SOA-C01 Sample Questions Answers

Include the S3 bucket as a mapping in each template.

Add the S3 bucket as a resource in each template.

Create the S3 bucket in its own template and export it.

Generate the S3 bucket using StackSets.

D18912E1457D5D1DDCBD40AB3BF70D5D

The Administrator has requested too many instances at once and must request fewer instances in batches.

The concurrent running instance limit has been reached, and an EC2 limit increase request must be filed with AWS Support.

AWS does not currently have enough available capacity and a different instance type must be used.

The Administrator must specify the maximum number of instances to be created while provisioning EC2 instances.

The cluster has Enhanced VPC Routing enabled and it must be turned off

The cluster is only a single node and needs to be expanded to multi-node.

The cluster login credentials are incorrect request new credentials from the Administrator

The cluster nodes are running in multiple Availability Zones, and all need to be placed in a single Availability Zone.

AWS CloudTrail logs

Elastic Load Balancer access logs

Amazon S3 access logs

VPC Flow Logs

Stream the CloudTrail logs to Amazon CloudWatch to store logs at a secondary location.

Enable log file integrity validation and use digest files to verify the hash value of the log file.

Replicate the S3 log bucket across regions, and encrypt log files with S3 managed keys.

Enable S3 server access logging to track requests made to the log bucket for security audits.

Create a role for each department within AWS 1AM and assign each role the necessary permissions.

Create a user for each department within AWS 1AM and assign each user the necessary permissions.

Implement service control policies within AWS Organizations to determine which resources each department can access

Place each department into an organizational unit (OU) within AWS Organizations and use 1AM policies to determine which resources they can access

The EC2 instances are in the same Availability Zone, causing contention between the two.

The route tables are not updated to allow traffic to flow between the ALB and the EC2 instances.

The ALB health check has failed, and the ALB has taken EC2 instances out of service.

The Amazon Route 53 health check has failed, and the ALB has taken EC2 instances out of service.

Assign elastic IP addresses to the instances and create a route from the private subnets to the internet gateway.

Delete the NAT instance and replace it with AWS WAF.

Disable source/destination checks on the NAT instance.

Start/Stop the NAT instance so it is launched on a different host.

Dedicated Hosts

On-Demand instances

Reserved instances

Spot instances

AWS Snowball

AWS Direct Connect

AWS Storage Gateway

Amazon S3 Transfer Acceleration

Configuring IPsec tunnels for the VPN

Ensuring high availability of the EC2 instance

Ensuring high availability of the VPN connection

Managing the health of the underlying EC2 host

Create an Amazon Machine Image (AMI) of the EC2 instance. Share the AMI with authorized accounts owned by the company. Allow the Data Scientists to create EC2 instances with this AMI.

Distribute an AWS CloudFormation template containing the EC2 instance configuration to the Data Scientists from an Amazon S3 bucket. Set the S3 template object to be readable from the AWS Organization orgid.

Publish the instance configuration to the Private Marketplace Share the Private Marketplace with the company's AWS accounts. Allow the Data Scientists to subscribe and launch the product from the Private Marketplace.

Upload an AWS CloudFormation template to AWS Service Catalog. Allow the Data Scientists to provision and deprovision products from the company's AWS Service Catalog portfolio.

Copy an automated RDS snapshot to the security account using the copy-db-snapshot command with the AWS CLI.

Create an RDS MySQL Read Replica for the critical database in the security account, then enable automatic backups for the Read Replica.

Create an RDS snapshot with the AWS CLI create-db-snapshot command, share it with the security account, then create a copy of the shared snapshot in the security account.

Use AWS DMS to replicate data from the critical database to another RDS MySQL instance in the security account, then use an automated backup for the RDS instance.

Reboot the instance as soon as possible to perform the system maintenance before the scheduled retirement.

Reboot the instance outside business hours to perform the system maintenance before the scheduled retirement.

Reboot the instance outside business hours to a new host before the scheduled retirement.

Write an AWS Lambda function to restore the system when the Scheduled retirement occurs

Back up the current KMS key and enable automatic key rotation.

Create a new key in AWS KMS and assign the key to Amazon EBS.

Enable automatic key rotation of the EBS volume key in AWS KMS.

Upload ne key material to the EBS volume key in AWS KMS to enable automatic key rotation for the volume.

Configure the ALB health check to restart instances instead of terminating them.

Configure an AWS Lambda function to take a snapshot of all instance before they are terminated.

Implement Amazon CloudWatch Events to capture lifecycle events and trigger an AWS Lambda function for remediation.

Use an Amazon EC2 Auto Scaling lifecycle hook to pause instance termination after the instance has been removed from service.

Enable flow logs on the NAT gateway elastic network interface and use Amazon CloudWatch insights to filter data based on the source IP addresses

Run an AWS Cost and Usage report and group the findings by instance ID.

Use the VPC traffic mirroring feature to send traffic to Amazon QuickSight.

Use Amazon CloudWatch metrics generated by the NAT gateway for each individual instance.

Select the AWS Namespace, filter by metric name, then add to the dashboard.

Add a text widget, select the appropriate metric from the custom namespace, then add to the dashboard.

Select the appropriate widget and metrics from the custom namespace, then add to the dashboard.

Open the CloudWatch console, from the CloudWatch Events, add all custom metrics.

Add a new inbound rule:

database-ag TCP 5432

Add a new outbound rule:

database-sg TCP 5432

Add a new outbound rule:

0.0.0.0/0 Ail Traffic 0-€5535

Change the outbound rule to:

cache-sg TCP 54 32

CloudFront does not have the ALB configured as the origin access identity.

The DNS is still pointing to the ALB instead of the CloudFront distribution.

The ALB security group is not permitting inbound traffic from CloudFront.

The default, minimum, and maximum Time to Live (TTL) are set to 0 seconds on the CloudFront distribution.

The target groups associated with the ALB are configured for sticky sessions.

Add s3:Deleteobject permission to the IAM execution role of the AWS Lambda function in Account A.

Change the bucket policy of the S3 bucket in Account B to allow s3:Deleteobject permission for Account A.

Disable server-side encryption for objects written to the S3 bucket by the Lambda function.

Call the S3:PutObjectAcl API operation from the Lambda function in Account A to specify bucket owner, full control.

Enable encryption on each host’s connection to the Amazon EFS volume. Each connection must be recreated for encryption to take effect.

Enable encryption on the existing EFS volume by using the AWS command line interface.

Enable encryption on each host’s local drive. Restart each host to encrypt the drive.

Enable encryption on a newly created volume and copy all data from the original volume. Reconnect each hosts to the new volume.

Create a custom report using AWS Systems Manager Inventory to identify unapproved AMIs

Run Amazon Inspector on all EC2 instances and flag instances using unapproved AMIs

Use an AWS Config rule to identify unapproved AMIs

Use AWS Trusted Advisor to identify EC2 workloads using unapproved AMIs

Configure ElastiCache automatic scaling for the Memcached cluster. Set the CPU Utilization metric as a scaling trigger above 75% and FreeableMemory below 10 MB.

Configure ElastiCache read replicas for each Memcached node in different Availability Zones to distribute the workload.

Deploy an Application Load Balancer to distribute the workload to Memcached cluster nodes.

Replace the Memcached cluster and select a node type that has a higher CPU and memory.

Enable detailed monitoring on the instance within Amazon CloudWatch

Publish the memory metrics to Amazon CloudWatch Events

Publish the memory metrics using the Amazon CloudWatch agent

Publish the memory metrics using Amazon CloudWatch Logs

Set metrics_collection_interval to 60 seconds

Use Amazon CloudFront to log the URL and forward the request

Use Amazon CloudFront to rewrite the header based on the microservice and forward the request

Use a Network Load Balancer (NLB) and do path-based routing

Use an Application Load Balancer (ALB) and do path-based routing

Add Systems Manager permissions to the instance profile

Configure the bucket used by Session Manager logs to allow write access

install Systems Manager Agent on the instance

Modify the instance security group to allow inbound traffic on SSH port 22

Reboot the instance with a new SSH key pair named ssm-user

Write a script to download the encrypted snapshot decrypt it using the AWS KMS encryption key used to encrypt the snapshot then create a new volume in each account

date the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts then share the snapshot with those accounts

Create an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other accounts Require each account owner to create a new volume from that snapshot and encrypt it

Create a new unencrypted RDS instance from the encrypted snapshot connect to the instance using SSH/RDP, export the database contents into a file then share this file with the other accounts

Create a new CMK every 7 days to manually rotate the encryption keys.

Enable key rotation on the CMKs and set the rotation period 7 days.

Switch to using AWS CloudHSM as AWS KMS does not support key rotation.

Use data keys for each encryption task to avoid the need to rotate keys.

Enable AWS Trusted Advisor and show the Security team that the Security Groups unrestricted access check will alarm.

Schedule an AWS Lambda function to run hourly to scan and evaluate all security groups, and send a report to the Security team.

Use AWS Config to enable the restricted-common-ports rule, and add port 80 to the parameters.

Use Amazon Inspector to evaluate the security groups during scans, and send the completed reports to the Security team.

Copy the AMI to each region using aws ec2 copy-image Update the CloudFormation mapping include mappings for the copy AMIs.

Creating a snapshot of the running instance and copy the snapshot to the other regions. Create an AMI from the snapshots. Update the CloudFormation template for each region to use the new AMI.

Run the existing CloudFormation template in each additional region based on the success of the template used currently in us-east-1.

Update the CloudFormation template to include the additional regions in the auto scaling group. Update the existing stack in us-east-1.

Modify the EC2 security group rules to allow inbound traffic from the on-premises computer

Modify the EC2 security group rules to allow outbound traffic to the on-premises computer

Modify the VPC network ACL rules to allow inbound traffic from the on-premises computer

Modify the VPC network ACL rules to allow outbound traffic to the on-premises computer

AWS Service Health Dashboard

AWS Trusted Advisor

AWS Personal Health Dashboard

AWS Systems Manager

Implement an IAM policy that uses the aws:sourceConnection condition to allow access from the AWS Direct Connect connection ID only

Set up a public virtual interface on the AWS Direct Connect connection

Configure AWS Shield to protect the AWS Management Console from being accessed by IP addresses other than those within the data center ranges

Update all the VPC network ACLs to allow access from the data center IP ranges

Amazon CloudWatch

Amazon S3 server access logs

AWS CloudTrail

AWS Cost Explorer

Create an Amazon CloudWatch dashboard to monitor the memory usage metrics on the Instance over time.

Create an alarm on the dashboard that publishes an Amazon SNS notification to alert the CIO when a threshold is passed.

Create an alarm on the metric that publishes an Amazon SNS notification to alert the CIO when a threshold is passed.

Create an alarm on the AWS Personal Health Dashboard that publishes an Amazon SNS notification to alert the CIO when the system is out of memory.

Configure the Amazon CloudWatch agent to collect and push memory usage metrics on the instance.

Create a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL

Create an ALIAS record in Amazon Route 53 that points to the CloudFront distribution URL

Creole an A record in Amazon Route 53 that points to the public IP address of the web application

Create a PTR record in Amazon Route 53 that points to the public IP address of the web application

AWS will apply the patch during the next maintenance window and will provide the Administrator with a report of all patched EC2 instances

AWS will relaunch the EC2 instances with the latest version of the Amazon Machine Image (AMI) and will provide the Administrator with a report of all patched EC2 instances

AWS will research the vulnerability to see if the Administrator's operating system is impacted and will patch the EC2 instances that are affected

AWS will review the shared responsibility model with the Administrator and advise them regarding how to patch the EC2 instances

Run the application on On-Demand EC2 instances. Run the jobs on Spot Instances with a specified duration.

Run the application on Reserved Instance EC2 instances. Run the jobs on AWS Lambda.

Run the application on On-Demand EC2 instances. Run the jobs on On-Demand EC2 instances.

Run the application on Reserved instance EC2 instances. Run the jobs on Spot Instances with a specified duration.

Stop Storage Gateway and reboot the virtual machine, then restart Storage Gateway.

Reboot the virtual machine, then restart Storage Gateway.

Reboot the virtual machine.

Shut down the virtual machine and stop Storage Gateway, then turn on the virtual machine.

CPU Utilization

Disk Read Operations

Memory Utilization

Network Packets In

Network Packets Dropped

CPU Ready Time

The IAM user did not have privileges to launch the CloudFormation template.

The t2 medium EC2 instance service limit was reached.

An AWS Budgets threshold was breached.

The application’s Amazon Machine Image (AMI) is not available in us-east-2.

Elastic Load Balancer

EC2 instances

RDS instance

ElastiCache cluster

Auto Scaling group

Delete the failed stack and create a new stack.

Execute a change set on the failed stack.

Perform an update-stack action on the failed stack.

Run a validate-template command.

Create a service control policy in AWS Organizations and apply it to the development account.

Create a customer managed policy in IAM and apply it to all users within the development account.

Create a job function policy in IAM and apply it to all users within the development account.

Create an IAM policy and apply it in API Gateway to restrict the development account.

Add each existing account to the central organization using AWS IAM.

Create a new organization in each account and join them to the central organization.

Log in to each existing account an add them to the central organization.

Send each existing account an invitation from the central organization.

D18912E1457D5D1DDCBD40AB3BF70D5D

Create a customer gateway to connect to Amazon S3 Modify the route table of the private subnets to use the customer gateway

Create a gateway VPC endpoint for Amazon S3 Modify the route table of the private subnets to use the gateway VPC endpoint.

Create a NAT gateway in the private subnets. Modify the route table of the subnets to use the NAT gateway.

Create an S3 bucket policy to allow connections from the private subnets. Modify the route table.

Create an IAM EC2 role for the EC2 instances and grant the role permission to read the Systems Manager parameters

Create an IAM group for the application and grant the group permissions to read the Systems Manager parameters

Create an IAM policy for the application and grant the policy permission to read the Systems Manager parameters

Create an IAM user for the application and grant the user permission to read the Systems Manager parameters

Use AWS Budgets to report on low utilization of EC2 instances.

Run an AWS Systems Manager script to check for low memory utilization of EC2 instances.

Run Cost Explorer to look for low utilization of EC2 instances.

Use Amazon CloudWatch metrics to identify EC2 instances with low utilization.

Create an AWS CloudFormation template to use the AWS Service Catalog portfolio in the new AWS account.

Manually create an AWS Service Catalog portfolio in the new AWS account that duplicates the original portfolio.

Run an AWS Lambda function to create a new AWS Service Catalog portfolio based on the output of the DescribePortfolio API operation.

Share the AWS Service Catalog portfolio with the other AWS accounts and import the portfolio into the other AWS accounts.

Edit the template to remove the RDS resources and update the stack.

Enable termination protection on the stack.

Set the deletionPolicy attributes for RDS resources to retain in the template.

Set the deletion-protection parameter on RDS resources.

Map the group attribute to an AWS group. The AWS group is assigned IAM policies that govern access to AWS resources.

Map the policy attribute to IAM policies the federated user is assigned to. These policies govern access to AWS resources.

Map the role attribute to an AWS role. The AWS role is assigned IAM policies that govern access to AWS resources.

Map the user attribute to an AWS user. The AWS user is assigned specific IAM policies that govern access to AWS resources.

Security groups

NAT gateways

Virtual private gateway

Gateway VPC endpoints

Continue the update rollback while skipping the resources that have been manually deleted.

Run the signal-resource command with the 08 instance name to proceed with the stack rollback.

Recreate the DB Instance using the same resource name, and update the stack.

Remove Amazon RDS from the template, and update the stack.

Contact the domain register and ask them to provide the verification required by AWS.

Place a new request with the proper domain name instead of the ALB FQDN.

Select the certificate request in the ACM console and resend the validation email.

Contact AWS support and verify the request by answering security challenge questions.

The ALB Is associated with private subnets within the VPC.

The ALB received a request from a client, but the client closed the connection.

The ALB security group is not configured to allow inbound traffic from the users.

The ALB target group does not contain healthy EC2 instances.

Purchase Reserved Instances for the specific m2 instances

Change the m2 instances to equivalent m5 types, and purchase Reserved Instances for the specific m5 instances

Change the Classic Load Balancer to an Application Load Balancer, and purchase Reserved Instances for the specific m2 instances.

Purchase Spot Instances for the specific m2 instances

The NAT gateway no longer exists

There is no route to the internet gateway.

The routes are no longer propagating.

There is no route rule with a destination for the internet.

In the payer account: Enable billing alerts in the Billing and Cost Management console; publish an Amazon SNS message when the billing alert triggers.

In each account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in Amazon CloudWatch; publish an SNS message when the alarm triggers.

In the payer account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in the Billing and Cost Management console to publish an SNS message when the alarm triggers.

In the payer account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in Amazon CloudWatch; publish an SNS message when the alarm triggers.

The AWS Security team

The Amazon EC2 team

The AWS Premium Support team

The company’s System Administrator

Configure AWS Database Migration Service (AWS DMS) to allow Amazon RDS for MySQL to scale and accept more requests.

Configure RDS for MySQL to scale horizontally by additional nodes to offload write requests.

Enable the Multi-AZ feature for the RDS instance.

Modify the RDS MySQL instance so it is a larger instance type.

Move all of the EC2 instances behind a NAT gateway and provide the gateway IP address to the service.

Move all of the EC2 instances behind an internet gateway and provide the gateway IP address to the service.

Move all of the EC2 instances into a single Availability Zone and provide the Availability Zone IP address to the service.

Move all of the EC2 instances to a peered VPC and provide the VPC IP address to the service.

Restore the EBS volume from the snapshot with fast snapshot restore enabled

Restore the EBS volume from the snapshot using the cold HDD volume type.

Restore the EBS volume from the snapshot and pre-warm the volume by reading all of the blocks.

Restore the EBS volume from the snapshot and configure encryption.

Restore the EBS volume from the snapshot and configure I/O block sizes at random

Create an Amazon EC2 proxy in Account A that forwards requests to Account B.

Create a load balancer in Account A that points to the load balancer in Account B.

Create a CNAME record in Account A pointing to an alias record to the load balancer in Account B.

Create an alias record in Account A pointing to the load balancer in Account B.

Configure Amazon CloudWatch Events to filter and forward AWS Health events for disk space utilization to an Amazon SNS topic to notify the Administrator.

Create an AWS Lambda function to describe the volume status for each EC2 instance. Post a notification to an Amazon SNS topic when a volume status is impaired.

Enable detailed monitoring for the EC2 instances. Create an Amazon CloudWatch alarm to notify the

Administrator when disk space is running low.

Use the Amazon CloudWatch agent on the EC2 instances to collect disk metrics. Create a CloudWatch alarm to notify the Administrator when disk space is running low.

sts:AssumeRote

sts:AssumeRoleWithSAML

stsAssumeRoleWithWebldentity

sts:GetFederationToken

Auto Scaling logs

AWS CloudTrail logs

EC2 instance logs

Elastic Load Balancer access logs

Create an EC2 instance launch configuration. Allow the business units to launch EC2 instances by specifying this launch configuration in the AWS Management Console

Develop an 1AM policy that limits the business units to provision EC2 instances only Instruct the business units to launch instances by using an AWS CtoudFormation template.

Publish a product and launch constraint role for EC2 instances by using AWS Service Catalog Allow the business units to perform actions in AWS Service Catalog only

Share an AWS CloudFormation template with the business units Instruct the business units to pass a role to AWS CloudFormation to allow the service to manage EC2 instances.

Fix the error that caused the attack to fail, then select the continue update Rollback action in the console.

Select the update stack action with a working template in the console.

Update the password of the IAM user, then select the continue update rollback action in the console.

Use the AWS CLI to manually change the stack status to update_complete, then continue updating the stack with a working template.

Move the static content from Amazon EFS and serve that the content through the EC2 instances.

Move the databases from Amazon RDS to Amazon ElastiCache for Memcached.

Use Amazon Cloudfront to cache the static content.

Use Amazon Route S3 with geolocation routing.

Add a larger Amazon EBS volume to the ElastiCache cluster nodes

Add a load balancer to route traffic to the ElastiCache cluster

Add additional worker nodes to the ElastiCache cluster

Create an Auto Scaling group to the ElastiCache cluster

Vertically scale the ElastiCache cluster by changing the node type

Create a VPC endpoint for the S3 bucket, and create an IAM policy that conditionally limits al S3 actions on the bucket to the VPC endpoint as the source

Create a VPC endpoint for the S3 bucket and create a S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source

Create a service-linked role for Amazon EC2 that allows the EC2 instances to interact directly with Amazon S3, and attach an IAM policy to the role that allows the EC2 instances full access to the S3 bucket

Create a NAT gateway in the VPC, and modify the VPC route table to route all traffic destined for Amazon S3 through the NAT gateway

Implement AWS Organizations and create a service control policy that defines the billing relationship with the new master account.

Configure AWS Organizations Consolidated Billing and provide the finance team with IAM access to the billing console.

Send Cost and Usage Reports files to a central Amazon S3 bucket and load the data into Amazon Redshift. Use Amazon QuickSight to provide visualizations to the finance team.

Link the Reserved Instances to the master payer account and use Amazon Redshift Spectrum to query Detailed Billing Report data across all accounts.

Add a bucket policy that grants everyone read access to the bucket

Add a bucket policy that grants everyone read access to the bucket objects

Remove the default bucket policy that denies read access to the bucket.

Configure cross origin resource sharing (CORS) on the bucket

Use a VPN to set up a tunnel between the on-premises data center and the AWS resources

Use AWS Certificate Manager to create TLS/SSL certificates

Use AWS CloudHSM to encrypt the data

Use AWS KMS to create TLS/SSL certificates

Use AWS KMS to manage the encryption keys used for data encryption