Download AWS Certified SysOps Administrator - Associate.SOA-C02.CertDumps.2025-06-28.276q.tqb

Vendor: Amazon
Exam Code: SOA-C02
Exam Name: AWS Certified SysOps Administrator - Associate
Date: Jun 28, 2025
File Size: 2 MB
Download Exam

How to open TQB files?

Files with TQB (Taurus Question Bank) extension can be opened by Taurus Exam Studio.

Download
Taurus Exam Studio

Purchase
Coupon: TAURUSSIM_20OFF

Discount: 20%

Taurus Exam Simulator Taurus Exam Simulator Taurus Exam Simulator Taurus Exam Simulator Taurus Exam Simulator

Demo Questions

Question 1
An Amazon EC2 instance needs to be reachable from the internet. The EC2 instance is in a subnet with the following route table. Which entry must a SysOps administrator add to the route table to meet this requirement?
  1. A route for `0.0.0.0/0` that points to a NAT gateway.
  2. A route for `0.0.0.0/0` that points to an egress-only internet gateway.
  3. A route for `0.0.0.0/0` that points to an internet gateway.
  4. A route for `0.0.0.0/0` that points to an elastic network interface.
Correct answer: C
Question 2
A SysOps administrator launches an Amazon EC2 instance in a private subnet of a VPC. When the SysOps administrator attempts a curl command from the command line of the EC2 instance, the SysOps administrator cannot connect to https:www.example.com. What should the SysOps administrator do to resolve this issue?
  1. Ensure that there is an outbound security group for port `443` to `0.0.0.0/0`.
  2. Ensure that there is an inbound security group for port `443` from `0.0.0.0/0`.
  3. Ensure that there is an outbound network ACL for ephemeral ports `1024-66535` to `0.0.0.0/0`.
  4. Ensure that there is an outbound network ACL for port `80` to `0.0.0.0/0`.
Correct answer: A
Question 3
A company's public website is hosted in an Amazon S3 bucket in the `us-east-1` Region behind an Amazon CloudFront distribution. The company wants to ensure that the website is protected from DDoS attacks. A SysOps administrator needs to deploy a solution that gives the company the ability to maintain control over the rate limit at which DDoS protections are applied. Which solution will meet these requirements?
  1. Deploy a global-scoped AWS WAF web ACL with an allow default action. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the CloudFront distribution.
  2. Deploy an AWS WAF web ACL with an allow default action in `us-east-1`. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the S3 bucket.
  3. Deploy a global-scoped AWS WAF web ACL with a block default action. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the CloudFront distribution.
  4. Deploy an AWS WAF web ACL with a block default action in `us-east-1`. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the S3 bucket.
Correct answer: A
Question 4
A company hosts an online shopping portal in the AWS Cloud. The portal provides HTTPS security by using a TLS certificate on an Elastic Load Balancer (ELB). Recently, the portal suffered an outage because the TLS certificate expired. A SysOps administrator must create a solution to automatically renew certificates to avoid this issue in the future. What is the MOST operationally efficient solution that meets these requirements?
  1. Request a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. Write a scheduled AWS Lambda function to renew the certificate every 18 months.
  2. Request a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
  3. Register a certificate with a third-party certificate authority (CA). Import this certificate into AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
  4. Register a certificate with a third-party certificate authority (CA). Configure the ELB to import the certificate directly from the CA. Set the certificate refresh cycle on the ELB to refresh when the certificate is within 3 months of the expiration date.
Correct answer: B
Question 5
With the threat of ransomware viruses encrypting and holding company data hostage, which action should be taken to protect an Amazon S3 bucket?
  1. Deny Post. Put. and Delete on the bucket.
  2. Enable server-side encryption on the bucket.
  3. Enable Amazon S3 versioning on the bucket.
  4. Enable snapshots on the bucket.
Correct answer: B
Question 6
A company is partnering with an external vendor to provide data processing services. For this integration, the vendor must host the company's data in an Amazon S3 bucket in the vendor's AWS account. The vendor is allowing the company to provide an AWS Key Management Service (AWS KMS) key to encrypt the company's data. The vendor has provided an IAM role Amazon Resources Name (ARN) to the company for this integration. What should a SysOps administrator do to configure this integration?
  1. Create a new KMS key. Add the vendor's IAM role ARN to the KMS key policy. Provide the new KMS key ARN to the vendor.
  2. Create a new KMS key. Create a new IAM user. Add the vendor's IAM role ARN to an inline policy that is attached to the IAM user. Provide the new IAM user ARN to the vendor.
  3. Configure encryption using the KMS managed S3 key. Add the vendor's IAM role ARN to the KMS managed S3 key policy. Provide the KMS managed S3 key ARN to the vendor.
  4. Configure encryption using the KMS managed S3 key. Create an S3 bucket. Add the vendor's IAM role ARN to the S3 bucket policy. Provide the S3 bucket ARN to the vendor.
Correct answer: A
Question 7
A database is running on an Amazon RDS Multi-AZ DB instance. A recent security audit found the database to be out of compliance because it was not encrypted. Which approach will resolve the encryption requirement?
  1. Log in to the RDS console and select the encryption box to encrypt the database.
  2. Create a new encrypted Amazon EBS volume and attach it to the instance.
  3. Encrypt the standby replica in the secondary Availability Zone and promote it to the primary instance.
  4. Take a snapshot of the RDS instance, copy and encrypt the snapshot, and then restore to the new RDS instance.
Correct answer: D
Question 8
A SysOps administrator receives an alert from Amazon GuardDuty about suspicious network activity on an Amazon FC2 instance. The GuardDuty finding lists a new external IP address as a traffic destination. The SysOps administrator does not recognize the external IP address. The SysOps administrator must block traffic to the external IP address that GuardDuty identified Which solution will meet this requirement?
  1. Create a new security group to block traffic to the external IP address. Assign the new security group to the EC2 instance.
  2. Use VPC flow logs with Amazon Athena to block traffic to the external IP address.
  3. Create a network ACL Add an outbound deny rule tor traffic to the external IP address.
  4. Create a new security group to block traffic to the external IP address Assign the new security group to the entire VPC.
Correct answer: C
Question 9
A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A SysOps administrator notices that some of these EC2 instances show up as healthy in the Auto Scaling group but show up as unhealthy in the ALB target group. What is a possible reason for this issue?
  1. Security groups are not allowing traffic between the ALB and the failing EC2 instances.
  2. The Auto Scaling group health check is configured for EC2 status checks.
  3. The EC2 instances are failing to launch and failing EC2 status checks.
  4. The target group health check is configured with an incorrect port or path.
Correct answer: D
Question 10
A SysOps administrator has enabled AWS CloudTrail in an AWS account. If CloudTrail is disabled, it must be re-enabled immediately. What should the SysOps administrator do to meet these requirements WITHOUT writing custom code?
  1. Add the AWS account to AWS Organizations. Enable CloudTrail in the management account.
  2. Create an AWS Config rule that is invoked when CloudTrail configuration changes.Apply the `AWS-ConfigureCloudTrailLogging` automatic remediation action.
  3. Create an AWS Config rule that is invoked when CloudTrail configuration changes.Configure the rule to invoke an AWS Lambda function to enable CloudTrail.
  4. Create an Amazon EventBridge (Amazon CloudWatch Events) hourly rule with a schedule pattern to run an AWS Systems Manager Automation document to enable CloudTrail.
Correct answer: B
CONNECT US
HOW TO OPEN VCE FILES

Use VCE Exam Simulator to open VCE files
Avanaset

HOW TO OPEN VCEX FILES

Use ProfExam Simulator to open VCEX files
ProfExam Screen

ProfExam
ProfExam at a 20% markdown

You have the opportunity to purchase ProfExam at a 20% reduced price

Get Now!