SOA-C02 Free Practice Test

- (Exam Topic 1)
A SysOps administrator is troubleshooting connection timeouts to an Amazon EC2 instance that has a public IP address. The instance has a private IP address of 172.31.16.139. When the SysOps administrator tries to ping the instance's public IP address from the remote IP address 203.0.113.12, the response is "request timed out." The flow logs contain the following information:

What is one cause of the problem?

1. A. Inbound security group deny rule
2. B. Outbound security group deny rule
3. C. Network ACL inbound rules
4. D. Network ACL outbound rules

Correct Answer: D

- (Exam Topic 1)
A company uses AWS CloudFormation to deploy its application infrastructure Recently, a user accidentally changed a property of a database in a CloudFormation template and performed a stack update that caused an interruption to the application A SysOps administrator must determine how to modify the deployment process to allow the DevOps team to continue to deploy the infrastructure, but prevent against accidental modifications to specific resources.
Which solution will meet these requirements?

1. A. Set up an AWS Config rule to alert based on changes to any CloudFormation stack An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation
2. B. Set up an Amazon CloudWatch Events event with a rule to trigger based on any CloudFormation API call An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation
3. C. Launch the CloudFormation templates using a stack policy with an explicit allow for all resources and an explicit deny of the protected resources with an action of Update
4. D. Attach an IAM policy to the DevOps team role that prevents a CloudFormation stack from updating, with a condition based on the specific Amazon Resource Names (ARNs) of the protected resources

Correct Answer: B

- (Exam Topic 1)
A SysOps administrator created an AWS Cloud Formation template that provisions Amazon EC2 instances, an Elastic Load Balancer (ELB), and an Amazon RDS DB instance. During stack creation, the creation of the EC2 instances and the creation of the ELB are successful. However, the creation of the DB instance fails.
What is the default behavior of CloudFormation in this scenario?

1. A. CloudFormation will roll back the stack and delete the stack.
2. B. CloudFormation will roll back the stack but will not delete the stack.
3. C. CloudFormation will prompt the user to roll back the stack or continue.
4. D. CloudFormation will successfully complete the stack but will report a failed status for the DB instance.

Correct Answer: C

- (Exam Topic 1)
A company has a new requirement stating that all resources in AWS must be tagged according to a set policy. Which AWS service should be used to enforce and continually identify all resources that are not in compliance with the policy?

1. A. AWS CloudTrail
2. B. Amazon Inspector
3. C. AWSConfig
4. D. AWS Systems Manager

Correct Answer: C

- (Exam Topic 1)
A company is partnering with an external vendor to provide data processing services. For this integration, the vendor must host the company's data in an Amazon S3 bucket in the vendor's AWS account. The vendor is allowing the company to provide an AWS Key Management Service (AWS KMS) key to encrypt the company's data. The vendor has provided an IAM role Amazon Resource Name (ARN) to the company for this integration.
What should a SysOps administrator do to configure this integration?

1. A. Create a new KMS ke
2. B. Add the vendor's IAM role ARN to the KMS key polic
3. C. Provide the new KMS key ARN to the vendor.
4. D. Create a new KMS ke
5. E. Create a new IAM use
6. F. Add the vendor's IAM role ARN to an inline policy that is attached to the IAM use
7. G. Provide the new IAM user ARN to the vendor.
8. H. Configure encryption using the KMS managed S3 ke
9. I. Add the vendor's IAM role ARN to the KMS managed S3 key polic
10. J. Provide the KMS managed S3 key ARN to the vendor.
11. K. Configure encryption using the KMS managed S3 ke
12. L. Create an S3 bucke
13. M. Add the vendor's IAM role ARN to the S3 bucket polic
14. N. Provide the S3 bucket ARN to the vendor.

Correct Answer: C