Amazon SOA-C02 Amazon AWS Certified SysOps Administrator - Associate (2021) Exam Exam Practice Test Questions

• Question 1

  A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted.What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?

  • Set up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
  • Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.
  • Create an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
  • Use AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.

  Show Answer Answer: B Next

• Question 2

  A SysOps administrator has enabled AWS CloudTrail in an AWS account. If CloudTrail is disabled, it must be re-enabled immediately. What should the SysOps administrator do to meet these requirements WITHOUT writing custom code?

  • Add the AWS account to AWS Organizations. Enable CloudTrail in the management account.
  • Create an AWS Config rule that is invoked when CloudTrail configuration changes. Apply the AWS-ConfigureCloudTrailLogging automatic remediation action.
  • Create an AWS Config rule that is invoked when CloudTrail configuration changes. Configure the rule to invoke an AWS Lambda function to enable CloudTrail.
  • Create an Amazon EventBridge (Amazon CloudWatch Events) hourly rule with a schedule pattern to run an AWS Systems Manager Automation document to enable CloudTrail.

  Show Answer Answer: B Next

• Question 3

  A SysOps Administrator is managing a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in anEC2 Auto Scaling group. The administrator wants to set an alarm for when all target instances associated with the ALB are unhealthy.Which condition should be used with the alarm?

  • AWS/ApplicationELB HealthyHostCount <= 0
  • AWS/ApplicationELB UnhealthyHostCount >= 1
  • AWS/EC2 StatusCheckFailed <= 0
  • AWS/EC2 StatusCheckFailed >= 1

  Show Answer Answer: A Next

• Question 4

  A company with multiple AWS accounts needs to obtain recommendations for AWS Lambda functions and identify optimal resource configurations for each Lambda function. How should a SysOps administrator provide these recommendations?

  • Create an AWS Serverless Application Repository and export the Lambda function recommendations.
  • Enable AWS Compute Optimizer and export the Lambda function recommendations
  • Enable all features of AWS Organization and export the recommendations from AWS CloudTrail Insights.
  • Run AWS Trusted Advisor and export the Lambda function recommendations

  Show Answer Answer: B Next

• Question 5

  A company hosts an online shopping portal in the AWS Cloud. The portal provides HTTPS security by using a TLS certificate on an Elastic Load Balancer (ELB). Recently, the portal suffered an outage because the TLS certificate expired. A SysOps administrator must create a solution to automatically renew certificates to avoid this issue in the future.What is the MOST operationally efficient solution that meets these requirements?

  • Request a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. Write a scheduled AWS Lambda function to renew the certificate every 18 months.
  • Request a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
  • Register a certificate with a third-party certificate authority (CA). Import this certificate into AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
  • Register a certificate with a third-party certificate authority (CA). Configure the ELB to import the certificate directly from the CA. Set the certificate refresh cycle on the ELB to refresh when the certificate is within 3 months of the expiration date.

  Show Answer Answer: B Next