最新Amazon Associate SOA-C03考試題庫，Amazon SOA-C03課程的擬真試題下載

問題1
A company is storing backups in an Amazon S3 bucket. These backups must not be deleted for at least 3 months after creation.
What should the CloudOps engineer do?

A. Enable S3 Versioning on the existing S3 bucket. Configure S3 Lifecycle rules to protect the backups.

B. Configure an IAM policy that denies the s3:DeleteObject action for all users. Three months after an object is written, remove the policy.

C. Enable S3 Object Lock on a new S3 bucket in governance mode. Place all backups in the new S3 bucket with a retention period of 3 months.

D. Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.

正確答案: D

說明：（僅 NewDumps 成員可見）

問題2
A company moves workloads from public subnets to private subnets to improve security. During testing, the company discovers that servers in the private subnets cannot reach an external API. The VPC has a CIDR block of 10.0.0.0/16. The VPC contains two public subnets and two private subnets. The VPC has one internet gateway and has a NAT gateway in each of the private subnets.
The company must ensure that workloads that run in the private subnets can reach the external API.
Which solution will meet this requirement?

A. Create and configure an Amazon API Gateway HTTP API as a proxy for the external API. Edit the route tables to direct outbound traffic to the HTTP API.

B. Deploy a new NAT gateway that has an Elastic IP address in each public subnet. Edit the route tables to direct outbound traffic through the NAT gateways.

C. Deploy an outbound-only internet gateway to allow traffic from private subnets to the internet. Edit the route tables to direct outbound traffic through the outbound-only internet gateway.

D. Create a VPC interface endpoint. Edit the route tables to direct outbound traffic through the endpoint.

正確答案: B

說明：（僅 NewDumps 成員可見）

問題3
A CloudOps engineer wants to provide access to AWS services by attaching an IAM policy to multiple IAM users. The CloudOps engineer also wants to be able to change the policy and create new versions.
Which combination of actions will meet these requirements? (Select TWO.)

A. Create an inline policy.

B. Add the users to an IAM user group. Attach the policy to the group.

C. Create a customer managed policy.

D. Add the users to an IAM service-linked role. Attach the policy to the role.

E. Create an AWS managed policy.

正確答案: B,C

說明：（僅 NewDumps 成員可見）

問題4
A CloudOps engineer is maintaining a web application that uses an Amazon CloudFront web distribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All services have logging enabled. The CloudOps engineer needs to investigate HTTP Layer 7 status codes from the web application.
Which log sources contain the status codes? (Select TWO.)

A. AWS CloudTrail logs

B. RDS logs

C. ALB access logs

D. VPC Flow Logs

E. CloudFront access logs

正確答案: C,E

說明：（僅 NewDumps 成員可見）

問題5
A company is using an Amazon Aurora MySQL DB cluster that has point-in-time recovery, backtracking, and automatic backup enabled. A CloudOps engineer needs to roll back the DB cluster to a specific recovery point within the previous 72 hours. Restores must be completed in the same production DB cluster.
Which solution will meet these requirements?

A. Use backtracking to rewind the existing DB cluster to the desired recovery point.

B. Create an Aurora Replica. Promote the replica to replace the primary DB instance.

C. Use point-in-time recovery to restore the existing DB cluster to the desired recovery point.

D. Create an AWS Lambda function to restore an automatic backup to the existing DB cluster.

正確答案: A

說明：（僅 NewDumps 成員可見）

問題6
A company hosts a database on an Amazon RDS Multi-AZ DB instance. The database is not encrypted. The company's new security policy requires all AWS resources to be encrypted at rest and in transit.
What should a CloudOps engineer do to encrypt the database?

A. Take a snapshot of the DB instance. Copy and encrypt the snapshot. Create a new DB instance by restoring the encrypted copy.

B. Take a snapshot of the DB instance. Encrypt the snapshot. Restore the snapshot to the same DB instance.

C. Configure encryption on the existing DB instance.

D. Encrypt the standby replica in a secondary Availability Zone. Promote the standby replica to the primary DB instance.

正確答案: A

說明：（僅 NewDumps 成員可見）

問題7
A company is storing backups in an Amazon S3 bucket. The backups must not be deleted for at least 3 months after the backups are created.
What should a CloudOps engineer do to meet this requirement?

A. Enable S3 Versioning on the existing S3 bucket. Configure S3 Lifecycle rules to protect the backups.

B. Configure an IAM policy that denies the s3:DeleteObject action for all users. Remove the policy after three months.

C. Enable S3 Object Lock on a new S3 bucket in governance mode. Place all backups in the new S3 bucket with a retention period of 3 months.

D. Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.

正確答案: D

說明：（僅 NewDumps 成員可見）

問題8
A company's Amazon EC2 instance with high CPU utilization is a t3.large instance running a test web app.
The company determines the app would run better on a compute-optimized large instance.
What should the CloudOps engineer do?

A. Enable hibernation on the EC2 instance. Change the instance type to a compute optimized instance.
Disable hibernation on the EC2 instance.

B. Stop the EC2 instance. Change the instance type to a compute optimized instance. Start the EC2 instance.

C. Change the instance type to a compute optimized instance while the EC2 instance is running.

D. Migrate the EC2 instance to a compute optimized instance by using AWS VM Import/Export.

正確答案: B

說明：（僅 NewDumps 成員可見）

問題9
A CloudOps engineer is troubleshooting a website that will not load for users. The website is hosted by an Amazon CloudFront distribution that has an Amazon S3 bucket as the origin. The CloudFront distribution is named d111111abcdef8.cloudfront.net. The S3 bucket has the following Amazon Resource Name (ARN): arn:
aws:s3:::example-com-website-files. The S3 bucket has S3 Block Public Access enabled. The CloudOps engineer examines the website ' s DNS CNAME records and discovers that the record value is set to s3.
amazonaws.com/example-com-website-files/.
What should the CloudOps engineer do to configure the website for use with CloudFront?

A. Disable S3 Block Public Access on the S3 bucket.

B. Modify the value of the DNS CNAME record to be d111111abcdef8.cloudfront.net instead of the S3 URL.

C. Create an S3 access point in the same AWS Region where the S3 bucket is located. Configure the access point policy to allow CloudFront to read from the S3 bucket. Point the CNAME record to the S3 access point name.

D. Modify the value of the DNS CNAME record to be arn:aws:s3:::example-com-website-files instead of the S3 URL.

正確答案: B

說明：（僅 NewDumps 成員可見）

問題10
A company runs applications on Amazon EC2 instances. The company wants to ensure that SSH ports on the EC2 instances are never open. The company has enabled AWS Config and has set up the restricted-ssh AWS managed rule.
A CloudOps engineer must implement a solution to remediate SSH port access for noncompliant security groups.
What should the engineer do to meet this requirement with the MOST operational efficiency?

A. Configure the AWS Config rule to identify noncompliant security groups. Manually update each noncompliant security group to remove the Allow rule.

B. Configure the AWS Config rule to identify noncompliant security groups. Configure the rule to use the AWS-PublishSNSNotification AWS Systems Manager Automation runbook to send notifications about noncompliant resources.

C. Make an AWS Config API call to search for noncompliant security groups. Disable SSH access for noncompliant security groups by using a Deny rule.

D. Configure the AWS Config rule to identify noncompliant security groups. Configure the rule to use the AWS-DisableIncomingSSHOnPort22 AWS Systems Manager Automation runbook to remediate noncompliant resources.

正確答案: D

說明：（僅 NewDumps 成員可見）

問題11
A company is running workloads on premises and on AWS. A CloudOps engineer needs to automate tasks across all servers on premises by using AWS services. The CloudOps engineer must not install long-term credentials on the on-premises servers.
What should the CloudOps engineer do to meet these requirements?

A. Create an IAM role and instance profile that include AWS Systems Manager permissions. Attach the role to the on-premises servers.

B. Create an IAM user and an access key. Log on to the on-premises servers and install the AWS CLI.Configure the access key in the AWS credentials file after the AWS CLI is successfully installed.

C. Create a managed-instance activation in AWS Systems Manager. Install the Systems Manager Agent on the on-premises servers. Register the servers with the activation code and ID from the managed- instance activation.

D. Create an AWS managed IAM policy that includes the appropriate AWS Systems Manager permissions. Download the IAM policy to the on-premises servers.

正確答案: C

說明：（僅 NewDumps 成員可見）

先試後買

購買之前，你可以先嘗試下載一個試用版本。目前我們只提供PDF版本的試用DEMO，軟件版本只提供截圖。

專業認證

品質保證

輕松通過

Try Before Buy

最新的真實試題

相關鏈接

聯繫我們