How Many Questions Of SOA-C01 Actual Exam

NEW QUESTION 1
A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other?

• A. Destination : 20.0.0.0/24 and Target : VPC
• B. Destination : 20.0.0.0/16 and Target : ALL
• C. Destination : 20.0.0.0/0 and Target : ALL
• D. Destination : 20.0.0.0/24 and Target : Local

Answer: D

NEW QUESTION 2
A company must ensure that any objects upload to an bucket are encrypted. Which of the following actions will meet this requirement? (Select TWO.)

• A. Implement AWS Shield to protect against unencrypted objects stored in S3 buckets
• B. Implement Object access control list (ACL) to deny unencrypted objects from being uploaded to the S3 bucket.
• C. Implement Amazon S3 default encryption to make sure that any object being uploaded is encrypted before it is stored.
• D. Implement Amazon Inspector to inspect objects uploaded to the S3 I make sure that they are encrypted.
• E. Implement S3 bucket policies to deny unencrypted objects from being upload to the buckets.

Answer: BC

Explanation:
By default, all S3 buckets are private, and can only be accessed by users that have been explicitly granted access. Most use cases won't require broad-ranging public access to read files from your S3 buckets, unless you're using S3 to host public assets (for example, to host images for use on a public website), and it's best practice to never open access to the public. You can control access to your S3 resources by using a combination of bucket ACLs and IAM and bucket policies.
AWS also provides services that help you monitor and audit your security configurations, such as server access logging, Amazon CloudWatch Logs, AWS CloudTrail, and AWS Trusted Advisor.

NEW QUESTION 3
When an EC2 instance that is backed by an S3-based AMI Is terminated, what happens to the data on me root volume?

• A. Data is automatically saved as an EBS volume.
• B. Data is automatically saved as an ESS snapshot.
• C. Data is automatically deleted.
• D. Data is unavailable until the instance is restarted.

Answer: C

Explanation:
Reference:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ComponentsAMIs.html

NEW QUESTION 4
Your organization's security policy requires that all privileged users either use frequently rotated passwords or one-time access credentials in addition to username/password.
Which two of the following options would allow an organization to enforce this policy for AWS users? Choose 2 answers

• A. Configure multi-factor authentication for privileged 1AM users
• B. Create 1AM users for privileged accounts
• C. Implement identity federation between your organization's Identity provider leveraging the 1AM Security Token Service
• D. Enable the 1AM single-use password policy option for privileged users

Answer: AB

Explanation:
See also: http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
Enable MFA for privileged users
For extra security, enable multifactor authentication (MFA) for privileged IAM users (users who are allowed access to sensitive resources or APIs). With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their user name and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device (for example, it can run in an app on a smartphone).

NEW QUESTION 5
A new network is needed to run secure Amazon EC2 instance. This network cannot have direct access to the internet and must be separate from existing production instances. The instances will be manager using SSH from a Developer in a home office with a fixed IP address but without a VPN- capable router.
How should a SysOps Administrator create this network and manage these servers?

• A. Create a new subnet in an existing VP
• B. Configure access rules to allow SSH access from the Developer's IP addres
• C. Use AWS Shield to select the instances that should not have access to the internet.
• D. Associated an internet gateway with a new VPC with two subne
• E. Set up a bastion instance with an Elastic IP address Configure security groups and routing to allow SSH access to the bastion instance from the Developer's Ip address and SSH access from the bastion hot to the private subnet.
• F. Configure a new VPC with one public subnet no internet gatewa
• G. Configure the security for the instance to allow SSH from the Developer's IP address.
• H. Setup a new VPC with one private subne
• I. When deployment the instance use the User data to install and configure a third-party management tool for the instances Connect to the instance using the third-party tool.

Answer: C

NEW QUESTION 6
An application you maintain consists of multiple EC2 instances in a default tenancy VPC. This application has undergone an internal audit and has been determined to require dedicated hardware for one instance. Your compliance team has given you a week to move this instance to single-tenant hardware.
Which process will have minimal impact on your application while complying with this requirement?

• A. Create a new VPC with tenancy=dedicated and migrate to the new VPC
• B. Use ec2-reboot-instances command line and set the parameter "dedicated=true"
• C. Right click on the instance, select properties and check the box for dedicated tenancy
• D. Stop the instance, create an AMI, launch a new instance with tenancy=dedicated, and terminate the old instance

Answer: D

Explanation:
Reference:
See: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/dedicated- instance.html#dedicated-apichanges
You cannot change the tenancy of a default instance after you??ve launched it. You can change the tenancy of an instance from ??dedicated?? to ??host?? after you??ve launched it, and vice versa.

NEW QUESTION 7
A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created public and VPN only subnets along with hardware VPN access to connect to the user??s data centre. The user has not yet launched any instance as well as modified or deleted any setup. He wants to delete this VPC from the console. Will the console allow the user to delete the VPC?

• A. Yes, the console will delete all the setups and also delete the virtual private gateway
• B. No, the console will ask the user to manually detach the virtual private gateway first and then allow deleting the VPC
• C. Yes, the console will delete all the setups and detach the virtual private gateway
• D. No, since the NAT instance is running

Answer: C

Explanation:
The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data centre, he can setup a public and VPN only subnet which uses hardware VPN access to connect with his data centre. When the user has configured this setup with Wizard, it will create a virtual private gateway to route all traffic of the VPN subnet. If the virtual private gateway is attached with VPC and the user deletes the VPC from the console it will first detach the gateway automatically and only then delete the VPC.

NEW QUESTION 8
Your team is excited about the use of AWS because now they have access to ??programmable Infrastructure" You have been asked to manage your AWS infrastructure In a manner similar to the way you might manage application code You want to be able to deploy exact copies of different versions of your infrastructure, stage changes into different environments, revert back to previous versions, and identify what versions are running at any particular time (development, test, QA, production).
Which approach addresses this requirement?

• A. Use cost allocation reports and AWS OpsWorks to deploy and manage your infrastructure.
• B. Use AWS CloudWatch metrics and alerts along with resource tagging to deploy and manage your infrastructure.
• C. Use AWS Beanstalk and a version control system like GIT to deploy and manage your infrastructure.
• D. Use AWS CloudFormation and a version control system like GIT to deploy and manage your infrastructure.

Answer: D

Explanation:
Reference:
?V Answer A: does not provide versioning
?V Answer B: does not provide versioning
?V Answer C: Beanstalk provide version control over your application (not infrastructure)
Extract from what is AWS CloudFormation: (http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html)
Easily Control and Track Changes to Your Infrastructure In some cases, you might have underlying resources that you want to upgrade incrementally. For example, you might change to a higher performing instance type in your Auto Scaling launch configuration so that you can reduce the maximum number of instances in your Auto Scaling group. If problems occur after you complete the update, you might need to roll back your infrastructure to the original settings. To do this manually, you not only have to remember which resources were changed, you also have to know what the original settings were.
When you provision your infrastructure with AWS CloudFormation, the AWS CloudFormation template describes exactly what resources are provisioned and their settings. Because these templates are text files, you simply track differences in your templates to track changes to your infrastructure, similar to the way developers control revisions to source code. For example, you can use a version control system with your templates so that you know exactly what changes were made, who made them, and when. If at any point you need to reverse changes to your infrastructure, you can use a previous version of your template.

NEW QUESTION 9
You have been asked to propose a multi-region deployment of a web-facing application where a controlled portion of your traffic is being processed by an alternate region.
Which configuration would achieve that goal?

• A. Route53 record sets with weighted routing policy
• B. Route53 record sets with latency based routing policy
• C. Auto Scaling with scheduled scaling actions set
• D. Elastic Load Balancing with health checks enabled

Answer: A

Explanation:
The question is asking ??a controlled portion of your traffic??, that would be established with weighted routing policy.
See: http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html

NEW QUESTION 10
A user has created a VPC with CIDR 20.0.0.0/16. The user has created public and VPN only subnets along with hardware VPN access to connect to the user??s datacenter. The user wants to make so that all traffic coming to the public subnet follows the organization??s proxy policy. How can the user make this happen?

• A. Setting up a NAT with the proxy protocol and configure that the public subnet receives traffic from NAT
• B. Setting up a proxy policy in the internet gateway connected with the public subnet
• C. It is not possible to setup the proxy policy for a public subnet
• D. Setting the route table and security group of the public subnet which receives traffic from a virtual private gateway

Answer: D

Explanation:
The user can create subnets within a VPC. If the user wants to connect to VPC from his own data centre, he can setup public and VPN only subnets which uses hardware VPN access to connect with his data centre. When the user has configured this setup, it will update the main route table used with the VPN-only subnet, create a custom route table and associate it with the public subnet. It also creates an internet gateway for the public subnet. By default, the internet traffic of the VPN subnet is routed to a virtual private gateway while the internet traffic of the public subnet is routed through the internet gateway. The user can set up the route and security group rules. These rules enable the traffic to come from the organization??s network over the virtual private gateway to the public subnet to allow proxy settings on that public subnet.

NEW QUESTION 11
An application is generating a log file every 5 minutes. The log file is not critical but may be required only for verification in case of some major issue. The file should be accessible over the internet whenever required. Which of the below mentioned options is a best possible storage solution for it?

• A. AWS S3
• B. AWS Glacier
• C. AWS RDS
• D. AWS RRS

Answer: D

Explanation:
Amazon S3 stores objects according to their storage class. There are three major storage classes: Standard, Reduced Redundancy Storage and Glacier. Standard is for AWS S3 and provides very high durability. However, the costs are a little higher. Glacier is for archival and the files are not available over the internet. Reduced Redundancy Storage is for less critical files. Reduced Redundancy is little cheaper as it provides less durability in comparison to S3. In this case since the log files are not mission critical files, RRS will be a better option.

NEW QUESTION 12
When you put objects in Amazon S3, what is the indication that an object was successfully stored?

• A. Each S3 account has a special bucket named_s3_log
• B. Success codes are written to this bucket with a timestamp and checksum.
• C. A success code is inserted into the S3 object metadata.
• D. A HTTP 200 result code and MD5 checksum, taken together, indicate that the operation was successful.
• E. Amazon S3 is engineered for 99.999999999% durabilit
• F. Therefore, there is no need to confirm that data was inserted.

Answer: C

Explanation:
To ensure that data is not corrupted traversing the network, use the Content-MD5 form field. When you use this form field, Amazon S3 checks the object against the provided MD5 value. If they do not match, Amazon S3 returns an error.
success_action_status
The status code returned to the client upon successful upload if success_action_redirectis not specified.
Accepts the values 200, 201, or 204 (default).
If the value is set to 200 or 204, Amazon S3 returns an empty document with a 200 or 204 status code.
If the value is set to 201, Amazon S3 returns an XML document with a 201 status code.
If the value is not set or if it is set to an invalid value, Amazon S3 returns an empty document with a 204 status code.
Type: String Default: None Note
Some versions of the Adobe Flash player do not properly handle HTTP responses with an empty body. To support uploads through Adobe Flash, we recommend setting success_action_statusto 201.
Source: http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html

NEW QUESTION 13
When an EC2 instance mat is backed by an S3-Dased AMI is terminated, what happens to the data on the root volume?

• A. Data is automatically deleted
• B. Data is automatically saved as an EBS snapshot.
• C. Data is unavailable until the instance is restarted
• D. Data is automatically saved as an EBS volume.

Answer: A

NEW QUESTION 14
A company is migrating an application to AWS that requires access to a legacy system, which remain in the company's data centre. The application runs inside a VPC in the company's AWS account. The application must offer a consistent and low-latency response to its users
How can these requirements be met?

• A. Create a software-based VPN connection between the Amazon VPC and the on-premises network
• B. Create an AWS Direct Connect connection between AWS and the on-premises network and then use a private virtual interface
• C. Create a hardware-based IPsec VPN connection between the VPC in AWS and the on-premises network
• D. Create an overlay network by using third-party software and use that to connect the X/PC back to the on-premises network

Answer: B

Explanation:
Private Connectivity to your Amazon VPC. You can use AWS Direct Connect to establish a private virtual interface from your on-premise network directly to your Amazon VPC, providing you with a private, high bandwidth network connection between your network and your VPC.

NEW QUESTION 15
A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. What does this policy define?
"Statement": [{
"Sid": "Stmt1388811069831",
"Effect": "Allow", "Principal": { "AWS": "*"},
"Action": [ "s3:GetObjectAcl", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::cloudacademy]
}]

• A. It will make the cloudacademy bucket as well as all its objects as public
• B. It will allow everyone to view the ACL of the bucket
• C. It will give an error as no object is defined as part of the policy while the action defines the rule aboutthe object
• D. It will make the cloudacademy bucket as public

Answer: D

Explanation:
A sysadmin can grant permission to the S3 objects or the buckets to any user or make objects public using the bucket policy and user policy. Both use the JSON-based access policy language. Generally if the user is defining the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be defined at the bucket level which allows the objects as well as the bucket to be public with a single policy applied to that bucket. In the sample policy the action says ??S3:ListBucket?? for effect Allow on Resource arn:aws:s3:::cloudacademy. This will make the cloudacademy bucket public.
"Statement": [{
"Sid": "Stmt1388811069831",
"Effect": "Allow", "Principal": { "AWS": "*" },
"Action": [ "s3:GetObjectAcl", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::cloudacademy]
}]

NEW QUESTION 16
A user has hosted an application on EC2 instances. The EC2 instances are configured with ELB and Auto Scaling. The application server session time out is 2 hours. The user wants to configure connection draining to ensure that all in-flight requests are supported by ELB even though the instance is being deregistered. What time out period should the user specify for connection draining?

• A. 5 minutes
• B. 1 hour
• C. 30 minutes
• D. 2 hours

Answer: B

NEW QUESTION 17
You receive a frantic call from a new DBA who accidentally dropped a table containing all your customers.
Which Amazon RDS feature will allow you to reliably restore your database to within 5 minutes of when the mistake was made?

• A. Multi-AZ RDS
• B. RDS snapshots
• C. RDS read replicas
• D. RDS automated backup

Answer: D

Explanation:
Reference:
http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.BackingUpAndRestoringAma zonRDSInstances.html

NEW QUESTION 18
A company has two AWS account developers and production. All application send logs to a specific Amazon bucket for each account, and the Developers are requesting access to the production
account S3 buckets to view the logs?
Which is the MOST efficient way to provide the Developers with access?

• A. Create an AWS Lambda function with an IAM role attached to it that has access to be accounts'S3 buckets Put me logs tram the production S3 bucket to the development S3 bucket
• B. Create IAM users for each Developer on the production account and add the Developers to an IAM group that provides read-only access to the S3 log bucket
• C. Create an Amazon EC2 bastion host with an 1AM role attached to it that has access to it that has production S3 log bucket and then provision access for the Developers on the host
• D. Create a resource-based pokey for the S3 bucket on the production account that grant access to the development account and then delegate the development account

Answer: B

Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

NEW QUESTION 19
A user has moved an object to Glacier using the life cycle rules. The user requests to restore the archive after 6 months. When the restore request is completed the user accesses that archive. Which of the below mentioned statements is not true in this condition?

• A. The archive will be available as an object for the duration specified by the user during the restoration request
• B. The restored object??s storage class will be RRS
• C. The user can modify the restoration period only by issuing a new restore request with the updated period
• D. The user needs to pay storage for both RRS (restore
• E. and Glacier (Archiv
• F. Rates

Answer: B

Explanation:
AWS Glacier is an archival service offered by AWS. AWS S3 provides lifecycle rules to archive and restore objects from S3 to Glacier. Once the object is archived their storage class will change to Glacier. If the user sends a request for restore, the storage class will still be Glacier for the restored object. The user will be paying for both the archived copy as well as for the restored object. The object is available only for the duration specified in the restore request and if the user wants to modify that period, he has to raise another restore request with the updated duration.

NEW QUESTION 20
A syslog Administrator is created additional Amazon EC2 instances and receive an Instancelimitexceeded error.
What is the cause of the issue and how can it be resolve?

• A. The Administrator has requested too many instances at once and must request fewer instances in batches
• B. The concurrent running instance limit has been reached and an EC2 limit increase request must be filed with AWS Support
• C. AWS does not currently nave enough available capacity and a different instance type must be used
• D. The Administrator must specify the maximum number of instances to be ?V created provisioning EC stances

Answer: B

Explanation:
EC2 Service Limits: AWS sets limits for these resources on a per-region basis.
If you are getting an InstanceLimitExceeded error when you try to launch an instance, you have reached your concurrent running instance limit. For new AWS accounts, the default limit is 20. If you need additional running instances, complete the form at Request to Increase Amazon EC2 Instance Limit.
By default, all AWS accounts have a limit of 20 running instances at any time per region. If you attempt to start another one, even if it already existed in the stopped state, you will receive this error message.
To resolve this issue, you can do any of the following: Stop one of your other running instances
Contact AWS support and request your running EC2 instances quota limit be raised.

NEW QUESTION 21
A user has configured Auto Scaling with the minimum capacity as 2 and the desired capacity as 2. The user is trying to terminate one of the existing instance with the command:
as-terminate-instance-in-auto-scaling-group<Instance ID> --decrement-desired-capacity
What will Auto Scaling do in this scenario?

• A. Terminates the instance and does not launch a new instance
• B. Terminates the instance and updates the desired capacity to 1
• C. Terminates the instance and updates the desired capacity and minimum size to 1
• D. Throws an error

Answer: D

Explanation:
The Auto Scaling command as-terminate-instance-in-auto-scaling-group <Instance ID> will terminate the specific instance ID. The user is required to specify the parameter as --decrement-desired- capacity. Then Auto Scaling will terminate the instance and decrease the desired capacity by 1. In this case since the minimum size is 2, Auto Scaling will not allow the desired capacity to go below 2. Thus, it will throw an error.

NEW QUESTION 22
A user has configured CloudWatch monitoring on an EBS backed EC2 instance. If the user has not attached any additional device, which of the below mentioned metrics will always show a 0 value?

• A. DiskReadBytes
• B. NetworkIn
• C. NetworkOut
• D. CPUUtilization

Answer: A

Explanation:
CloudWatch is used to monitor AWS as the well custom services. For EC2 when the user is monitoring the EC2 instances, it will capture the 7 Instance level and 3 system check parameters for the EC2 instance. Since this is an EBS backed instance, it will not have ephermal storage attached to it. Out of the 7 EC2 metrics, the 4 metrics DiskReadOps, DiskWriteOps, DiskReadBytes and DiskWriteBytes are disk related data and available only when there is ephermal storage attached to an instance. For an EBS backed instance without any additional device, this data will be 0.

NEW QUESTION 23
A user has launched an ELB which has 5 instances registered with it. The user deletes the ELB by mistake. What will happen to the instances?

• A. ELB will ask the user whether to delete the instances or not
• B. Instances will be terminated
• C. ELB cannot be deleted if it has running instances registered with it
• D. Instances will keep running

Answer: D

Explanation:
When the user deletes the Elastic Load Balancer, all the registered instances will be deregistered. However, they will continue to run. The user will incur charges if he does not take any action on those instances.

NEW QUESTION 24
......