SOA-C02 Free Practice Test

- (Exam Topic 1)
A company recently migrated its application to a VPC on AWS. An AWS Site-to-Site VPN connection connects the company’s on-premises network to the VPC. The application retrieves customer data from another system that resides on premises. The application uses an on-premises DNS server to resolve domain records. After the migration, the application is not able to connect to the customer data because of name resolution errors.
Which solution will give the application the ability to resolve the internal domain names?

1. A. Launch EC2 instances in the VP
2. B. On the EC2 instances, deploy a custom DNS forwarder that forwards all DNS requests to the on-premises DNS serve
3. C. Create an Amazon Route 53 private hosted zone that uses the EC2 instances for name servers.
4. D. Create an Amazon Route 53 Resolver outbound endpoin
5. E. Configure the outbound endpoint to forward DNS queries against the on-premises domain to the on-premises DNS server.
6. F. Set up two AWS Direct Connect connections between the AWS environment and the on-premises networ
7. G. Set up a link aggregation group (LAG) that includes the two connection
8. H. Change the VPC resolver address to point to the on-premises DNS server.
9. I. Create an Amazon Route 53 public hosted zone for the on-premises domai
10. J. Configure the network ACLs to forward DNS requests against the on-premises domain to the Route 53 public hosted zone.

Correct Answer: B
https://docs.aws.amazon.com/zh_tw/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html

- (Exam Topic 1)
Application A runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are in an Auto Scaling group and are in the same subnet that is associated with the NLB. Other applications from an on-premises environment cannot communicate with Application A on port 8080.
To troubleshoot the issue, a SysOps administrator analyzes the flow logs. The flow logs include the following records:

What is the reason for the rejected traffic?

1. A. The security group of the EC2 instances has no Allow rule for the traffic from the NLB.
2. B. The security group of the NLB has no Allow rule for the traffic from the on-premises environment.
3. C. The ACL of the on-premises environment does not allow traffic to the AWS environment.
4. D. The network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range.

Correct Answer: A

- (Exam Topic 1)
A company needs to take an inventory of applications that are running on multiple Amazon EC2 instances. The company has configured users and roles with the appropriate permissions for AWS Systems Manager. An updated version of Systems Manager Agent has been installed and is running on every instance. While configuring an inventory collection, a SysOps administrator discovers that not all the instances in a single subnet are managed by Systems Manager.
What must the SysOps administrator do to fix this issue?

1. A. Ensure that all the EC2 instances have the correct tags for Systems Manager access.
2. B. Configure AWS Identity and Access Management Access Analyzer to determine and automatically remediate the issue.
3. C. Ensure that all the EC2 instances have an instance profile with Systems Manager access.
4. D. Configure Systems Manager to use an interface VPC endpoint.

Correct Answer: C
Ensuring that all the EC2 instances have an instance profile with Systems Manager access is the most effective way to fix this issue. Having an instance profile with Systems Manager access will allow the SysOps administrator to configure the inventory collection for all the instances in the subnet, regardless of whether or not they are managed by Systems Manager.

- (Exam Topic 1)
A team of On-call engineers frequently needs to connect to Amazon EC2 Instances In a private subnet to troubleshoot and run commands. The Instances use either the latest AWS-provided Windows Amazon Machine Images (AMIs) or Amazon Linux AMIs.
The team has an existing IAM role for authorization. A SysOps administrator must provide the team with
access to the Instances by granting IAM permissions to this Which solution will meet this requirement?

1. A. Add a statement to the IAM role policy to allow the ssm:StartSession action on the instance
2. B. Instruct the team to use AWS Systems Manager Session Manager to connect to the Instances by using the assumed IAM role.
3. C. Associate an Elastic IP address and a security group with each instanc
4. D. Add the engineers' IP addresses to the security group inbound rule
5. E. Add a statement to the IAM role policy to allow the ec2:AuthoflzeSecurityGroupIngress action so that the team can connect to the Instances.
6. F. Create a bastion host with an EC2 Instance, and associate the bastion host with the VP
7. G. Add a statement to the IAM role policy to allow the ec2:CreateVpnConnection action on the bastion hos
8. H. Instruct the team to use the bastion host endpoint to connect to the instances.D Create an internet-facing Network Load Balance
9. I. Use two listener
10. J. Forward port 22 to a target group of Linux instance
11. K. Forward port 3389 to a target group of Windows Instance
12. L. Add a statement to the IAM role policy to allow the ec2:CreateRoute action so that the team can connect to the Instances.

Correct Answer: A

- (Exam Topic 1)
A company hosts a website on multiple Amazon EC2 instances that run in an Auto Scaling group. Users are reporting slow responses during peak times between 6 PM and 11 PM every weekend. A SysOps administrator must implement a solution to improve performance during these peak times.
What is the MOST operationally efficient solution that meets these requirements?

1. A. Create a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to increase the desired capacity before peak times.
2. B. Configure a scheduled scaling action with a recurrence option to change the desired capacity before and after peak times.
3. C. Create a target tracking scaling policy to add more instances when memory utilization is above 70%.
4. D. Configure the cooldown period for the Auto Scaling group to modify desired capacity before and after peak times.

Correct Answer: B
"Scheduled scaling helps you to set up your own scaling schedule according to predictable load changes. For example, let's say that every week the traffic to your web application starts to increase on Wednesday, remains high on Thursday, and starts to decrease on Friday. You can configure a schedule for Amazon EC2 Auto Scaling to increase capacity on Wednesday and decrease capacity on Friday." https://docs.aws.amazon.com/autoscaling/ec2/userguide/schedule_time.html