Get Amazon SOA-C02 Exam Dumps

Answer : A

Modifying the DB instance to a Multi-AZ deployment is the recommended solution for failover and high availability in RDS. Multi-AZ RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone, allowing automatic failover in case of an instance or Availability Zone failure.

Multi-AZ Deployment: Provides resilience with automatic failover and minimizes application downtime.

No Application Changes Needed: Multi-AZ is managed by AWS, so the failover is transparent to the application.

Read replicas and Auto Scaling groups do not provide automatic failover for write operations, and RDS Proxy only improves connection management rather than high availability.

Answer : B

Using ALB health checks in the Auto Scaling group will provide more accurate health monitoring and replace instances if they are unhealthy.

ALB Health Checks: Configure health checks based on HTTP response codes, which will detect application-level issues causing the HTTP 500 errors and replace instances as needed.

EC2 vs. ALB Health Checks: EC2 status checks only verify instance hardware and OS, not the application's responsiveness. By using ALB health checks, Auto Scaling can remove instances that are failing at the application level, thus preventing users from receiving 500 errors.

Replacing the ALB with a Network Load Balancer does not address HTTP 500 errors, and enabling session affinity does not resolve application health issues. The CloudWatch agent would not provide the required health check functionality for automated instance replacement.

Answer : A

To prevent accounts from leaving an AWS Organization, an SCP that denies the LeaveOrganization action should be applied to the root organizational unit (OU).

Service Control Policy (SCP): By denying LeaveOrganization, member accounts are restricted from leaving the organization.

Root OU Application: Applying this policy at the root level ensures that no account in the organization can bypass it.

The RemoveAccountFromOrganization action pertains to removing an account by the organization's management account rather than preventing member accounts from leaving. AWS Config's account-part-of-organizations rule does not enforce this restriction but only monitors it.

Answer : A

Cluster placement groups are designed to place EC2 instances close together within a single Availability Zone, which reduces latency and maximizes network performance between instances.

Cluster Placement Group: Reduces network latency by keeping instances in close proximity within the same hardware, providing low-latency, high-throughput networking.

High Network Performance: Ideal for latency-sensitive applications, especially those running within a clustered architecture.

Spread placement groups are designed for high availability rather than low latency. Jumbo frames may improve throughput but not significantly reduce latency.

Answer : B, D

To monitor and remediate open SSH ports, AWS Config and Systems Manager Automation are ideal:

AWS Config Rule: Use AWS Config to monitor security groups and detect when SSH (port 22) is open to the public. Config rules can be set up to trigger remediation actions automatically.

Systems Manager Automation Runbook: Create or use a predefined automation runbook that can remove the open SSH rule from security groups, thus closing port 22 to the public.

CloudWatch alarms are not ideal for monitoring security group configurations. Amazon Inspector focuses on vulnerability assessment rather than continuous monitoring for specific port access.