this example helps claryifing.

    Adapted from community discussion by foreverlearner · 2022-12-21 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. F

       foreverlearner

       2022-12-21

       Selected A20 upvotes

       The questions says: "must be able to change the instance TYPE within the SAME instance FAMILY". Note that the question says TYPE, and not SIZE. According to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ri-modifying.html, You can "Change the instance SIZE within the same instance family and generation" and "For example, you can modify a Reserved Instance from t2.small to t2.large because they're both in the same T2 family and generation. But you can't modify a Reserved Instance from T2 to M2 or from T2 to T3, because in both these examples, the target instance family and generation are not the same as the original Reserved Instance." In the above example: General Purpose Family, TYPE T, Generation 2, SIZE small (T2.large) (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#AvailableInstanceTypes) Convert it to T2.large. This is same TYPE (T2), different SIZE (large). Hence, Standard would cover it. However, if I want to change T3.small, this would be a different TYPE (T3) within the same family (General Purpose). Hope this example helps claryifing.

    2. S

       squeeze_talus0y

       2023-01-14

       Selected A4 upvotes

       https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ri-modifying.html#ri-modification-instancemove For Standard RI you cannot change family or generation but you can change size - "But you can't modify a Reserved Instance from T2 to M2 or from T2 to T3, because in both these examples, the target instance family and generation are not the same as the original Reserved Instance." Issue here is that they mention "TYPE" which is just another word for "generation within a family". https://docs.aws.amazon.com/whitepapers/latest/cost-optimization-reservation-models/standard-vs.-convertible-offering-classes.html We can clearly see here they use the word "TYPE" above for Standard RI. They are only interested into changing the size.

    3. H

       henryford

       2023-05-10

       6 upvotes

       This is wrong. TYPE and SIZE are the same thing in this context. What you're saying to be the "TYPE" is actually the FAMILY. t2.large = Family T, Generation 2, Type Large. General Purpose is not the family.

    4. M

       MattBGH

       2023-08-28

       2 upvotes

       Answer is D https://docs.aws.amazon.com/whitepapers/latest/cost-optimization-reservation-models/standard-vs.-convertible-offering-classes.html Standard Reserved Instances typically provide the highest discount levels. It Enables you to modify Availability Zone, scope, networking type, and instance size (within the same instance type) of your Reserved Instance. Convertible Reserved Instance, Enables you to exchange one or more Convertible Reserved Instances for another Convertible Reserved Instance with a different configuration, including instance family, operating system, and tenancy.

25. Question 25 of 25

    A company analyzes sales data for its customers. Customers upload files to one of the company's Amazon S3 buckets, and a message is posted to an Amazon Simple Queue Service (Amazon SQS) queue that contains the object Amazon Resource Name (ARN). An application that runs on an Amazon EC2 instance polls the queue and processes the messages. The processing time depends on the size of the file. Customers are reporting delays in the processing of their files. A SysOps administrator decides to configure Amazon EC2 Auto Scaling as the first step. The SysOps administrator creates an Amazon Machine Image (AMI) that is based on the existing EC2 instance. The SysOps administrator also creates a launch template that references the AMI. How should the SysOps administrator configure the Auto Scaling policy to improve the response time?

    • AAdd several different instance sizes in the launch template. Create an Auto Scaling policy based on the ApproximateNumberOfMessagesVisible metric to select the size of the instance based on the number of messages in the queue.
    • BCreate an Auto Scaling policy based on the ApproximateNumberOfMessagesDelayed metric to scale the number of instances based on the number of messages in the queue that have been delayed.
    • CCreate a custom metric based on the ASGAverageCPUUtilization metric and the GroupPendingInstances metric from the Auto Scaling group. Modify the application to calculate the metric and post the metric to Amazon CloudWatch once each minute. Create an Auto Scaling policy based on this metric to scale the number of instances.
    • DCreate a custom metric based on the ApproximateNumberOfMessagesVisible metric and the number of instances in the InService state in the Auto Scaling group. Modify the application to calculate the metric and post the metric to Amazon CloudWatch once each minute. Create an Auto Scaling policy based on this metric to scale the number of instances.

    Show answer

    Correct answer: D

    How others answered

    • D81%
    • B19%

    Explanation

    The issue here is that the app is taking too long to process the files. This means that the messages are in the SQS queue, just they're not being processed fast enough. It can't be B as "ApproximateNumberOfMessagesDelayed – Returns the approximate number of messages in the queue that are delayed and not available for reading immediately" (https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueAttributes.html). This would mean that the messages are not available, which isn't the case in this question The link posted by zolthar_z clearly explains why it's D. The app takes a variable amount of time to process each message, hence the app should calculate the Backlog per instance

    Adapted from community discussion by foreverlearner · 2022-12-21 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SOA-C02 or CertExamHQ.

    1. F

       foreverlearner

       2022-12-21

       Selected D4 upvotes

       The issue here is that the app is taking too long to process the files. This means that the messages are in the SQS queue, just they're not being processed fast enough. It can't be B as "ApproximateNumberOfMessagesDelayed – Returns the approximate number of messages in the queue that are delayed and not available for reading immediately" (https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueAttributes.html). This would mean that the messages are not available, which isn't the case in this question The link posted by zolthar_z clearly explains why it's D. The app takes a variable amount of time to process each message, hence the app should calculate the Backlog per instance

    2. J

       jipark

       2023-08-12

       Selected D4 upvotes

       I thought B, but it looks D. numberofDelay seems just delay setting msg, not queued msg : B. ApproximateNumberOfMessagesDelayed – Returns the approximate number of messages in the queue that are delayed and not available for reading immediately. This can happen when the queue is configured as a delay queue or when a message has been sent with a delay parameter. D. ApproximateNumberOfMessagesNotVisible – Returns the approximate number of messages that are in flight. Messages are considered to be in flight if they have been sent to a client but have not yet been deleted or have not yet reached the end of their visibility window.

    3. N

       numark

       2024-11-21

       2 upvotes

       It is D: ApproximateNumberOfMessagesVisible Metric: This metric indicates the number of messages waiting to be processed in the Amazon SQS queue.Number of InService Instances:The scaling decision should consider the number of currently available EC2 instances in the Auto Scaling group to handle the load efficiently. Custom Metric:By creating a custom metric that divides the ApproximateNumberOfMessagesVisible by the number of running (InService) instances, you can calculate the per-instance workload.Posting the Metric to CloudWatch:Once the application posts this custom metric to Amazon CloudWatch, you can create an Auto Scaling policy that uses it to scale the number of instances dynamically.\ B: ApproximateNumberOfMessagesDelayed refers to messages that were delayed because of SQS configurations like delay queues or retries. It doesn’t reflect the immediate workload waiting to be processed.

    4. V

       Vivec

       2023-03-09

       Selected D2 upvotes

       When there are delays in processing files due to a high volume of messages in the queue, adding more instances using Auto Scaling can help to reduce the processing time. The ApproximateNumberOfMessagesVisible metric is a good indicator of the workload on the EC2 instances. By creating an Auto Scaling policy based on this metric, the number of instances can be scaled up or down depending on the number of messages in the queue.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C02 practice, question 1 of 25