SOA-C03 Practice Exam Questions and Answers

A.  

Add a NAT gateway in the public subnet of each Availability Zone. Make the NAT gateway the default route of all private subnets In those Availability Zones.

B.  

Allocate one Elastic IP address in each Availability Zone. Associate the Elastic IP address with all the instances in the Availability Zone

C.  

Place the instances behind a Network Load Balancer (NLB). Send the traffic to the interne! through the private IP address of the NLB

D.  

Update the main route table to send the traffic to the internet through an Elastic IP address that is assigned to each instance.

A.  

Deploy a global-scoped AWS WAF web ACL with an allow default action. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the CloudFront distribution.

B.  

Deploy an AWS WAF web ACL with an allow default action in us-east-1. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the S3 bucket.

C.  

Deploy a global-scoped AWS WAF web ACL with a block default action. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the CloudFront distribution.

D.  

Deploy an AWS WAF web ACL with a block default action in us-east-1. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the S3 bucket.

A.  

Examine the expiration date on the certificate on the origin site. Validate that the certificate has not expired. Replace the certificate if necessary.

B.  

Examine the hostname on the certificate on the origin site. Validate that the hostname matches one of the hostnames on the CloudFront distribution. Replace the certificate if necessary.

C.  

Examine the firewall rules that are associated with the origin server. Validate that port 443 is open for inbound traffic from the internet. Create an inbound rule if necessary.

D.  

Examine the network ACL rules that are associated with the CloudFront distribution. Validate that port 443 is open for outbound traffic to the origin server. Create an outbound rule if necessary.

A.  

Configure CloudWatch from the AWS Management Console tor all the instances that require monitoring by CloudWatch. AWS automatically installs and configures the agents far the specified instances.

B.  

Install and configure the CloudWatch agent on all the instances. Attach an IAM role to allow the instances to write logs to CloudWatch.

C.  

Install and configure the CloudWatch agent on all the instances. Attach an IAM user to allow the instances to write logs to CloudWatch.

D.  

Install and configure the CloudWatch agent on all the instances. Attach the necessary security groups to allow the instances to write logs to CloudWatch

A.  

Store the credentials in AWS Systems Manager Parameter Store as a secure string. Configure automatic rotation with a rotation interval of 30 days.

B.  

Store the credentials in AWS Secrets Manager. Configure automatic rotation with a rotation interval of 30 days.

C.  

Store the credentials in a file in an Amazon S3 bucket. Deploy an AWS Lambda function to automatically rotate the credentials every 30 days.

D.  

Store the credentials in AWS Secrets Manager. Deploy an AWS Lambda function to automatically rotate the credentials every 30 days.

A.  

Create an AWS Config rule that runs evaluations against configuration changes to the S3 bucket When an unencrypted object is found run an AWS Systems Manager Automation document to encrypt the object in place

B.  

Edit the properties of the S3 bucket to enable default server-side encryption

C.  

Filter the S3 Inventory report by using S3 Select to find all objects that are not encrypted Create an S3 Batch Operations job to copy each object in place with encryption enabled

D.  

Filter the S3 Inventory report by using S3 Select to find all objects that are not encrypted Send each object name as a message to an Amazon Simple Queue Service (Amazon SQS) queue Use the SQS queue to invoke an AWS Lambda function to tag each object with a key of "Encryption" and a value of "SSE-KMS"

E.  

Use S3 Event Notifications to invoke an AWS Lambda function on all new object-created events for the S3 bucket Configure the Lambda function to check whether the object is encrypted and to run an AWS Systems Manager Automation document to encrypt the object in place when an unencrypted object is found

A.  

Add Auto Discovery to the data store.

B.  

Create an Amazon ElastiCache for Memcached data store.

C.  

Create an Amazon ElastiCache for Redis data store.

D.  

Enable Multi-AZ for the data store.

E.  

Enable Multi-threading for the data store.

A.  

Review the Incomplete Multipart Upload Bytes metre in the S3 Storage Lens dashboard Create an S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days.

B.  

Implement S3 Intelligent-Tiering to move data into tower-cost storage classes after 7 days. Create an S3 Storage Lens policy to automatically delete any incomplete multipart uploads after 7 days.

C.  

Access the S3 console Review the Metrics tab to check the storage that incomplete multipart uploads are consuming. Create an AWS Lambda function to delete any incomplete multipart uploads after 7 days.

D.  

Use the S3 analytics storage class analysis tool to identify and measure incomplete multipart uploads. Configure an S3 bucket policy to enforce restrictions on multipart uploads to delete incomplete multipart uploads after 7 days.

A.  

Add an inbound rule for port 22 in the security group associated with the Ubuntu instance.

B.  

Assign the AmazonSSMManagedlnstanceCore managed policy to the EC2 instance profile for the Ubuntu instance.

C.  

Configure the SSM Agent to log in with a user name of "ubuntu".

D.  

Generate a new key pair, configure Session Manager to use this new key pair, and provide the private key to the users.

A.  

Write a script to continue backing up the RDS instance every live minutes.

B.  

Create an AWS Lambda function to take a snapshot of the RDS instance, and manually invoke the function before deleting the stack.

C.  

Use the Snapshot Deletion Policy in the Cloud Formation template definition of the RDS instance.

D.  

Create a new CloudFormallon template to perform backups of the RDS instance, and run this template before deleting the stack.