Pass4Future also provide interactive practice exam software for preparing Amazon AWS Certified SysOps Administrator - Associate (SOA-C02) Exam effectively. You are welcome to explore sample free Amazon SOA-C02 Exam questions below and also try Amazon SOA-C02 Exam practice test software.
Do you know that you can access more real Amazon SOA-C02 exam questions via Premium Access? ()
The company wants to ensure that SSH access to EC2 instances is not publicly accessible, and if it becomes open, it needs to close the port immediately.
Options (Select TWO):
Answer : B, D
To monitor and remediate open SSH ports, AWS Config and Systems Manager Automation are ideal:
AWS Config Rule: Use AWS Config to monitor security groups and detect when SSH (port 22) is open to the public. Config rules can be set up to trigger remediation actions automatically.
Systems Manager Automation Runbook: Create or use a predefined automation runbook that can remove the open SSH rule from security groups, thus closing port 22 to the public.
CloudWatch alarms are not ideal for monitoring security group configurations. Amazon Inspector focuses on vulnerability assessment rather than continuous monitoring for specific port access.
The company needs to minimize network latency for a cluster of EC2 instances running custom software for advanced statistical analysis.
Options:
Answer : A
Cluster placement groups are designed to place EC2 instances close together within a single Availability Zone, which reduces latency and maximizes network performance between instances.
Cluster Placement Group: Reduces network latency by keeping instances in close proximity within the same hardware, providing low-latency, high-throughput networking.
High Network Performance: Ideal for latency-sensitive applications, especially those running within a clustered architecture.
Spread placement groups are designed for high availability rather than low latency. Jumbo frames may improve throughput but not significantly reduce latency.
The SysOps administrator needs to prevent any account within an AWS Organization from leaving the organization.
Options:
Answer : A
To prevent accounts from leaving an AWS Organization, an SCP that denies the LeaveOrganization action should be applied to the root organizational unit (OU).
Service Control Policy (SCP): By denying LeaveOrganization, member accounts are restricted from leaving the organization.
Root OU Application: Applying this policy at the root level ensures that no account in the organization can bypass it.
The RemoveAccountFromOrganization action pertains to removing an account by the organization's management account rather than preventing member accounts from leaving. AWS Config's account-part-of-organizations rule does not enforce this restriction but only monitors it.
The company's ecommerce website running on EC2 instances behind an ALB intermittently returns HTTP 500 errors. The Auto Scaling group is only using EC2 status checks.
Options:
Answer : B
Using ALB health checks in the Auto Scaling group will provide more accurate health monitoring and replace instances if they are unhealthy.
ALB Health Checks: Configure health checks based on HTTP response codes, which will detect application-level issues causing the HTTP 500 errors and replace instances as needed.
EC2 vs. ALB Health Checks: EC2 status checks only verify instance hardware and OS, not the application's responsiveness. By using ALB health checks, Auto Scaling can remove instances that are failing at the application level, thus preventing users from receiving 500 errors.
Replacing the ALB with a Network Load Balancer does not address HTTP 500 errors, and enabling session affinity does not resolve application health issues. The CloudWatch agent would not provide the required health check functionality for automated instance replacement.
The company needs a solution to provide failover for a Single-AZ RDS for MySQL DB instance to minimize application downtime.
Options:
Answer : A
Modifying the DB instance to a Multi-AZ deployment is the recommended solution for failover and high availability in RDS. Multi-AZ RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone, allowing automatic failover in case of an instance or Availability Zone failure.
Multi-AZ Deployment: Provides resilience with automatic failover and minimizes application downtime.
No Application Changes Needed: Multi-AZ is managed by AWS, so the failover is transparent to the application.
Read replicas and Auto Scaling groups do not provide automatic failover for write operations, and RDS Proxy only improves connection management rather than high availability.
