Labour Day Special 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

AWS Certified SysOps Administrator - Associate Question and Answers

AWS Certified SysOps Administrator - Associate

Last Update Apr 24, 2024
Total Questions : 263

We are offering FREE SOA-C01 Amazon Web Services exam questions. All you do is to just go and sign up. Give your details, prepare SOA-C01 free exam questions and then go for complete pool of AWS Certified SysOps Administrator - Associate test questions that will help you more.

SOA-C01 pdf

SOA-C01 PDF

$35  $99.99
SOA-C01 Engine

SOA-C01 Testing Engine

$42  $119.99
SOA-C01 PDF + Engine

SOA-C01 PDF + Testing Engine

$56  $159.99
Questions 1

A SySOps Administrator is managing an AWS account where Developers are authorized to launch Amazon EC2 instances to test new code. To limit costs, the Administrator must ensure that the EC2 instances in the account are terminated 24 hours after launch.

How should the Administrator meet these requirements?

Options:

A.  

Create an Amazon CloudWatch alarm based on the CPUUtilization metric. When the metric is 0% for 24 hours, trigger an action to terminate the EC2 instance when the alarm is triggered.

B.  

Create an AWS Lambda function to check all EC2 instances and terminate instances running more than 24 hours. Trigger the function with an Amazon CloudWatch Events event every 15 minutes.

C.  

Add an action to AWS Trusted Advisor to turn off EC2 instances based on the Low Utilization Amazon EC2 Instances check, terminating instances identified by Trusted Advisor as running for more than 24 hours.

D.  

Install the unified Amazon CloudWatch agent on every EC2 instance. Configure the agent to terminate instances after they have been running for 24 hours.

Discussion 0
Questions 2

An e-commerce company wants to lower costs on its nightly jobs that aggregate the current day’s sales and store the results in Amazon S3. The jobs are currently run using multiple on-demand instances and the job take just under 2 hours to complete. If a job fails for any reason, it needs to be restarted from the beginning.

What method is the MOST cost effective based on these requirements?

Options:

A.  

Use a mixture of On-Demand and Spot Instances for job execution.

B.  

Submit a request for a Spot block to be used for job execution.

C.  

Purchase Reserved Instances to be used for job execution.

D.  

Submit a request for a one-time Spot Instance for job execution.

Discussion 0
Questions 3

An application is being developed that will be served across a fleet of Amazon EC2 instances, which require a consistent view of persistent data. Items stored vary in size from 1 KB lo 300MB; the items are read frequently, created occasionally, and often require partial changes without conflict. The data store is not expected to grow beyond 2TB. and items will be expired according to age and content type.

Which AWS service solution meets these requirements?

Options:

A.  

Amazon S3 buckets with lifecycle policies to delete old objects

B.  

Amazon ROS PostgreSQL and a job that deletes rows based on age and file type columns.

C.  

Amazon EFS and a scheduled process to delete files based on age and extension.

D.  

An EC2 instance store synced on boot from a central Amazon EBS-backed instance.

Discussion 0
Questions 4

After launching a new Amazon EC2 instance from a Microsoft Windows 2012 Amazon Machine Image (AMI), the SysOps Administrator is unable to connect to the instance using Remote Desktop Protocol (RDP). The instance is also unreachable. As part of troubleshooting, the Administrator deploys a second instance from a different AMI using the same configuration and is able to connect to the instance.

What should be the next logical step in troubleshooting the first instance?

Options:

A.  

Use AWS Trusted Advisor to gather operating system log files for analysis.

B.  

Use VPC Flow Logs to gather operating system log files for analysis.

C.  

Use EC2Rescue to gather operating system log files for analysis.

D.  

Use Amazon metrics using Amazon CloudWatch Logs.

Discussion 0
Questions 5

A company is expanding its use of AWS services across its portfolios. The company wants to provision AWS accounts for each team to ensure a separation of business processes for security, compliance, and billing account creation and bootstrapping should be completed in a scalable and efficient way so new accounts are created with a defined baseline and governance guardrails in place. A sysops administrator needs to design a provisioning process that save time and resources.

Which action should be taken to meet these requirements?

Options:

A.  

Automate using AWS Elastic Beanstalk to provision the AWS Accounts, set up infrastructure, and integrate with AWS Organizations.

B.  

Create bootstrapping scripts in AWS OpsWorks and combine them with AWS CloudFormation templates to provision accounts and infrastructure.

C.  

Use AWS config to provision accounts and deploy instances using AWS service catalog.

D.  

Use AWS Control Tower to create a template in account factory and use the template to provision new accounts.

Discussion 0
Questions 6

An organization created an Amazon Elastic File System (Amazon EFS) volume with a file system ID of fs-85ba41fc, and it is actively used by 10 Amazon EC2 hosts. The organization has become concerned that the file system is not encrypted?

How can this be resolved?

Options:

A.  

Enable encryption on each host’s connection to the Amazon EFS volume. Each connection must be recreated for encryption to take effect.

B.  

Enable encryption on the existing EFS volume by using the AWS command line interface.

C.  

Enable encryption on each host’s local drive. Restart each host to encrypt the drive.

D.  

Enable encryption on a newly created volume and copy all data from the original volume. Reconnect each hosts to the new volume.

Discussion 0
Questions 7

A Systems Administrator is responsible for maintaining custom, approved AMIs for a company. These AMIs must be shared with each of the company’s AWS accounts.

How can the Administrator address this issue?

Options:

A.  

Contact AWS Support for sharing AMIs with other AWS accounts.

B.  

Modify the permissions on the AMIs so that they are publicly accessible.

C.  

Modify the permissions on the IAM role that are associated with the AMI.

D.  

Share the AMIs with each AWS account using the console or CLI.

Discussion 0
Questions 8

A company is planning to deploy multiple ecommerce websites across the eu-west-1, ap-east-1, and us-west-1 Regions. The websites consist of Amazon S3 buckets Amazon EC2 instances, Amazon RDS databases and Elastic Load Balancers.

Which method will accomplish the deployment with the LEAST amount of effort?

Options:

A.  

Configure deployment automation using AWS OpsWorks

B.  

Configure S3 cross-Region replication

C.  

Use AWS CloudFormation stack sets to deploy the application

D.  

Use AWS Elastic Beanstalk to deploy the application

Discussion 0
Questions 9

A SysOps Administrator is running Amazon EC2 instances in multiple AWS Regions. The Administrator wants to aggregate the CPU utilization for all instances onto an Amazon CloudWatch dashboard. Each region should be present on the dashboard and represented by a single graph that contains the CPU utilization for all instances in that region.

How can the Administrator meet these requirements?

Options:

A.  

Create a cross-region dashboard using AWS Lambda and distribute it to all regions

B.  

Create a custom CloudWatch dashboard and add a widget for each region in the AWS Management

Console

C.  

Enable cross-region dashboards under the CloudWatch section of the AWS Management Console

D.  

Switch from basic monitoring to detailed monitoring on all instances

Discussion 0
Questions 10

A company needs to run a distributed application that processes large amounts of data across multiple EC2 instances. The application is designed to tolerate processing interruptions.

What is the MOST cost-effective Amazon EC2 pricing model for these requirements?

Options:

A.  

Dedicated Hosts

B.  

On-Demand instances

C.  

Reserved instances

D.  

Spot instances

Discussion 0
Questions 11

A company's IT department noticed an increase in the spend of their Developer AWS account. There are over 50 Developers using the account and the Finance Tram wants to determine the service costs incurred by each Developer.

What should a SysOps Administrator do to collect this information? (Select TWO)

Options:

A.  

Activate the createdBy tag in the account

B.  

Analyze the usage with Amazon CloudWatch dashboards

C.  

Analyze the usage with Cost Explorer

D.  

Configure AWS Trusted Advisor to track resource usage

E.  

Create a billing alarm in AWS Budgets

Discussion 0
Questions 12

A SysOps administrator created an AWS service catalog portfolio and shared the portfolio with a second AWS account in the company. The second account is controlled by a different administrator.

Which action will the administrator of the second account be able to perform?

Options:

A.  

Add a product from the imported portfolio to a local portfolio.

B.  

Add new product to the imported portfolio.

C.  

Change the launch role for the products contained in the imported portfolio.

D.  

Remove Products from the imported portfolio.

Discussion 0
Questions 13

A company has a business application hosted on Amazon EC2 instances behind an Application Load

Balancer. Amazon CloudWatch metrics show that the CPU utilization on the EC2 instances is very high. There are also reports from users that receive HTTP 503 and 504 errors when they try to connect to the application.

Which action will resolve these issues?

Options:

A.  

Place the EC2 instances into an AWS Auto Scaling group.

B.  

Configure the ALB's Target Group to use more frequent health checks.

C.  

Enable sticky sessions on the Application Load Balancer.

D.  

Increase the idle timeout setting of the Application Load Balancer.

Discussion 0
Questions 14

A company has a multi-tier web application. In the web tier, all the servers are in private subnets inside a VPC. The development team wants to make changes to the application that requires access to Amazon S3.

What should be done to accomplish this?

Options:

A.  

Create a customer gateway to connect to Amazon S3 Modify the route table of the private subnets to use the customer gateway

B.  

Create a gateway VPC endpoint for Amazon S3 Modify the route table of the private subnets to use the gateway VPC endpoint.

C.  

Create a NAT gateway in the private subnets. Modify the route table of the subnets to use the NAT gateway.

D.  

Create an S3 bucket policy to allow connections from the private subnets. Modify the route table.

Discussion 0
Questions 15

The Accounting department would like to receive billing updates more than once a month. They would like the updates to be in a format that can easily be viewed with a spreadsheet application.

How can this request be fulfilled?

Options:

A.  

Use Amazon CloudWatch Events to schedule a billing inquiry on a bi-weekly basis. Use AWS Glue to convert the output to CSV.

B.  

Set AWS Cost and Usage Reports to publish bills daily to an Amazon S3 bucket in CSV format.

C.  

Use the AWS CLI to output billing data as JSON. Use Amazon SES to email bills on a daily basis.

D.  

Use AWS Lambda, triggered by CloudWatch, to query billing data and push to Amazon RDS.

Discussion 0
Questions 16

A company has several accounts between different teams and wants to increase its auditing and compliance capabilities The accounts are managed through AWS Organizations. Management wants to provide the security team with secure access to the account logs while also restricting the possibility for the logs to be modified.

How can a sysops administrator achieve this is with the LEAST amount of operational overhead?

Options:

A.  

Store AWS CloudTrail logs in Amazon S3 in each account Create a new account to store compliance data and replicate the objects into the newly created account

B.  

Store AWS CloudTrail logs in Amazon S3 in each account. Create an 1AM user with read-only access to the CloudTrail logs

C.  

From the master account create an organization trail using AWS CloudTrail and apply it to all Regions Use 1AM roles to restrict access.

D.  

Use an AWS CloudFormation stack set to create an AWS CloudTrail trail in every account and restrict permissions to modify the logs

Discussion 0
Questions 17

A chief financial officer has asked for a breakdown of costs per project in a single AWS account using cost explorer.

Which combination of options should be set to accomplish this? (Select two)

Options:

A.  

Active AWS Budgets.

B.  

Active cost allocation tags

C.  

Create an organization using AWS Organization

D.  

Create and apply resource tags

E.  

enable AWS trusted advisor

Discussion 0
Questions 18

A web application runs on Amazon EC2 instances and accesses external services. The external services require authentication credentials. The application is deployed using AWS CloudFormation to three separate environments development test, and production Each environment requires unique credentials for external services

What option securely provides the application with the needed credential while requiring MINIMAL administrative overhead?

Options:

A.  

Pass the credentials for the target environment to the CloudFormation template as parameters Use the user data script to insert the parameterized credentials into the EC2 instances

B.  

Store the credentials as secure strings in AWS Systems Manager Parameter Store. Pass an environment tag as a parameter to the CloudFormation template Use the user data script to insert the environment tag in the EC2 instances Access the credentials from the application

C.  

Create a separate CloudFormation template for each environment in the Resources section include a user data script for each EC2 instance Use the user data script to insert the proper credentials for the environment into the EC2 instances

D.  

Create separate Amazon Machine Images (AMIs) with the required credentials for each environment Pass the environment tag as a parameter to the CloudFormation template In the Mappings section of the CloudFormation template, map the environment tag to the proper AMI then use that AMI when launching the EC2 instances

Discussion 0
Questions 19

A company is concerned about a security vulnerability impacting its Linux operating system.

What should the SysOps Administrator do to alleviate this concern?

Options:

A.  

Patch the vulnerability with Amazon Inspector.

B.  

Provide an AWS Trusted Advisor report showing which Amazon EC2 instances have been patched.

C.  

Redeploy the Amazon EC2 instances using AWS CloudFormation.

D.  

Patch the Linux operating system using AWS Systems Manager.

Discussion 0
Questions 20

A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required. Currently, all nodes are running on demand, and the worker nodes are uses for approximately 4 hours each day.

Which combination of actions will be most cost-effective? (Select Two)

Options:

A.  

Use dedicated Hosts for the control nodes.

B.  

Use reserved instances for the control nodes.

C.  

Use reserved instances for the worker nodes.

D.  

Use spot instances for the control nodes and On-demand instances if there is no Spot availability.

E.  

Use spot instances for the worker nodes and On-demand instances if there is no spot availability.

Discussion 0
Questions 21

A SysOps Administrator needs to confirm that security best practices are being followed with the AWS account root user.

How should the Administrator ensure that this is done?

Options:

A.  

Change the root user password by using the AWS CLI routinely.

B.  

Periodically use the AWS CLI to rotate access keys and secret keys for the root user.

C.  

Use AWS Trusted Advisor security checks to review the configuration of the root user.

D.  

Periodically distribute the AWS compliance document from AWS Artifact that governs the root user configuration.

Discussion 0
Questions 22

An HTTP web application is launched on Amazon EC2 instances behind an ELB Application Load Balancer. The EC2 instances run across multiple Availability Zones. A network ACL and a security group for the load balancer and EC2 instances allow inbound traffic on port 80. After launch, the website cannot be reached over the internet.

What additional step should be taken?

Options:

A.  

Add a rule to the security group allowing outbound traffic on port 80.

B.  

Add a rule to the network ACL allowing outbound traffic on port 80.

C.  

Add a rule to the security group allowing outbound traffic on ports 1024 through 65535.

D.  

Add a rule to the network ACL allowing outbound traffic on ports 1024 through 65535.

Discussion 0
Questions 23

An application team has asked a sysops administrator to provision an additional environment for an application in four additional regions. The application is running on more than 100 instances in us-east-1, using fully baked AMIs, An AWS CloudFormation template has been created to deploy resources in us-east-1.

What must the sysops administrator do to provision the application quickly?

Options:

A.  

Copy the AMI to each region using aws ec2 copy-image Update the CloudFormation mapping include mappings for the copy AMIs.

B.  

Creating a snapshot of the running instance and copy the snapshot to the other regions. Create an AMI from the snapshots. Update the CloudFormation template for each region to use the new AMI.

C.  

Run the existing CloudFormation template in each additional region based on the success of the template used currently in us-east-1.

D.  

Update the CloudFormation template to include the additional regions in the auto scaling group. Update the existing stack in us-east-1.

Discussion 0
Questions 24

A SysOps Administrator has implemented a VPC network design with the following requirements

• Two Availability Zones (AZs) - Two private subnets

• Two public subnets

• One internet gateway

• One NAT gateway

What would potentially cause applications in the VPC to fail during an AZ outage?

Options:

A.  

A single virtual private gateway, because it can be associated with a single AZ only.

B.  

A single internet gateway, because it is not redundant across both AZs.

C.  

A single NAT gateway, because it is not redundant across both AZs

D.  

The default VPC route table, because it can be associated with a single AZ only

Discussion 0
Questions 25

An application resides on multiple EC2 instances in public subnets in two Availability Zones. To improve security, the Information Security team has deployed an Application Load Balancer (ALB) in separate subnets and pointed the DNS at the ALB instead of the EC2 instances.

After the change, traffic is not reaching the instances, and an error is being returned from the ALB.

What steps must a SysOps Administrator take to resolve this issue and improve the security of the application? (Select TWO.)

Options:

A.  

Add the EC2 instances to the ALB target group, configure the health check, and ensure that the instances report healthy.

B.  

Add the EC2 instances to an Auto Scaling group, configure the health check to ensure that the instances report healthy, and remove the public IPs from the instances.

C.  

Create a new subnet in which EC2 instances and ALB will reside to ensure that they can communicate, and remove the public IPs from the instances.

D.  

Change the security group for the EC2 instances to allow access from only the ALB security group, and remove the public IPs from the instances.

E.  

Change the security group to allow access from 0.0.0.0/0, which permits access from the ALB.

Discussion 0
Questions 26

A SysOps Administrator has been tasked with deploying a company’s infrastructure as code. The Administrator wants to write a single template that can be reused for multiple environments in a safe, repeatable manner.

What is the recommended way to use AWS CloudFormation to meet this requirement?

Options:

A.  

Use parameters to provision the resources.

B.  

Use nested stacks to provision the resources.

C.  

Use Amazon EC2 user data to provision the resources.

D.  

Use stack policies to provision the resources.

Discussion 0
Questions 27

A SysOps Administrator has an AWS CloudFormation template of the company’s existing infrastructure in us-west-2. The Administrator attempts to use the template to launch a new stack in eu-west-1, but the stack only partially deploys, receives an error message, and then rolls back.

Why would this template fail to deploy? (Choose two.)

Options:

A.  

The template referenced an IAM user that is not available in eu-west-1

B.  

The template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1

C.  

The template did not have the proper level of permissions to deploy the resources

D.  

The template requested services that do not exist in eu-west-1

E.  

CloudFormation templates can be used only to update existing services

Discussion 0
Questions 28

A web application accepts orders from online users and places the orders into an Amazon SQS queue. Amazon EC2 instances in an EC2 Auto Scaling group read the messages from the queue, process the orders, and email order confirmations to the users. The Auto Scaling group scales up and down based on the queue depth. At the beginning of each business day, users report confirmation emails are delayed.

What action will address this issue?

Options:

A.  

Create a scheduled scaling action to scale up in anticipation of the traffic.

B.  

Change the Auto Scaling group to scale up and down based on CPU utilization.

C.  

Change the launch configuration to launch larger EC2 instance types.

D.  

Modify the scaling policy to deploy more EC2 instances when scaling up.

Discussion 0
Questions 29

A company wants to identify specific Amazon EC2 instances that ate underutilized and the estimated cost savings for each instance How can this be done with MINIMAL effort?

Options:

A.  

Use AWS Budgets to report on low utilization of EC2 instances.

B.  

Run an AWS Systems Manager script to check for low memory utilization of EC2 instances.

C.  

Run Cost Explorer to look for low utilization of EC2 instances.

D.  

Use Amazon CloudWatch metrics to identify EC2 instances with low utilization.

Discussion 0
Questions 30

A security researcher has published a new Common Vulnerabilities and Exposures (CVE) report that impacts a popular operating system A SysOps Administrator is concerned with the new CVE report and wants to patch the company's systems immediately The Administrator contacts AWS Support and requests the patch be applied to all Amazon EC2 instances

How will AWS respond to this request?

Options:

A.  

AWS will apply the patch during the next maintenance window and will provide the Administrator with a report of all patched EC2 instances

B.  

AWS will relaunch the EC2 instances with the latest version of the Amazon Machine Image (AMI) and will provide the Administrator with a report of all patched EC2 instances

C.  

AWS will research the vulnerability to see if the Administrator's operating system is impacted and will patch the EC2 instances that are affected

D.  

AWS will review the shared responsibility model with the Administrator and advise them regarding how to patch the EC2 instances

Discussion 0
Questions 31

A SysOps Administrator working on an Amazon EC2 instance has misconfigured the clock by one hour. The EC2 instance is sending data to Amazon CloudWatch through the CloudWatch agent. The timestamps on the logs are 45 minutes in the future.

What will be the result of this configuration?

Options:

A.  

Amazon CloudWatch will not capture the data because it is in the future.

B.  

Amazon CloudWatch will accept the custom metric data and record it.

C.  

The Amazon CloudWatch agent will check the Network Time Protocol (NTP) server before sending the data, and the agent will correct the time.

D.  

The Amazon CloudWatch agent will agent check the Network Time Protocol (NTP) server, and the agent will not send the data because it is more than 30 minutes in the future.

Discussion 0
Questions 32

A medical imaging company needs lo process large amounts of imaging data in real time using a specific instance type. The company wants to guarantee sufficient resource capacity for 1 year

Which action will meet these requirements in the MOST cost-effective manner?

Options:

A.  

Create 1-year On-Demand Capacity Reservations in the specific Availability Zones

B.  

Launch Amazon EC2 instances with termination protection enabled

C.  

Purchase 1 -year Reserved Instances in the specific Availability Zones

D.  

Use a Spot Fleet across multiple Availability Zones

Discussion 0
Questions 33

A company manages multiple AWS accounts and wants to provide access to AWS from a single management account using an existing on-premises Microsoft Active Directory domain. Which solution will meet these requirements with the LEAST amount of effort?

Options:

A.  

Create an Active Directory connector using AWS Directory Service. Create 1AM users in the target accounts with the appropriate trust policy.

B.  

Create an Active Directory connector using AWS Directory Service. Associate the directory with AWS Single Sign-On (AWS SSO). Configure user access to target accounts through AWS SSO.

C.  

Create an Amazon Cognito federated identity pool. Associate the pool identity with the on-premises directory. Configure the 1AM roles with the appropriate trust policy,

D.  

Create an identity provider in AWS 1AM associated with the on-premises directory. Create 1AM roles in the target accounts with the appropriate trust policy.

Discussion 0
Questions 34

A company monitors its account activity using AWS CloudTrail, and is concerned that some log files are being tampered with after the logs have been delivered to the account’s Amazon S3 bucket.

Moving forward, how can the SysOps Administrator confirm that the log files have not been modified after being delivered to the S3 bucket.

Options:

A.  

Stream the CloudTrail logs to Amazon CloudWatch to store logs at a secondary location.

B.  

Enable log file integrity validation and use digest files to verify the hash value of the log file.

C.  

Replicate the S3 log bucket across regions, and encrypt log files with S3 managed keys.

D.  

Enable S3 server access logging to track requests made to the log bucket for security audits.

Discussion 0
Questions 35

A Security and Compliance team is reviewing Amazon EC2 workloads for unapproved AMI usage.

Which action should a SysOps Administrator recommend?

Options:

A.  

Create a custom report using AWS Systems Manager Inventory to identify unapproved AMIs

B.  

Run Amazon Inspector on all EC2 instances and flag instances using unapproved AMIs

C.  

Use an AWS Config rule to identify unapproved AMIs

D.  

Use AWS Trusted Advisor to identify EC2 workloads using unapproved AMIs

Discussion 0
Questions 36

A company needs to ensure that all IAM users rotate their password on a regular basis.

Which action should be taken to implement this?

Options:

A.  

Configure multi-factor authentication for all IAM users.

B.  

Deactivate existing users and re-create new users every time a credential rotation is required.

C.  

Re-create identity federation with new identity providers every time a credential rotation is required

D.  

Set up a password policy to enable password of expiration for IAM users.

Discussion 0
Questions 37

A SysOps administrator needs to register targets for a Network Load Balancer (NL8) using IP addresses Which prerequisite should the SysOps administrator validate to perform this task?

Options:

A.  

Ensure the NLB listener security policy is set to ELBSecuntyPohcy-TLS-1-2-Ext-2018-06, ELBSecuntyPolicy-FS-1-2-Res-2019-08 or ELBSecuntyPolicy-TLS-1-0-2015-04

B.  

Ensure the heath check setting on the NLB for the Matcher configuration is between 200 and 399

C.  

Ensure the targets are within any of these CIDR blocks: 10.0.0.0/8 (RFC I918)r 100.64.0.0/10 (RFC 6598): 172.16.0.0/12 (RFC 1918), or 192.168.0.0/16 (RFC 1918).

D.  

Ensure the NLB is exposed as an endpoint service before registering the targets using IP addresses

Discussion 0
Questions 38

A popular auctioning platform requires near-real-time access to dynamic bidding information. The platform must be available at all times The current Amazon RDS instance often reaches 100% CPU utilization during the weekend auction and can no longer be resized. To improve application performance, a sysops administrator is evaluating Amazon ElastiCache and has chosen Redis (cluster mode enabled) instead of Memcached

What are reasons for making this choice? (Select TWO.)

Options:

A.  

Data partitioning

B.  

Multi-threaded processing

C.  

Multi-AZ with automatic failover

D.  

Multi-region with automatic failover

E.  

Online resharding

Discussion 0
Questions 39

A SysOps administrator implemented the following bucket policy to allow only the corporate IP address range of 54.240.143.0/24 to access objects in an Amazon S3 bucket.

Some employees are reporting that they are able to access the S3 bucket from IP addresses outside the corporate IP address range.

How can the Administrator address this issue?

Options:

A.  

Modify the Condition operator to include both NotIpAddress and IpAddress to prevent unauthorized access to the S3 bucket.

B.  

Modify the Condition element from the IAM policy to aws:StringEquals instead of aws:SourceIp.

C.  

Modify the IAM policy instead of the bucket policy to restrict users from accessing the bucket based on their source IP addresses.

D.  

Change Effect from Allow to Deny in the second statement of the policy to deny requests not from the source IP range.

Discussion 0