The Secret Of Amazon-Web-Services SOA-C01 Free Practice Questions

NEW QUESTION 1
A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at rest. If the user is supplying his own keys for encryption (SSE-C., what is recommended to the user for the purpose of security?

• A. The user should not use his own security key as it is not secure
• B. Configure S3 to rotate the user??s encryption key at regular intervals
• C. Configure S3 to store the user??s keys securely with SSL
• D. Keep rotating the encryption key manually at the client side

Answer: D

Explanation:
AWS S3 supports client side or server side encryption to encrypt all data at Rest. The server side
encryption can either have the S3 supplied AES-256 encryption key or the user can send the key along with each API call to supply his own encryption key (SSE-C.. Since S3 does not store the encryption keys in SSE-C, it is recommended that the user should manage keys securely and keep rotating them regularly at the client side version.

NEW QUESTION 2
A user is planning to use AWS services for his web application. If the user is trying to set up his own billing management system for AWS, how can he configure it?

• A. Set up programmatic billing acces
• B. Download and parse the bill as per the requirement
• C. It is not possible for the user to create his own billing management service with AWS
• D. Enable the AWS CloudWatch alarm which will provide APIs to download the alarm data
• E. Use AWS billing APIs to download the usage report of each service from the AWS billing console

Answer: A

Explanation:
AWS provides an option to have programmatic access to billing. Programmatic Billing Access leverages the existing Amazon Simple Storage Service (Amazon S3. APIs. Thus, the user can build applications that reference his billing data from a CSV (comma-separated value. file stored in an Amazon S3 bucket. AWS will upload the bill to the bucket every few hours and the user can download the bill CSV from the bucket, parse itand create a billing system as per the requirement.

NEW QUESTION 3
A sys admin is planning to subscribe to the RDS event notifications. For which of the below mentioned source categories the subscription cannot be configured?

• A. DB security group
• B. DB snapshot
• C. DB options group
• D. DB parameter group

Answer: C

Explanation:
Amazon RDS uses the Amazon Simple Notification Service (SNS. to provide a notification when an Amazon RDS event occurs. These events can be configured for source categories, such as DB instance, DB security group, DB snapshot and DB parameter group.

NEW QUESTION 4
A company operate a secure website running an Amazon EC2 instance behind a Classic Load Balancer. An SSL certificate from AWS Certificate Manager is deployment on the load balancer. The company's Marketing team has determined that too many customer using older browser are experiencing issues with the website has asked a SysOps Administrator to fix this issue.
What course of action should the administrator take?

• A. Update the SSL negotiation configuration of the load balancer by creating a custom security polic
• B. Ensure the appropriate cipher has been enabled so that the web application can support the webbrowser.
• C. Create a separate Classic Load Balancer and install custom SSL certificate with a different domain name on it that support the web browse
• D. Ask customer with the affected browser to use this domain name instead of the one they are accustomed to using.
• E. Create a new SSL certificate in Certificate Manager and install this certificate on each of the servers to accommodates the web browsers.
• F. Remove the load balancer from the configuration and instead install a custom SSL certificate on each of the web servers.

Answer: A

Explanation:
Update the SSL Negotiation Configuration of Your Classic Load Balancer
Elastic Load Balancing provides security policies that have predefined SSL negotiation configurations to use to negotiate SSL connections between clients and your load balancer. If you are using the HTTPS/SSL protocol for your listener, you can use one of the predefined security policies, or use your own custom security policy.
For more information about the security policies, see SSL Negotiation Configurations for Classic Load Balancers. For information about the configurations of the security policies provided by Elastic Load Balancing, see Predefined SSL Security Policies.
If you create an HTTPS/SSL listener without associating a security policy, Elastic Load Balancing associates the default predefined security policy, ELBSecurityPolicy-2016-08, with your load balancer. If you have an existing load balancer with an SSL negotiation configuration that does not use the latest protocols and ciphers, we recommend that you update your load balancer to use ELBSecurityPolicy-2016-08. If you prefer, you can create a custom configuration. We strongly recommend that you test the new security policies before you upgrade your load balancer configuration.
The following examples show you how to update the SSL negotiation configuration for an HTTPS/SSL listener. Note that the change does not affect requests that were received by a load balancer node and are pending routing to a healthy instance, but the updated configuration will be used with new requests that are received.

NEW QUESTION 5
A user has setup a CloudWatch alarm on the EC2 instance for CPU utilization. The user has setup to receive a notification on email when the CPU utilization is higher than 60%. The user is running a virus scan on the same instance at a particular time. The user wants to avoid receiving an email at this time. What should the user do?

• A. Remove the alarm
• B. Disable the alarm for a while using CLI
• C. Modify the CPU utilization by removing the email alert
• D. Disable the alarm for a while using the console

Answer: B

Explanation:
Amazon CloudWatch alarm watches a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. When the user has setup an alarm and it is know that for some unavoidable event the status may change to Alarm, the user can disable the alarm using the DisableAlarmActions API or from the command line mon-disable-alarm-actions.

NEW QUESTION 6
Your EC2-Based Multi-tier application includes a monitoring instance that periodically makes application -level read only requests of various application components and if any of those fail more than three times 30 seconds calls CloudWatch lo fire an alarm, and the alarm notifies your operations team by email and SMS of a possible application health problem. However, you also need to ??watch the watcher?? --the monitoring instance itself - and be notified if it becomes unhealthy.
Which of the following is a simple way to achieve that goal?

• A. Run another monitoring instance that pings the monitoring instance and fires a could watch alarm mat notifies your operations team should the primary monitoring instance become unhealthy.
• B. Set a CloudWatch alarm based on EC2 system and instance status checks and have the alarm notify your operations team of any detected problem with the monitoring instance.
• C. Set a CloudWatch alarm based on the CPU utilization of the monitoring instance and nave the alarm notify your operations team if the CPU usage exceeds 50% few more than one minute; then have your monitoring application go into a CPU-bound loop should it Detect any application problems.
• D. Have the monitoring instances post messages to an SQS queue and then dequeue those messages on another instance should the queue cease to have new messages, the second instance should first terminate the original monitoring instance start another backup monitoring instance and assume (he role of the previous monitoring instance and beginning adding messages to the SQS queue.

Answer: B

NEW QUESTION 7
Which method can be used to prevent an IP address block from accessing public objects in an S3 bucket?

• A. Create a bucket policy and apply it to the bucket
• B. Create a NACL and attach it to the VPC of the bucket
• C. Create an ACL and apply it to all objects in the bucket
• D. Modify the IAM policies of any users that would access the bucket

Answer: A

Explanation:
Reference:
http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html

NEW QUESTION 8
A user is observing the EC2 CPU utilization metric on CloudWatch. The user has observed some interesting patterns while filtering over the 1 week period for a particular hour. The user wants to zoom that data point to a more granular period. How can the user do that easily with CloudWatch?

• A. The user can zoom a particular period by selecting that period with the mouse and then releasing the mouse
• B. The user can zoom a particular period by double clicking on that period with the mouse
• C. The user can zoom a particular period by specifying the aggregation data for that period
• D. The user can zoom a particular period by specifying the period in the Time Range

Answer: A

NEW QUESTION 9
A user has configured Elastic Load Balancing by enabling a Secure Socket Layer (SSL. negotiation configuration known as a Security Policy. Which of the below mentioned options is not part of this secure policy while negotiating the SSL connection between the user and the client?

• A. SSL Protocols
• B. Client Order Preference
• C. SSL Ciphers
• D. Server Order Preference

Answer: B

Explanation:
Elastic Load Balancing uses a Secure Socket Layer (SSL. negotiation configuration which is known as a Security Policy. It is used to negotiate the SSL connections between a client and the load balancer. A security policy is a combination of SSL Protocols, SSL Ciphers, and the Server Order Preference option.

NEW QUESTION 10
A user has setup an Auto Scaling group. The group has failed to launch a single instance for more than 24 hours. What will happen to Auto Scaling in this condition?

• A. Auto Scaling will keep trying to launch the instance for 72 hours
• B. Auto Scaling will suspend the scaling process
• C. Auto Scaling will start an instance in a separate region
• D. The Auto Scaling group will be terminated automatically

Answer: B

Explanation:
If Auto Scaling is trying to launch an instance and if the launching of the instance fails continuously, it will
suspend the processes for the Auto Scaling groups since it repeatedly failed to launch an instance. This is known as an administrative suspension. It commonly applies to the Auto Scaling group that has no running instances which is trying to launch instances for more than 24 hours, and has not succeeded in that to do so.

NEW QUESTION 11
A user has two EC2 instances running in two separate regions. The user is running an internal memory management tool, which captures the data and sends it to CloudWatch in US East, using a CLI with the same namespace and metric. Which of the below mentioned options is true with respect to the above statement?

• A. The setup will not work as CloudWatch cannot receive data across regions
• B. CloudWatch will receive and aggregate the data based on the namespace and metric
• C. CloudWatch will give an error since the data will conflict due to two sources
• D. CloudWatch will take the data of the server, which sends the data first

Answer: B

Explanation:
Amazon CloudWatch does not differentiate the source of a metric when receiving custom data. If the user is publishing a metric with the same namespace and dimensions from different sources, CloudWatch will treat them as a single metric. If the data is coming with the same timezone within a minute, CloudWatch will aggregate the data. It treats these as a single metric, allowing the user to get the statistics, such as minimum, maximum, average, and the sum of all across all servers.

NEW QUESTION 12
A sys admin is trying to understand the sticky session algorithm. Please select the correct sequence of steps, both when the cookie is present and when it is not, to help the admin understand the implementation of the sticky session:
ELB inserts the cookie in the response
ELB chooses the instance based on the load balancing algorithm Check the cookie in the service request
The cookie is found in the request
The cookie is not found in the request

• A. 3,1,4,2 [Cookie is not Present] & 3,1,5,2 [Cookie is Present]
• B. 3,4,1,2 [Cookie is not Present] & 3,5,1,2 [Cookie is Present]
• C. 3,5,2,1 [Cookie is not Present] & 3,4,2,1 [Cookie is Present]
• D. 3,2,5,4 [Cookie is not Present] & 3,2,4,5 [Cookie is Present]

Answer: C

Explanation:
Generally AWS ELB routes each request to a zone with the minimum load. The Elastic Load Balancer provides a feature called sticky session which binds the user??s session with a specific EC2 instance. The load balancer uses a special load-balancer-generated cookie to track the application instance for each request. When the load balancer receives a request, it first checks to see if this cookie is present in the request. If so, the request is sent to the application instance specified in the cookie. If there is no cookie, the load balancer chooses an application instance based on the existing load balancing algorithm. A cookie is inserted into the response for binding subsequent requests from the same user to that application instance.

NEW QUESTION 13
An organization is planning to create a user with IAM. They are trying to understand the limitations of IAM so that they can plan accordingly. Which of the below mentioned statements is not true with respect to the limitations of IAM?

• A. One IAM user can be a part of a maximum of 5 groups
• B. The organization can create 100 groups per AWS account
• C. One AWS account can have a maximum of 5000 IAM users
• D. One AWS account can have 250 roles

Answer: A

Explanation:
AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services. The default maximums for each of the IAM entities is given below:
Groups per AWS account: 100 Users per AWS account: 5000 Roles per AWS account: 250
Number of groups per user: 10 (that is, one user can be part of these many groups.

NEW QUESTION 14
A user has setup a web application on EC2. The user is generating a log of the application performance at every second. There are multiple entries for each second. If the user wants to send that data to CloudWatch every minute, what should he do?

• A. The user should send only the data of the 60th second as CloudWatch will map the receive data timezone with the sent data timezone
• B. It is not possible to send the custom metric to CloudWatch every minute
• C. Give CloudWatch the Min, Max, Sum, and SampleCount of a number of every minute
• D. Calculate the average of one minute and send the data to CloudWatch

Answer: C

Explanation:
Amazon CloudWatch aggregates statistics according to the period length that the user has specified
while getting data from CloudWatch. The user can publish as many data points as he wants with the same or similartime stamps. CloudWatch aggregates them by the period length when the user calls get statistics about those data points. CloudWatch records the average (sum of all items divided by the number of items. of the values received for every 1-minute period, as well as the number of samples, maximum value, and minimum value for the same time period. CloudWatch will aggregate all the data which have time stamps within a one-minute period.

NEW QUESTION 15
A user has enabled session stickiness with ELB. The user does not want ELB to manage the cookie; instead he wants the application to manage the cookie. What will happen when the server instance, which is bound to a cookie, crashes?

• A. The response will have a cookie but stickiness will be deleted
• B. The session will not be sticky until a new cookie is inserted
• C. ELB will throw an error due to cookie unavailability
• D. The session will be sticky and ELB will route requests to another server as ELB keeps replicating the Cookie

Answer: B

Explanation:
With Elastic Load Balancer, if the admin has enabled a sticky session with application controlled stickiness, the load balancer uses a special cookie generated by the application to associate the session with the original server which handles the request. ELB follows the lifetime of the application-generated cookie corresponding to the cookie name specified in the ELB policy configuration. The load balancer only inserts a new stickiness cookie if the application response includes a new application cookie. The load balancer stickiness cookie does not update with each request. If the application cookie is explicitly removed or expires, the session stops being sticky until a new application cookie is issued.

NEW QUESTION 16
A user is configuring a CloudWatch alarm on RDS to receive a notification when the CPU utilization of RDS is higher than 50%. The user has setup an alarm when there is some inactivity on RDS, such as RDS unavailability. How can the user configure this?

• A. Setup the notification when the CPU is more than 75% on RDS
• B. Setup the notification when the state is Insufficient Data
• C. Setup the notification when the CPU utilization is less than 10%
• D. It is not possible to setup the alarm on RDS

Answer: B

Explanation:
Amazon CloudWatch alarms watch a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a
number of time periods. The alarm has three states: Alarm, OK and Insufficient data. The Alarm will change to Insufficient Data when any of the three situations arise: when the alarm has just started, when the metric is not available or when enough data is not available for the metric to determine the alarm state. If the user wants to find that RDS is not available, he can setup to receive the notification when the state is in Insufficient data.

NEW QUESTION 17
A customer needs to capture all client connection information from their load balancer every five minutes. The company wants to use this data for analyzing traffic patterns and troubleshooting their applications. Which of the following options meets the customer requirements?

• A. Enable AWS CloudTrail for the load balancer.
• B. Enable access logs on the load balancer.
• C. Install the Amazon CloudWatch Logs agent on the load balancer.
• D. Enable Amazon CloudWatch metrics on the load balancer.

Answer: A

NEW QUESTION 18
A user is using Cloudformation to launch an EC2 instance and then configure an application after the instance is launched. The user wants the stack creation of ELB and AutoScaling to wait until the EC2 instance is launched and configured properly. How can the user configure this?

• A. It is not possible that the stack creation will wait until one service is created and launched
• B. The user can use the HoldCondition resource to wait for the creation of the other dependent resources
• C. The user can use the DependentCondition resource to hold the creation of the other dependent resources
• D. The user can use the WaitCondition resource to hold the creation of the other dependent resources

Answer: D

Explanation:
AWS Cloudformation is an application management tool which provides application modelling, deployment, configuration, management and related activities. AWS CloudFormation provides a WaitCondition resource which acts as a barrier and blocks the creation of other resources until a completion signal is received from an external source, such as a user application or management system.

NEW QUESTION 19
A user has created a queue named ??awsmodule?? with SQS. One of the consumers of queue is down for 3 days and then becomes available. Will that component receive message from queue?

• A. Yes, since SQS by default stores message for 4 days
• B. No, since SQS by default stores message for 1 day only
• C. No, since SQS sends message to consumers who are available that time
• D. Yes, since SQS will not delete message until it is delivered to all consumers

Answer: A

Explanation:
SQS allows the user to move data between distributed components of applications so they can perform different tasks without losing messages or requiring each component to be always available. Queues retain messages for a set period of time. By default, a queue retains messages for four days. However, the user can configure a queue to retain messages for up to 14 days after the message has been sent.

NEW QUESTION 20
A sysadmin has created a shopping cart application and hosted it on EC2. The EC2 instances are running behind ELB. The admin wants to ensure that the end user request will always go to the EC2 instance where the user session has been created. How can the admin configure this?

• A. Enable ELB cross zone load balancing
• B. Enable ELB cookie setup
• C. Enable ELB sticky session
• D. Enable ELB connection draining

Answer: C

Explanation:
Generally, AWS ELB routes each request to a zone with the minimum load. The Elastic Load Balancer provides a feature called sticky session which binds the user??s session with a specific EC2 instance. If the sticky session is enabled the first request from the user will be redirected to any of the EC2 instances. But, henceforth, all requests from the same user will be redirected to the same EC2 instance. This ensures that all requests coming from the user during the session will be sent to the same application instance.

NEW QUESTION 21
How can you secure data at rest on an EBS volume?

• A. Encrypt the volume using the S3 server-side encryption service.
• B. Attach the volume to an instance using EC2's SSL interface.
• C. Create an IAM policy that restricts read and write access to the volume.
• D. Write the data randomly instead of sequentially.
• E. Use an encrypted file system m top of the EBS volume.

Answer: E

Explanation:
Reference:
http://docs.aws.amazon.com/IAM/latest/UserGuide/policies_examples.html

NEW QUESTION 22
A user has received a message from the support team that an issue occurred 1 week back between 3 AM to 4 AM and the EC2 server was not reachable. The user is checking the CloudWatch metrics of that instance. How can the user find the data easily using the CloudWatch console?

• A. The user can find the data by giving the exact values in the time Tab under CloudWatch metrics
• B. The user can find the data by filtering values of the last 1 week for a 1 hour period in the Relative tab under CloudWatch metrics
• C. It is not possible to find the exact time from the consol
• D. The user has to use CLI to provide the specific time
• E. The user can find the data by giving the exact values in the Absolute tab under CloudWatch metrics

Answer: D

Explanation:
If the user is viewing the data inside the CloudWatch console, the console provides options to filter values either using the relative period, such as days /hours or using the Absolute tab where the user can provide data with a specific date and time. The console also provides the option to search using the local timezone under the time range caption in the console.

NEW QUESTION 23
A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306.. The user is configuring a security group for the public subnet (WebSecGrp. and the private subnet (DBSecGrp.. Which of the below mentioned entries is required in the private subnet database security group (DBSecGrp.?

• A. Allow Inbound on port 3306 for Source Web Server Security Group (WebSecGrp.
• B. Allow Inbound on port 3306 from source 20.0.0.0/16
• C. Allow Outbound on port 3306 for Destination Web Server Security Group (WebSecGrp.
• D. Allow Outbound on port 80 for Destination NAT Instance IP

Answer: A

Explanation:
A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet to host the web server and DB server respectively, the user should configure that the instances in the private subnet can receive inbound traffic from the public subnet on the DB port. Thus, configure port 3306 in Inbound with the source as the Web Server Security Group (WebSecGrp.. The user should configure ports 80 and 443 for Destination 0.0.0.0/0 as the route table directs traffic to the NAT instance from the private subnet.

NEW QUESTION 24
......