SOA-C02 Free Practice Test

- (Exam Topic 1)
A company uses Amazon Route 53 to manage the public DNS records for the domain example.com. The company deploys an Amazon CloudFront distribution to deliver static assets for a new corporate website. The company wants to create a subdomain that is named "static" and must route traffic for the subdomain to the CloudFront distribution.
How should a SysOps administrator create a new record for the subdomain in Route 53?

1. A. Create a CNAME recor
2. B. Enter static.cloudfront.net as the record nam
3. C. Enter the CloudFront distribution's public IP address as the value.
4. D. Create a CNAME recor
5. E. Enter static.example.com as the record nam
6. F. Enter the CloudFront distribution's private IP address as the value.
7. G. Create an A recor
8. H. Enter static.cloudfront.net as the record nam
9. I. Enter the CloudFront distribution's ID as an alias target.
10. J. Create an A recor
11. K. Enter static.example.com as the record nam
12. L. Enter the CloudFront distribution's domain name as an alias target.

Correct Answer: D
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html

- (Exam Topic 1)
A company is managing many accounts by using a single organization in AWS Organizations. The organization has all features enabled. The company wants to turn on AWS Config in all the accounts of the organization and in all AWS Regions.
What should a Sysops administrator do to meet these requirements in the MOST operationally efficient way?

1. A. Use AVVS CloudFormation StackSets to deploy stack instances that turn on AWS Config in all accounts and in all Regions.
2. B. Use AWS CloudFormation StackSets to deploy stack policies that turn on AWS Config in all accounts and in all Regions.
3. C. Use service control policies (SCPs) to configure AWS Config in all accounts and in all Regions.
4. D. Create a script that uses the AWS CLI to turn on AWS Config in all accounts in the organizatio
5. E. Run the script from the organization's management account.

Correct Answer: C

- (Exam Topic 1)
An existing, deployed solution uses Amazon EC2 instances with Amazon EBS General Purpose SSD volumes, an Amazon RDS PostgreSQL database, an Amazon EFS file system, and static objects stored in an Amazon S3 bucket. The Security team now mandates that at-rest encryption be turned on immediately for all aspects of the application, without creating new resources and without any downtime.
To satisfy the requirements, which one of these services can the SysOps administrator enable at-rest encryption on?

1. A. EBS General Purpose SSD volumes
2. B. RDS PostgreSQL database
3. C. Amazon EFS file systems
4. D. S3 objects within a bucket

Correct Answer: D
https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html

- (Exam Topic 1)
A company stores files on 50 Amazon S3 buckets in the same AWS Region. The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost.
Which solution will meet these requirements?

1. A. Create a gateway VPC endpoint for each S3 bucke
2. B. Attach the gateway VPC endpoints to each subnetinside the VPC.
3. C. Create an interface VPC endpoint for each S3 bucke
4. D. Attach the interface VPC endpoints to each subnet inside the VPC.
5. E. Create one gateway VPC endpoint for all the S3 bucket
6. F. Add the gateway VPC endpoint to the VPC route table.
7. G. Create one interface VPC endpoint for all the S3 bucket
8. H. Add the interface VPC endpoint to the VPC route table.

Correct Answer: C

- (Exam Topic 1)
A SysOps administrator receives an alert from Amazon GuardDuty about suspicious network activity on an Amazon FC2 instance. The GuardDuty finding lists a new external IP address as a traffic destination. The SysOps administrator does not recognize the external IP address. The SysOps administrator must block traffic to the external IP address that GuardDuty identified
Which solution will meet this requirement?

1. A. Create a new security group to block traffic to the external IP addres
2. B. Assign the new security group to the EC2 instance
3. C. Use VPC flow logs with Amazon Athena to block traffic to the external IP address
4. D. Create a network ACL Add an outbound deny rule tor traffic to the external IP address
5. E. Create a new security group to block traffic to the external IP address Assign the new security group to the entire VPC

Correct Answer: A