Amazon SOA-C03 問題集

質問 1：
A CloudOps engineer needs to create a report that shows how many bytes are sent to and received from each target group member for an Application Load Balancer (ALB).
Which combination of steps should the CloudOps engineer take to meet these requirements? (Select TWO.)
A. Enable access logging for the ALB. Save the logs to an Amazon S3 bucket.
B. Use Amazon Athena to query the ALB logs. Query the table. Use the received_bytes and sent_bytes fields to calculate the total bytes grouped by the target and port fields.
C. Install the Amazon CloudWatch agent on the instances in the target group.
D. Create an Amazon CloudWatch dashboard that shows the Sum statistic of the ProcessedBytes metric for the ALB.
E. Use Amazon Athena to query the ALB logs. Query the table. Use the received_bytes and sent_bytes fields to calculate the total bytes grouped by the client port field.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A company runs a critical application by using Amazon DynamoDB. During a recent deployment, the application accidentally wrote incorrect data to a DynamoDB table. The table has point-in-time recovery (PITR) enabled with continuous backups. DynamoDB Streams is enabled on the table. The company's recovery point objective (RPO) is 2 minutes.
A CloudOps engineer must restore the table to its state from 2 minutes before the corruption occurred.
Which solution will meet these requirements?
A. Use PITR to restore the table to 2 minutes before the incorrect data was written. Update the existing table in place.
B. Restore the most recent on-demand snapshot. Use DynamoDB Streams to replay all transactions since the snapshot was taken.
C. Create a new table by using PITR to restore the table from 2 minutes before the corruption occurred.
Update the application to reference the new table.
D. Use DynamoDB Streams to replay the table's change events in reverse order to undo the writing of the incorrect data.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must ensure that all AWS resources meet specific security requirements.
The company must not deploy any EC2 instances in the ap-southeast-2 Region. The company must completely block root user actions in all member accounts. The company must prevent any user from deleting AWS CloudTrail logs, including administrators. The company requires a centrally managed solution that the company can automatically apply to all existing and future accounts. Which solution will meet these requirements?
A. Create AWS Config rules with remediation actions in each account to detect policy violations.
Implement IAM permissions boundaries for the account root users.
B. Use AWS Control Tower for account governance. Configure Region deny controls. Use Service Control Policies (SCPs) to restrict root user access.
C. Enable AWS Security Hub across the organization. Create custom security standards to enforce the security requirements. Use AWS CloudFormation StackSets to deploy the standards to all the accounts in the organization. Set up Security Hub automated remediation actions.
D. Configure AWS Firewall Manager with security policies to meet the security requirements. Use an AWS Config aggregator with organization-wide conformance packs to detect security policy violations.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
A company's CloudOps engineer monitors multiple AWS accounts in an organization and checks each account's AWS Health Dashboard. After adding 10 new accounts, the engineer wants to consolidate health alerts from all accounts.
Which solution meets this requirement with the least operational effort?
A. Create an AWS Lambda function to query the AWS Health API and write all events to an Amazon DynamoDB table.
B. Enable organizational view in AWS Health.
C. Use the AWS Health API to write events to an Amazon DynamoDB table.
D. Configure the Health Dashboard in each account to forward events to a central AWS CloudTrail log.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
A CloudOps engineer must manage the security of an AWS account. Recently, an IAM user's access key was mistakenly uploaded to a public code repository. The engineer must identify everything that was changed using this compromised key.
How should the CloudOps engineer meet these requirements?
A. Search VPC Flow Logs for all events initiated with the compromised access key within the suspected timeframe.
B. Query Amazon EC2 logs by using Amazon CloudWatch Logs Insights for all events initiated with the compromised access key within the suspected timeframe.
C. Search AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe.
D. Create an Amazon EventBridge rule to send all IAM events to an AWS Lambda function for analysis.
正解：C
解説: (Topexam メンバーにのみ表示されます)