Amazon Web Services Updated SOA-C02 Exam Questions and Answers by ciaran

To enforce compliance with tagging policies in real-time:

AWS Config Setup: Implement an AWS Config rule to continuously monitor and evaluate EC2 instances for compliance with the tagging requirements. The required-tags managed rule can be configured to specifically check for the presence of a 'department' tag.

Automatic Remediation: Configure AWS Config to automatically execute the AWS-TerminateEC2Instance Systems Manager Automation document as a remediation action. This runbook will terminate any EC2 instance identified as noncompliant due to missing required tags.

Operational Efficiency: This setup allows for the enforcement of company tagging policies automatically and in near real-time, reducing the manual overhead of monitoring and ensuring compliance.

This method provides an efficient and effective solution to ensure that all EC2 instances meet the company's tagging requirements and that any noncompliant instances are dealt with promptly.

To centrally manage application logs and retain them for no more than 90 days, you can use the Amazon CloudWatch Logs agent to send logs to a CloudWatch log group and configure the log group's retention period.

Update the Launch Template User Data:

Navigate to the EC2 console.

Select the launch template used by the Auto Scaling group.

Edit the launch template to include the following user data script:

#!/bin/bash

yum update -y

yum install -y awslogs

cat < /etc/awslogs/awslogs.conf

[general]

state_file = /var/lib/awslogs/agent-state

[/var/log/messages]

file = /var/log/messages

log_group_name = /my-log-group

log_stream_name = {instance_id}/messages

datetime_format = %b %d %H:%M:%S

[/var/log/secure]

file = /var/log/secure

log_group_name = /my-log-group

log_stream_name = {instance_id}/secure

datetime_format = %b %d %H:%M:%S

EOF

systemctl start awslogsd

systemctl enable awslogsd

Replace /my-log-group with the name of your CloudWatch log group.

Configure the Log Group Retention Period:

Navigate to the CloudWatch console.

In the navigation pane, choose "Logs".

Select the log group created by the CloudWatch Logs agent.

Click on "Actions" and then "Edit retention settings".

Set the retention period to 90 days.

Verify the Configuration:

Ensure that logs from the EC2 instances are being sent to the CloudWatch log group.

Verify that the log group's retention period is correctly set to 90 days.

References:

Amazon CloudWatch Logs Agent

Setting Log Retention in CloudWatch

Step-by-Step Explanation:

Understand the Problem:

The EC2 instance processes large data files and uses a 1 TB General Purpose SSD (gp2) EBS volume.

CloudWatch metrics show consistent high VolumeReadOps.

The requirement is to improve I/O performance while ensuring data integrity.

Analyze the Requirements:

Improve I/O performance.

Maintain data integrity.

Evaluate the Options:

Option A: Change the instance type to a large, burstable, general-purpose instance.

Burstable instances provide a baseline level of CPU performance with the ability to burst to a higher level when needed. However, this does not address the I/O performance directly.

Option B: Change the instance type to an extra-large general-purpose instance.

A larger instance type might improve performance, but it does not directly address the I/O performance of the EBS volume.

Option C: Increase the EBS volume to a 2 TB General Purpose SSD (gp2) volume.

Increasing the size of a General Purpose SSD (gp2) volume can increase its IOPS. The larger the volume, the higher the baseline performance in terms of IOPS.

Option D: Move the data that resides on the EBS volume to the instance store.

Instance store volumes provide high I/O performance but are ephemeral, meaning data will be lost if the instance is stopped or terminated. This does not ensure data integrity.

Select the Best Solution:

Option C: Increasing the EBS volume size to 2 TB will provide higher IOPS, improving I/O performance while maintaining data integrity.

References:

Amazon EBS Volume Types

General Purpose SSD (gp2) Volumes

Increasing the size of the General Purpose SSD (gp2) volume is an effective way to improve I/O performance while ensuring data integrity remains intact.

To automate the invocation of an AWS Lambda function at the end of each day, you can use Amazon EventBridge (formerly known as CloudWatch Events) to create a scheduled rule.

Create a Scheduled EventBridge Rule:

Open the Amazon EventBridge console at Amazon EventBridge Console.

Choose Create rule.

Provide a name and description for the rule.

For Rule type, choose Schedule.

Define a cron expression that runs the rule at the end of each day. For example, cron(0 0 * * ? *) runs the function at midnight UTC.

Set the Target:

In the Targets section, choose Add target.

For Target type, select Lambda function.

Choose the Lambda function you want to invoke.

Create the Rule:

Review the settings and choose Create rule.

This setup ensures that the Lambda function runs automatically at the specified time every day.

References:

Amazon EventBridge Scheduler

Managing EventBridge Rules