Free Amazon SOA-C02 Exam Questions

Question 1

[High Availability, Backup, and Recovery]A SysOps administrator needs to implement a solution to create backups of an Amazon DynamoDBtable. The solution must perform the backups automatically every 24 hours and must move thebackups to cold storage after 30 days. The solution also must encrypt the backups by using an AWSKey Management Service (AWS KMS) key that has a customizable key policy.Which solution will meet these requirements?

A : Configure a DynamoDB table backup job that has a schedule period of 24 hours. Configure thebackup job to move backups to cold storage after 30 days. Create a customer managed KMS key.Configure the backup job to use the customer managed KMS key.

B : Configure a DynamoDB table backup job that has a schedule period of 24 hours. Configure thebackup jewto move backups to cold storage after 30 days. Configure the backup job to use the AWSmanaged KMS key for DynamoDB.

C : Configure AWS Backup for DynamoDB. Create an AWS Backup vault. Create an AWS Backup planthat includes the DynamoDB table with a cold storage lifecyde policy set to 30 days. Create acustomer managed KMS key. Configure the AWS Backup vault to use the customer managed KMSkey.

D : Configure AWS Backup for DynamoDB. Create an AWS Backup vault that includes a cold storagelifecyde policy set to 30 days. Create an AWS Backup plan that includes the DynamoDB table.Configure the AWS Backup vault to use the AWS managed KMS key for DynamoDB.

Answer: C

Question 2

[Security and Compliance] A company has its accounts in an organization in AWS Organizations. The company deploys its firstservice control policy (SCP) to an organizational unit (OU). The SCP denies the iam:CreateUser action.Only the newly created SCP is attached to the OU.After deployment of the SCP, users in the OU who assume a developer IAM role can no longer launchAmazon EC2 instances.Which action should a SysOps administrator take to resolve this issue?

A : Add a permissions boundary to the developer IAM role to explicitly allow the ec2:RunInstances action.

B : Update the SCP to include an additional statement that allows all actions on all resources.

C : Update the SCP to include an additional statement that allows the ec2:RunInstances action.

D : Update the SCP by changing the denied iam:CreateUser action to iam:Create*.

Answer: C

Question 3

The SysOps administrator needs to configure a website for CloudFront when the DNS CNAME record points to an S3 URL instead of CloudFront.

A : Disable S3 Block Public Access on the S3 bucket.

B : Create an S3 access point in the same AWS Region where the S3 bucket is located. Configure the access point policy to allow CloudFront to read from the S3 bucket. Point the CNAME record to the S3 access point name.

C : Modify the value of the DNS CNAME record to be arn:aws:s3:::example-com-website-files instead of the S3 URI.

D : Modify the value of the DNS CNAME record to be dllllllabcdef8.cloudfront.net instead of the S3 URI.

Answer: D

Question 4

[Monitoring, Reporting, and Automation]A SysOps administrator is troubleshooting an implementation of Amazon CloudWatch Synthetics. TheCloudWatch Synthetics results must be sent to an Amazon S3 bucket. The SysOps administrator hascopied the configuration of an existing canary that runs on a VPC that has an internet gatewayattached. However, the SysOps administrator cannot get the canary to successfully start on a privateVPC that has no internet access. What should the SysOps administrator do to successfully run thecanary on the private VPC?

A : Ensure that the DNS resolution option and the DNS hostnames option are turned on in the VPC.Add the synthetics:GetCanaryRuns permission to the VPC. On the S3 bucket, add theIgnorePublicAcls permission to the CloudWatch Synthetics role.

B : Ensure that the DNS resolution option and the DNS hostnames option are turned off in the VPC. Create a gateway VPC endpoint for Amazon S3. Add the permissions to allow CloudWatch Synthetics to use the S3 endpoint.

C : Ensure that the DNS resolution option and the DNS hostnames option are turned off in the VPC. Add a security group to the canary to allow outbound traffic on the DNS port. Add the permissions to allow CloudWatch Synthetics to write to the S3 bucket.

D : Ensure that the DNS resolution option and the DNS hostnames option are turned on in the VPC. Create an interface VPC endpoint for CloudWatch. Create a gateway VPC endpoint for Amazon S3. Add the permissions to allow CloudWatch Synthetics to use both endpoints.

Answer: D

Question 5

A company needs to implement a managed file system to host Windows file shares for users on premises.Resources in the AWS Cloud also need access to the data on these file shares. A SysOps administrator needs to present the user file shares on premises and make the user file shares available on AWS with minimum latency. What should the SysOps administrator do to meet these requirements?

A : t up an Amazon S3 File Gateway.

B : t up an AWS Direct Connect connection.

C : AWS DataSync to automate data transfers between the existing file servers and AWS.

D : t up an Amazon FSx File Gateway.

Answer: D