Amazon SOA-C02 AWS Certified SysOps Administrator - Associate Exam Practice Test

Answer : D

Objective:

Enforce corporate policy to prevent the creation of EC2 instances in unauthorized AWS Regions.

Using Service Control Policies (SCPs):

SCPs are an AWS Organizations feature that allow centralized control over permissions for all accounts in the organization.

By attaching an SCP to the root level of the organization, you can enforce the restriction across all accounts.

Solution Implementation:

Step 1: Open the AWS Organizations console.

Step 2: Create a new SCP with the following policy:

{

'Version': '2012-10-17',

'Statement': [

{

'Effect': 'Deny',

'Action': 'ec2:RunInstances',

'Resource': '*',

'Condition': {

'StringNotEquals': {

'aws:RequestedRegion': [

'us-east-1',

'us-west-2'

]

}

}

}

]

}

Replace 'us-east-1' and 'us-west-2' with the allowed Regions.

Step 3: Attach the SCP to the root level of the organization.

AWS Reference:

Service Control Policies (SCPs): SCP Best Practices

Restricting EC2 Regions with SCP: SCP Examples

Why Other Options Are Incorrect:

Option A: CloudTrail and EventBridge with Lambda are operationally less efficient and reactive rather than preventative.

Option B: IAM policies applied at the account level require manual configuration for each account, which is less efficient.

Option C: Permissions boundaries are more suited for controlling specific IAM user or role actions, not account-wide restrictions.

Topic 2, Simulation

Answer : D

Problem Analysis:

The Cache-Control header (max-age=1 hour) conflicts with the CloudFront Maximum TTL setting (5 minutes).

CloudFront adheres to the lower of the two settings, leading to assets being cached for only 5 minutes.

Understanding Cache Behavior in CloudFront:

CloudFront evaluates headers such as Cache-Control and Expires along with its TTL settings.

The effective cache duration is the minimum value among these settings.

Resolution:

Align the Cache-Control max-age header and CloudFront Maximum TTL settings:

Update the CloudFront behavior to use a consistent value (e.g., set both to 1 hour).

Why Other Options Are Incorrect:

A: The Expires header value is irrelevant as CloudFront primarily considers Cache-Control and TTL settings.

B: The issue is not about expiring cached assets but about the duration of cache retention.

C: Cache invalidation is not required as it addresses purging specific objects from cache.

Amazon CloudFront Caching

Cache Behavior Settings in CloudFront

Answer : C, D

Problem Analysis:

The CloudWatch agent configuration is inconsistent across instances.

A centralized and automated mechanism is needed for consistent configuration management.

Action: Store Configuration in Systems Manager Parameter Store:

Parameter Store allows for secure, centralized storage of configuration files.

Steps:

Open Systems Manager Console.

Navigate to Parameter Store.

Create a parameter with the CloudWatch agent configuration file content.

Action: Use State Manager to Apply Configuration:

Systems Manager State Manager automates repetitive tasks such as ensuring consistent configuration.

Steps:

Open State Manager Console.

Create an association using the AmazonCloudWatch-ManageAgent document.

Configure the document to use Parameter Store as the configuration source.

Use tags (key = 'OS', value = 'Windows') to target the Windows EC2 instances.

Why Other Options Are Incorrect:

A: Using an S3 bucket for configuration storage lacks integration with Systems Manager for automation.

B: OpsCenter is for managing operational issues, not configuration files.

E: S3 as a configuration source is valid but introduces additional operational complexity compared to Parameter Store.

AWS Systems Manager Parameter Store

AWS State Manager Documentation

CloudWatch Agent Management

Answer : B, D

Problem Analysis:

Users experience consistent forced logouts, indicating session data is not maintained properly.

Causes may include issues with session persistence between CloudFront, ALB, and the backend servers.

Action: Configure Cookie Forwarding in CloudFront:

CloudFront must forward cookies to maintain session state. Without forwarding cookies, session-specific data cannot reach the backend.

Update the Cache Behavior Settings in CloudFront:

Go to the CloudFront distribution settings.

In Cache Behaviors, select Forward Cookies.

Specify the relevant cookies required by the application.

Action: Enable Group-Level Stickiness in ALB:

Group-level stickiness ensures that a user's session consistently maps to the same backend server, preventing session disruption.

Steps:

Open the ALB Console.

Navigate to the Listener Rules.

Enable Group-Level Stickiness for the target groups under the listener rule settings.

Why Other Options Are Incorrect:

A: Changing to the least outstanding requests algorithm will not address session stickiness issues.

C: Forwarding headers does not resolve session-specific problems caused by cookies not being forwarded.

E: Weighted target groups manage traffic distribution but do not address session persistence.

Amazon CloudFront Cookie Forwarding

ALB Sticky Sessions Documentation

Answer : A

* Objective:

Publish VPC flow logs to Amazon CloudWatch Logs.

* Root Cause:

VPC flow logs require an IAM role with permissions to create log groups, log streams, and write logs to CloudWatch Logs.

If the logs:CreateLogGroup permission is missing, the flow log cannot create the required log group, and logs will not appear in CloudWatch.

* Solution Implementation:

Step 1: Verify the IAM role attached to the VPC flow logs.

Step 2: Add the following permissions to the IAM policy:

logs:CreateLogGroup

logs:CreateLogStream

logs:PutLogEvents

Step 3: Update the IAM role policy and retry creating flow logs.

* AWS Reference:

VPC Flow Logs Permissions: Permissions for VPC Flow Logs

* Why Other Options Are Incorrect:

Option B: logs:CreateExportTask is for exporting logs from CloudWatch to S3, not for creating log groups.

Option C: IPv6 addresses do not impact the publishing of flow logs to CloudWatch Logs.

Option D: VPC peering does not block flow log functionality.

Answer : D

Objective:

Notify administrators via email whenever a root user sign-in event occurs.

Using Amazon EventBridge and Amazon SNS:

EventBridge: Captures the root user sign-in events from AWS CloudTrail.

SNS: Publishes email notifications to subscribed recipients.

Steps to Implement:

Step 1: Enable CloudTrail for management events if not already enabled.

Step 2: Create an EventBridge rule:

Event pattern:

{

'source': ['aws.signin'],

'detail-type': ['AWS Console Sign In via Root Account']

}

Step 3: Set the rule target to an SNS topic.

Step 4: Subscribe email addresses to the SNS topic.

AWS Reference:

EventBridge Rules: Creating EventBridge Rules

SNS Subscriptions: Amazon SNS Subscriptions

Why Other Options Are Incorrect:

Option A: Trusted Advisor does not directly send notifications for root sign-ins.

Option B: Using an EC2 instance and scripts is less efficient and not operationally optimized.

Option C: Sending notifications to SQS introduces unnecessary complexity and delays.

Answer : A

Objective:

Resolve the failure of the CloudFormation Auto Scaling group resource creation due to a missing wait condition signal.

cfn-signal:

The cfn-signal command is used in user data scripts to signal CloudFormation that the resource has been successfully created or configured.

This ensures the stack creation process continues as expected.

Steps to Implement:

At the end of the user data script in the EC2 launch template:

Add the command: cfn-signal --stack <stack-name> --resource <resource-name> --region <region>

Replace <stack-name>, <resource-name>, and <region> with appropriate values.

AWS Reference:

cfn-signal: Using cfn-signal to Signal Completion

Why Other Options Are Incorrect:

Option B: While port 443 is necessary for CloudFormation signaling, the main issue is the absence of cfn-signal.

Option C: Reducing DesiredCapacity may bypass the error but does not solve the root cause.

Option D: Associating a public IP may help connectivity but is unrelated to the wait condition.