SOA-C01 Questions and Answers

Change the “Effect” from “Allow” to “Deny”

Change the “Action” from “s3:List*” to “s3:ListBucket”

Change the “Resource” from “arn:aws:s3:::bucketname/*” to “arn:aws:s3:::bucketname”

Change the “Principal” from “arn:aws:iam::111111111111:user/application” to “arn:aws:iam::111111111111: role/application”

Amazon CloudWatch will not capture the data because it is in the future.

Amazon CloudWatch will accept the custom metric data and record it.

The Amazon CloudWatch agent will check the Network Time Protocol (NTP) server before sending the data, and the agent will correct the time.

The Amazon CloudWatch agent will agent check the Network Time Protocol (NTP) server, and the agent will not send the data because it is more than 30 minutes in the future.

Create an Amazon EC2 proxy in Account A that forwards requests to Account B.

Create a load balancer in Account A that points to the load balancer in Account B.

Create a CNAME record in Account A pointing to an alias record to the load balancer in Account B.

Create an alias record in Account A pointing to the load balancer in Account B.

Log in to the AWS Billing and Cost Management console of the new account, and use the Cost Allocation Tags manager to create the new user-defined cost allocation tags.

Log in to the AWS Billing and Cost Management console of the payer account, and use Cost Allocation Tags manager to create the new user-defined cost allocation tags.

Log in to the AWS Management Console of the new account, use the Tag Editor to create the new user-defined tags, then use the Cost Allocation Tags manager in the new account to mark the tags as cost allocation tags.

Log in to the AWS Management Console of the new account, use the Tag Editor to create the new user-defined tags, then use the Cost Allocation Tags manager in the payer account to mark the tags as cost allocation tags.

Write a AWS lambda function that will query the logs every minute and contain the logic of which team to notify on which patterns and issues.

Set up different metric filters for each team based on patterns and alerts. Each alarm will notify the appropriate notification list.

Redesign the aggregation of logs so that each team’s relevant parts are sent to a separate log group, then subscribe each team to its respective log group.

Create an AWS Auto Scaling group of Amazon EC2 instances that will scale based on the amount of ingested log entries. This group will pull streams, look for patterns, and send notifications to relevant teams.

Type field

preamable

Data field

start of frame delimiter

The IAM user did not have privileges to launch the CloudFormation template.

The t2 medium EC2 instance service limit was reached.

An AWS Budgets threshold was breached.

The application’s Amazon Machine Image (AMI) is not available in us-east-2.

Shut down the EC2 instance. Enable multi-AZ replication within the EC2 instance, then restart the instance.

Launch a secondary EC2 instance running MySQL Configure a cron job that backs up the database on the primary EC2 instance and copies it to the secondary instance every 30 minutes.

Migrate the database to an RDS Aurora DB instance and create a Read Replication in another Availability Zone.

Create an Amazon RDS Microsoft SQL DB instance and enable multi-Az replication. Back up the existing data and import in to the new database.

Monitor AWS CloudTrail for StopInstances API calls related to upcoming maintenance.

Review the Personal Health Dashboard for any scheduled maintenance.

From the AWS Management Console, list any instances with failed system status checks.

Deploy a third-party monitoring solution to provide real-time EC2 instance monitoring.

VPC Flow Logs

Elastic Load Balancing logs

Amazon CloudFront logs

Amazon RDS MySQL error logs

Ensure the NLB listener security policy is set to ELBSecuntyPohcy-TLS-1-2-Ext-2018-06, ELBSecuntyPolicy-FS-1-2-Res-2019-08 or ELBSecuntyPolicy-TLS-1-0-2015-04

Ensure the heath check setting on the NLB for the Matcher configuration is between 200 and 399

Ensure the targets are within any of these CIDR blocks: 10.0.0.0/8 (RFC I918)r 100.64.0.0/10 (RFC 6598): 172.16.0.0/12 (RFC 1918), or 192.168.0.0/16 (RFC 1918).

Ensure the NLB is exposed as an endpoint service before registering the targets using IP addresses

Purchase Reserved Instances for the specific m2 instances

Change the m2 instances to equivalent m5 types, and purchase Reserved Instances for the specific m5 instances

Change the Classic Load Balancer to an Application Load Balancer, and purchase Reserved Instances for the specific m2 instances.

Purchase Spot Instances for the specific m2 instances

AWS CloudTrail

Amazon Inspector

AWS Shield Standard

AWS WAF

The Administrator has requested too many instances at once and must request fewer instances in batches.

The concurrent running instance limit has been reached, and an EC2 limit increase request must be filed with AWS Support.

AWS does not currently have enough available capacity and a different instance type must be used.

The Administrator must specify the maximum number of instances to be created while provisioning EC2 instances.

Deploy a second CloudFormation stack and use Amazon Route 53 to redirect traffic to the new stack.

Run the awa cloudformation update-attack command with the —rollback-configuration option.

Set an AutoScal ingRollingUpdate policy in the CloudFormation template to update the stack.

Update the CloudFormation template with the new AMI ID. then reboot the EC2 instances.

Create a customer gateway to connect to Amazon S3 Modify the route table of the private subnets to use the customer gateway

Create a gateway VPC endpoint for Amazon S3 Modify the route table of the private subnets to use the gateway VPC endpoint.

Create a NAT gateway in the private subnets. Modify the route table of the subnets to use the NAT gateway.

Create an S3 bucket policy to allow connections from the private subnets. Modify the route table.

A VPC endpoint has not been created for Amazon RDS.

A VPC endpoint has not been created for Amazon SQS.

The RDS security group is not allowing connections from the Lambda function.

The subnet associated with the Lambda function does not have an internet gateway attached

The subnet associated with the Lambda function has a NAT gateway

Use the AWS Management Console to delete the object delete markers.

Create a new lifecycle rule to delete the object delete markers that were created.

Use the AWS CLI to delete the object delete markers while specifying the version IDs of the delete markers.

Modify the existing lifecycle rule to delete the object delete markers that were created.

Use the AWS CLI to delete the object delete markers while specifying the name of the objects only.

Configure an AWS Data Pipeline resource with a CopyActivity activity object. Specify the input and output bucket names and a list of object keys.

Configure the S3 bucket resource to activate cross-Region replication. Point to the existing S3 bucket and specify a list of object keys to replicate.

Create an AWS Lambda function that can perform the copy operation. Add the Lambda function to the template as a custom resource.

Specify the commands to copy the objects in the user data field of the template's S3 bucket resource.

Use built-in Amazon CloudWatch metrics, and configure CloudWatch alarms and an Amazon SNS topic for email notifications

Use AWS CloudTrail logs and configure the trail to send notifications to an Amazon SNS topic

Use the Amazon CloudWatch agent to send disk space metrics, then set up CloudWatch alarms using an Amazon SNS topic

Use AWS Trusted Advisor and enable email notification alerts for EC2 disk space

Create an Amazon CloudWatch alarm based on the CPUUtilization metric. When the metric is 0% for 24 hours, trigger an action to terminate the EC2 instance when the alarm is triggered.

Create an AWS Lambda function to check all EC2 instances and terminate instances running more than 24 hours. Trigger the function with an Amazon CloudWatch Events event every 15 minutes.

Add an action to AWS Trusted Advisor to turn off EC2 instances based on the Low Utilization Amazon EC2 Instances check, terminating instances identified by Trusted Advisor as running for more than 24 hours.

Install the unified Amazon CloudWatch agent on every EC2 instance. Configure the agent to terminate instances after they have been running for 24 hours.

Add a NAT gateway to a public subnet

Attach a private address to the elastic network interface on the EC2 instance

Attach an Elastic IP address to the internet gateway

Add an entry to the route table for the subnet that points to an internet gateway

Create an internet gateway and attach it to a VPC

Create and run an Amazon Inspector assessment template.

Manually SSH into each instance and check the software version.

Use AWS CloudTrail to verify Amazon EC2 activity in the account.

Write a custom script and use AWS CodeDeploy to deploy to Amazon EC2 instances.

Create an Amazon CloudWatch dashboard to monitor the memory usage metrics on the Instance over time.

Create an alarm on the dashboard that publishes an Amazon SNS notification to alert the CIO when a threshold is passed.

Create an alarm on the metric that publishes an Amazon SNS notification to alert the CIO when a threshold is passed.

Create an alarm on the AWS Personal Health Dashboard that publishes an Amazon SNS notification to alert the CIO when the system is out of memory.

Configure the Amazon CloudWatch agent to collect and push memory usage metrics on the instance.

Create 1-year On-Demand Capacity Reservations in the specific Availability Zones

Launch Amazon EC2 instances with termination protection enabled

Purchase 1 -year Reserved Instances in the specific Availability Zones

Use a Spot Fleet across multiple Availability Zones

Use Amazon CloudFront to log the URL and forward the request

Use Amazon CloudFront to rewrite the header based on the microservice and forward the request

Use a Network Load Balancer (NLB) and do path-based routing

Use an Application Load Balancer (ALB) and do path-based routing

Enable automatic key rotation tor the CMK and specify a period of 6 months

Create a new CMK with new imported material and update the key alias to point to the new CMK

Delete the current key material and import new material into the existing CMK

Import a copy of the existing key material into a new CMK as a backup and set the rotation schedule for 6 months

Use the set-alarm-state command in AWS CloudTrail to invoke the Amazon SNS notification

Use CloudWatch custom metrics to set the alarm state in AWS CloudTrail and enable Amazon SNS notifications

Use EC2 instance metadata to manually set the CPU utilization to 75% and invoke the alarm state

Use the set-alarm-state command in the AWS CLI for CloudWatch

Use AWS Trusted Advisor to obtain a report containing the checked items in the Cost Optimization pillar

Download the detailed billing report, upload it to a database, and match the line items with a list of known resources by department.

Create a script by using the AWS CLI to automatically apply tags to existing resources (or each department. Schedule the script to run weekly.

Use AWS Organizations to create a department Organizational Unit and allow only authorized personnel in each department to create resources.

Create a Budget from the Billing and Cost Management console. Specify the budget type as Cost, assign tags for each department, define notifications, and specify any other options as required.

Create a role for each department within AWS 1AM and assign each role the necessary permissions.

Create a user for each department within AWS 1AM and assign each user the necessary permissions.

Implement service control policies within AWS Organizations to determine which resources each department can access

Place each department into an organizational unit (OU) within AWS Organizations and use 1AM policies to determine which resources they can access

Run the application on On-Demand EC2 instances. Run the jobs on Spot Instances with a specified duration.

Run the application on Reserved Instance EC2 instances. Run the jobs on AWS Lambda.

Run the application on On-Demand EC2 instances. Run the jobs on On-Demand EC2 instances.

Run the application on Reserved instance EC2 instances. Run the jobs on Spot Instances with a specified duration.

The request rate to Amazon S3 is too high.

There is an error with the Amazon RDS database.

The requests to Amazon S3 do not have the proper permissions.

The users are in different geographical region and Amazon Route 53 is restricting access.

Set up an AWS Config rule to alert based on changes to any Cloud Formation stack. An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation.

Set up an Amazon CloudWatch Events event with a rule to trigger based on any CloudFormation API call. An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation.

Launch the CloudFormation templates using a stack policy with an explicit allow for all resources and an explicit deny of the protected resources with an action of Update:*

Attach an IAM policy to the DevOps team role that prevents a CloudFormation stack from updating, with a condition based on the specific Amazon Resource names (ARNs) of the protected resources.

Create an 1AM managed policy lo deny access to ports 22 and 3389 on any security groups in a VPC.

Define an AWS Config rule and remediation action with AWS Systems Manager automation documents.

Enable AWS Trusted Advisor to remediate public port access.

Use AWS Systems Manager configuration compliance to remediate public port access.