Question 1

Does Amazon RDS support SSL encryption for SQL Server DB Instances?

Accepted Answer

A)  Yes, for all supported SQL Server editions 
B)  No 
C)  Yes, but only when the instances are in a single region 
D)  No, encryption using SSL is supported only in the GovCloud. 
A)  Yes, for all supported SQL Server editions 
B)  No 
C)  Yes, but only when the instances are in a single region 
D)  No, encryption using SSL is supported only in the GovCloud.

Question 2

A SysOps Administrator needs an Amazon EBS volume type for a big data application. The application data is accessed infrequently and stored sequentially. What EBS volume type will be the MOST cost-effective solution?

Accepted Answer

A)  Provisioned IOPS SSD (io1) 
B)  Cold HDD (sc1) 
C)  Throughout Optimized HDD (st1) 
D)  General Purpose SSD (gp2) 
A)  Provisioned IOPS SSD (io1) 
B)  Cold HDD (sc1) 
C)  Throughout Optimized HDD (st1) 
D)  General Purpose SSD (gp2)

Question 3

A SysOps administrator is deploying a fleet of over 100 Amazon EC2 instances in an Amazon VPC. After the instances are set up and serving clients, a new DNS server needs to be added to the instances for DNS resolution. What is the MOST efficient way to make this change?

Accepted Answer

A)  Update the DHCP options set for the Amazon VPC. 
B)  Use AWS OpsWorks to update the DNS server configuration for each instance. 
C)  Use AWS Systems Manager to update the DMS server configuration for each instance. 
D)  Write a script to update the DNS server configuration for each instance. 
A)  Update the DHCP options set for the Amazon VPC. 
B)  Use AWS OpsWorks to update the DNS server configuration for each instance. 
C)  Use AWS Systems Manager to update the DMS server configuration for each instance. 
D)  Write a script to update the DNS server configuration for each instance.

Question 4

A SysOps Administrator is troubleshooting an AWS CloudFormation template whereby multiple Amazon EC2 instances are being created. The template is working in us-east-1, but it is failing in us-west-2 with the error code: AMI [ami-12345678] does not exist How should the Administrator ensure that the AWS CloudFormation template is working in every region?

Accepted Answer

A)  Copy the source region's Amazon Machine Image (AMI) to the destination region and assign it the same ID. 
B)  Edit the AWS CloudFormation template to specify the region code as part of the fully qualified AMI ID. 
C)  Edit the AWS CloudFormation template to offer a drop-down list of all AMIs to the user by using the AWS::EC2::AMI::ImageID control. Edit the AWS CloudFormation template to offer a drop-down list of all AMIs to the user by using the AWS::EC2::AMI::ImageID control. 
D)  Modify the AWS CloudFormation template by including the AMI IDs in the "Mappings" section. Refer to the proper mapping within the template for the proper AMI ID. 
A)  Copy the source region's Amazon Machine Image (AMI) to the destination region and assign it the same ID. 
B)  Edit the AWS CloudFormation template to specify the region code as part of the fully qualified AMI ID. 
C)  Edit the AWS CloudFormation template to offer a drop-down list of all AMIs to the user by using the AWS::EC2::AMI::ImageID control. Edit the AWS CloudFormation template to offer a drop-down list of all AMIs to the user by using the AWS::EC2::AMI::ImageID control. 
D)  Modify the AWS CloudFormation template by including the AMI IDs in the "Mappings" section. Refer to the proper mapping within the template for the proper AMI ID.

Question 5

A SysOps Administrator has an AWS CloudFormation template of the company's existing infrastructure in us-west-2. The Administrator attempts to use the template to launch a new stack in eu-west-1, but the stack only partially deploys, receives an error message, and then rolls back. Why would this template fail to deploy? (Choose two.)

Accepted Answer

A)  The template referenced an IAM user that is not available in eu-west-1 
B)  The template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1 
C)  The template did not have the proper level of permissions to deploy the resources 
D)  The template requested services that do not exist in eu-west-1 
E)  CloudFormation templates can be used only to update existing services 
A)  The template referenced an IAM user that is not available in eu-west-1 
B)  The template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1 
C)  The template did not have the proper level of permissions to deploy the resources 
D)  The template requested services that do not exist in eu-west-1 
E)  CloudFormation templates can be used only to update existing services

Question 6

A security researcher has published a new Common Vulnerabilities and Exposures (CVE) report that impacts a popular operating system. A SysOps Administrator is concerned with the new CVE report and wants to patch the company's systems immediately. The administrator contacts AWS Support and requests the patch be applied to all Amazon EC2 instances. How will AWS respond to this request?

Accepted Answer

A)  AWS will apply the patch during the next maintenance window, and will provide the Administrator with a report of all patched EC2 instances. 
B)  AWS will relaunch the EC2 instances with the latest version of the Amazon Machine Image (AMI), and will provide the Administrator with a report of all patched EC2 instances. 
C)  AWS will research the vulnerability to see if the Administrator's operating system is impacted, and will patch the EC2 instances that are affected. 
D)  AWS will review the shared responsibility model with the Administrator and advise them regarding how to patch the EC2 instances. 
A)  AWS will apply the patch during the next maintenance window, and will provide the Administrator with a report of all patched EC2 instances. 
B)  AWS will relaunch the EC2 instances with the latest version of the Amazon Machine Image (AMI), and will provide the Administrator with a report of all patched EC2 instances. 
C)  AWS will research the vulnerability to see if the Administrator's operating system is impacted, and will patch the EC2 instances that are affected. 
D)  AWS will review the shared responsibility model with the Administrator and advise them regarding how to patch the EC2 instances.

Question 7

A company has a web application that is used across all company divisions. Each application request contains a header that includes the name of the division making the request. The SysOps Administrator wants to identify and count the requests from each division. Which condition should be added to the web ACL of the AWS WAF to accomplish this?

Accepted Answer

A)  Cross-site scripting 
B)  Geo match 
C)  IP match 
D)  String match 
A)  Cross-site scripting 
B)  Geo match 
C)  IP match 
D)  String match

Question 8

An organization is concerned that its Amazon RDS databases are not protected. The solution to address this issue must be low cost, protect against table corruption that could be overlooked for several days, and must offer a 30-day window of protection. How can these requirements be met?

Accepted Answer

A)  Enable Multi-AZ on the RDS instance to maintain the data in a second Availability Zone. 
B)  Create a read replica of the RDS instance to maintain the data in a second region. 
C)  Ensure that automated backups are enabled and set the appropriate retention period. 
D)  Enable versioning in RDS to recover altered table data when needed. 
A)  Enable Multi-AZ on the RDS instance to maintain the data in a second Availability Zone. 
B)  Create a read replica of the RDS instance to maintain the data in a second region. 
C)  Ensure that automated backups are enabled and set the appropriate retention period. 
D)  Enable versioning in RDS to recover altered table data when needed.

Question 9

An application is running on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are configured in an Amazon EC2 Auto Scaling group. A SysOps Administrator must configure the application to scale based on the number of incoming requests. Which solution accomplishes this with the LEAST amount of effort?

Accepted Answer

A)  Use a simple scaling policy based on a custom metric that measures the average active requests of all EC2 instances 
B)  Use a simple scaling policy based on the Auto Scaling group GroupDesiredCapacity metric Use a simple scaling policy based on the Auto Scaling group GroupDesiredCapacity metric 
C)  Use a target tracking scaling policy based on the ALB's ActiveConnectionCount metric Use a target tracking scaling policy based on the ALB's ActiveConnectionCount 
D)  Use a target tracking scaling policy based on the ALB's RequestCountPerTarget metric RequestCountPerTarget 
A)  Use a simple scaling policy based on a custom metric that measures the average active requests of all EC2 instances 
B)  Use a simple scaling policy based on the Auto Scaling group GroupDesiredCapacity metric Use a simple scaling policy based on the Auto Scaling group GroupDesiredCapacity metric 
C)  Use a target tracking scaling policy based on the ALB's ActiveConnectionCount metric Use a target tracking scaling policy based on the ALB's ActiveConnectionCount 
D)  Use a target tracking scaling policy based on the ALB's RequestCountPerTarget metric RequestCountPerTarget

Question 10

A sysops administrator is managing a VPC network consisting of public and private subnets. Instances in the private subnets access the Internet through a NAT gateway. A recent AWS bill shows that the NAT gateway charges have doubled. The administrator wants to identify which instances are creating the most network traffic. How should this be accomplished?

Accepted Answer

A)  Enable flow logs on the NAT gateway elastic network interface and use Amazon CloudWatch insights to filter data based on the source IP addresses. 
B)  Run an AWS Cost and Usage report and group the findings by instance ID. 
C)  Use the VPC traffic mirroring feature to send traffic to Amazon QuickSight. 
D)  Use Amazon CloudWatch metrics generated by the NAT gateway for each individual instance. 
A)  Enable flow logs on the NAT gateway elastic network interface and use Amazon CloudWatch insights to filter data based on the source IP addresses. 
B)  Run an AWS Cost and Usage report and group the findings by instance ID. 
C)  Use the VPC traffic mirroring feature to send traffic to Amazon QuickSight. 
D)  Use Amazon CloudWatch metrics generated by the NAT gateway for each individual instance.

Question 11

In the context of AWS Security Best Practices for RDS, if you require encryption or data integrity authentication of data at rest for compliance or other purposes, you can add protection at the _____ using SQL cryptographic functions.

Accepted Answer

A)  physical layer 
B)  security layer 
C)  application layer 
D)  data-link layer 
A)  physical layer 
B)  security layer 
C)  application layer 
D)  data-link layer

Question 12

A company has an application that is hosted on two Amazon EC2 instances in different Availability Zones. Both instances contain data that is critical for the company's business. Backups need to be retained for 7 days and need to be updated every 12 hours. Which solution will meet these requirements with the LEAST amount of effort?

Accepted Answer

A)  Use an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule to create snapshots of the Amazon Elastic Block Store (Amazon EBS) volumes. 
B)  Use Amazon Data Lifecycle Manager (Amazon DLM) to create a snapshot lifecycle policy for both instances. 
C)  Create a batch job to generate automated snapshots of the Amazon Elastic Block Store (Amazon EBS) volumes. 
D)  Create an AWS Lambda function to copy the data to Amazon S3 Glacier. 
A)  Use an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule to create snapshots of the Amazon Elastic Block Store (Amazon EBS) volumes. 
B)  Use Amazon Data Lifecycle Manager (Amazon DLM) to create a snapshot lifecycle policy for both instances. 
C)  Create a batch job to generate automated snapshots of the Amazon Elastic Block Store (Amazon EBS) volumes. 
D)  Create an AWS Lambda function to copy the data to Amazon S3 Glacier.

Question 13

A user has launched an ELB which has 5 instances registered with it. The user deletes the ELB by mistake. What will happen to the instances?

Accepted Answer

A)  ELB will ask the user whether to delete the instances or not 
B)  Instances will be terminated 
C)  ELB cannot be deleted if it has running instances registered with it 
D)  Instances will keep running 
A)  ELB will ask the user whether to delete the instances or not 
B)  Instances will be terminated 
C)  ELB cannot be deleted if it has running instances registered with it 
D)  Instances will keep running

Question 14

A user wants to disable connection draining on an existing ELB. Which of the below mentioned statements helps the user disable connection draining on the ELB?

Accepted Answer

A)  The user can only disable connection draining from CLI 
B)  It is not possible to disable the connection draining feature once enabled 
C)  The user can disable the connection draining feature from EC2 -> ELB console or from CLI 
D)  The user needs to stop all instances before disabling connection draining 
A)  The user can only disable connection draining from CLI 
B)  It is not possible to disable the connection draining feature once enabled 
C)  The user can disable the connection draining feature from EC2 -> ELB console or from CLI 
D)  The user needs to stop all instances before disabling connection draining

Question 15

How often is metric data is sent to CloudWatch when detailed monitoring is enabled on an Amazon EC2 instance?

Accepted Answer

A)  Every 30 seconds 
B)  Every 5 minutes 
C)  Every 15 minutes 
D)  Every minute 
A)  Every 30 seconds 
B)  Every 5 minutes 
C)  Every 15 minutes 
D)  Every minute

Question 16

A SysOps Administrator needs to retrieve a file from the GLACIER storage class of Amazon S3. The Administrator wants to receive an Amazon SNS notification when the file is available for access. What action should be taken to accomplish this?

Accepted Answer

A)  Create an Amazon CloudWatch Events event for file restoration from Amazon S3 Glacier using the GlacierJobDescription API and send the event to an SNS topic the Administrator has subscribed to. Create an Amazon CloudWatch Events event for file restoration from Amazon S3 Glacier using the GlacierJobDescription API and send the event to an SNS topic the Administrator has subscribed to. 
B)  Create an AWS Lambda function that performs a HEAD request on the object being restored and checks the storage class of the object. Then send a notification to an SNS topic the Administrator has subscribed to when the storage class changes to STANDARD . Create an AWS Lambda function that performs a HEAD request on the object being restored and checks the storage class of the object. Then send a notification to an SNS topic the Administrator has subscribed to when the storage class changes to STANDARD . 
C)  Enable an Amazon S3 event notification for the s3:ObjectCreated:Post event that sends a notification to an SNS topic the Administrator has subscribed to. Enable an Amazon S3 event notification for the s3:ObjectCreated:Post event that sends a notification to an SNS topic the Administrator has subscribed to. 
D)  Enable S3 event notification for the s3:ObjectCreated:Completed event that sends a notification to an SNS topic the Administrator has subscribed to. Enable S3 event notification for the s3:ObjectCreated:Completed event that sends a notification to an SNS topic the Administrator has subscribed to. 
A)  Create an Amazon CloudWatch Events event for file restoration from Amazon S3 Glacier using the GlacierJobDescription API and send the event to an SNS topic the Administrator has subscribed to. Create an Amazon CloudWatch Events event for file restoration from Amazon S3 Glacier using the GlacierJobDescription API and send the event to an SNS topic the Administrator has subscribed to. 
B)  Create an AWS Lambda function that performs a HEAD request on the object being restored and checks the storage class of the object. Then send a notification to an SNS topic the Administrator has subscribed to when the storage class changes to STANDARD . Create an AWS Lambda function that performs a HEAD request on the object being restored and checks the storage class of the object. Then send a notification to an SNS topic the Administrator has subscribed to when the storage class changes to STANDARD . 
C)  Enable an Amazon S3 event notification for the s3:ObjectCreated:Post event that sends a notification to an SNS topic the Administrator has subscribed to. Enable an Amazon S3 event notification for the s3:ObjectCreated:Post event that sends a notification to an SNS topic the Administrator has subscribed to. 
D)  Enable S3 event notification for the s3:ObjectCreated:Completed event that sends a notification to an SNS topic the Administrator has subscribed to. Enable S3 event notification for the s3:ObjectCreated:Completed event that sends a notification to an SNS topic the Administrator has subscribed to.

Question 17

A company is setting up a VPC peering connection between its VPC and a customer's VPC. The company VPC is an IPv4 CIDR block of 172.16.0.0/16, and the customer's is an IPv4 CIDR block of 10.0.0.0/16. The SysOps Administrator wants to be able to ping the customer's database private IP address from one of the company's Amazon EC2 instances. What action should be taken to meet the requirements?

Accepted Answer

A)  Ensure that both accounts are linked and are part of consolidated billing to create a file sharing network, and then enable VPC peering. 
B)  Ensure that both VPC owners manually add a route to the VPC route tables that points to the IP address range of the other VPC. 
C)  Instruct the customer to set up a VPC with the same IPv4 CIDR block as that of the source VPC: 172.16.0.0/16. 
D)  Instruct the customer to create a virtual private gateway to link the two VPCs. 
A)  Ensure that both accounts are linked and are part of consolidated billing to create a file sharing network, and then enable VPC peering. 
B)  Ensure that both VPC owners manually add a route to the VPC route tables that points to the IP address range of the other VPC. 
C)  Instruct the customer to set up a VPC with the same IPv4 CIDR block as that of the source VPC: 172.16.0.0/16. 
D)  Instruct the customer to create a virtual private gateway to link the two VPCs.

Question 18

A user has created a VPC with public and private subnets. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.1.0/24 and the public subnet uses CIDR 20.0.0.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306). The user is configuring a security group of the NAT instance. Which of the below mentioned entries is not required for the NAT security group?

Accepted Answer

A)  For Inbound allow Source: 20.0.1.0/24 on port 80 
B)  For Outbound allow Destination: 0.0.0.0/0 on port 80 
C)  For Inbound allow Source: 20.0.0.0/24 on port 80 
D)  For Outbound allow Destination: 0.0.0.0/0 on port 443 
A)  For Inbound allow Source: 20.0.1.0/24 on port 80 
B)  For Outbound allow Destination: 0.0.0.0/0 on port 80 
C)  For Inbound allow Source: 20.0.0.0/24 on port 80 
D)  For Outbound allow Destination: 0.0.0.0/0 on port 443

Question 19

A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption (SSE-C., which of the below mentioned statements is true?

Accepted Answer

A)  The user should use the same encryption key for all versions of the same object 
B)  It is possible to have different encryption keys for different versions of the same object 
C)  AWS S3 does not allow the user to upload his own keys for server side encryption 
D)  The SSE-C does not work when versioning is enabled 
A)  The user should use the same encryption key for all versions of the same object 
B)  It is possible to have different encryption keys for different versions of the same object 
C)  AWS S3 does not allow the user to upload his own keys for server side encryption 
D)  The SSE-C does not work when versioning is enabled

Question 20

In order to optimize performance for a compute cluster that requires low inter-node latency, which feature in the following list should you use?

Accepted Answer

A)  AWS Direct Connect 
B)  Placement Groups 
C)  VPC private subnets 
D)  EC2 Dedicated Instances 
E)  Multiple Availability Zones 
A)  AWS Direct Connect 
B)  Placement Groups 
C)  VPC private subnets 
D)  EC2 Dedicated Instances 
E)  Multiple Availability Zones

Does Amazon RDS support SSL encryption for SQL Server DB Instances?

A SysOps Administrator needs an Amazon EBS volume type for a big data application. The application data is accessed infrequently and stored sequentially. What EBS volume type will be the MOST cost-effective solution?

A SysOps administrator is deploying a fleet of over 100 Amazon EC2 instances in an Amazon VPC. After the instances are set up and serving clients, a new DNS server needs to be added to the instances for DNS resolution. What is the MOST efficient way to make this change?

An organization is concerned that its Amazon RDS databases are not protected. The solution to address this issue must be low cost, protect against table corruption that could be overlooked for several days, and must offer a 30-day window of protection. How can these requirements be met?

In the context of AWS Security Best Practices for RDS, if you require encryption or data integrity authentication of data at rest for compliance or other purposes, you can add protection at the _____ using SQL cryptographic functions.

A user has launched an ELB which has 5 instances registered with it. The user deletes the ELB by mistake. What will happen to the instances?

A user wants to disable connection draining on an existing ELB. Which of the below mentioned statements helps the user disable connection draining on the ELB?

How often is metric data is sent to CloudWatch when detailed monitoring is enabled on an Amazon EC2 instance?

A SysOps Administrator needs to retrieve a file from the GLACIER storage class of Amazon S3. The Administrator wants to receive an Amazon SNS notification when the file is available for access. What action should be taken to accomplish this?

A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption (SSE-C., which of the below mentioned statements is true?

In order to optimize performance for a compute cluster that requires low inter-node latency, which feature in the following list should you use?

AWS Certified Advanced Networking - Specialty (ANS-C00)

AWS Certified Alexa Skill Builder - Specialty

AWS Certified Cloud Practitioner (CLF-C01)

AWS Certified Data Analytics - Specialty (DAS-C01)

AWS Certified Database - Specialty

AWS Certified Developer Associate (DVA-C01)

AWS Certified Machine Learning - Specialty (MLS-C01)

AWS Certified Security - Specialty (SCS-C01)

AWS Certified Solutions Architect - Associate SAA-C02

AWS Certified Solutions Architect - Professional (SAP-C01)

AWS Certified SysOps Administrator - Associate (SOA-C02)

AWS DevOps Engineer - Professional (DOP-C01)

Filters

Exam 13: AWS Certified SysOps Administrator (SOA-C01)

Does Amazon RDS support SSL encryption for SQL Server DB Instances?

A SysOps Administrator needs an Amazon EBS volume type for a big data application. The application data is accessed infrequently and stored sequentially. What EBS volume type will be the MOST cost-effective solution?

A SysOps administrator is deploying a fleet of over 100 Amazon EC2 instances in an Amazon VPC. After the instances are set up and serving clients, a new DNS server needs to be added to the instances for DNS resolution. What is the MOST efficient way to make this change?

An organization is concerned that its Amazon RDS databases are not protected. The solution to address this issue must be low cost, protect against table corruption that could be overlooked for several days, and must offer a 30-day window of protection. How can these requirements be met?

In the context of AWS Security Best Practices for RDS, if you require encryption or data integrity authentication of data at rest for compliance or other purposes, you can add protection at the _____ using SQL cryptographic functions.

A user has launched an ELB which has 5 instances registered with it. The user deletes the ELB by mistake. What will happen to the instances?

A user wants to disable connection draining on an existing ELB. Which of the below mentioned statements helps the user disable connection draining on the ELB?

How often is metric data is sent to CloudWatch when detailed monitoring is enabled on an Amazon EC2 instance?

A SysOps Administrator needs to retrieve a file from the GLACIER storage class of Amazon S3. The Administrator wants to receive an Amazon SNS notification when the file is available for access. What action should be taken to accomplish this?

A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption (SSE-C., which of the below mentioned statements is true?

In order to optimize performance for a compute cluster that requires low inter-node latency, which feature in the following list should you use?

AWS Certified Advanced Networking - Specialty (ANS-C00)

AWS Certified Alexa Skill Builder - Specialty

AWS Certified Cloud Practitioner (CLF-C01)

AWS Certified Data Analytics - Specialty (DAS-C01)

AWS Certified Database - Specialty

AWS Certified Developer Associate (DVA-C01)

AWS Certified Machine Learning - Specialty (MLS-C01)

AWS Certified Security - Specialty (SCS-C01)

AWS Certified Solutions Architect - Associate SAA-C02

AWS Certified Solutions Architect - Professional (SAP-C01)

AWS Certified SysOps Administrator - Associate (SOA-C02)

AWS DevOps Engineer - Professional (DOP-C01)

Filters