Amazon Web Services Updated SOA-C02 Exam Questions and Answers by katie

If an EC2 instance does not appear in the Systems Manager Session Manager list, it is likely because the instance does not have an attached IAM role that allows Session Manager to connect.

Attach IAM Role with Necessary Permissions:

Ensure the EC2 instance has an IAM role attached with the AmazonSSMManagedInstanceCore policy.

Steps to Attach IAM Role:

Open the EC2 console, select the instance, and choose "Actions" -> "Instance Settings" -> "Attach/Replace IAM Role."

Select or create an IAM role with the necessary permissions for Session Manager.

Permissions for Session Manager:

The AmazonSSMManagedInstanceCore policy provides the required permissions for the Systems Manager agent to interact with the Systems Manager service.

References:

Session Manager Prerequisites

Attach an IAM Role to an Instance

For routing based on the user's geographic location to comply with data residency requirements, the best solution is to use Amazon Route 53 geolocation routing policy. This policy allows you to configure DNS responses based on the geographic location of the user, ensuring that requests are directed to specific AWS Regions that align with the company’s data residency requirements. Option C is correct. The AWS Route 53 documentation provides details on implementing geolocation routing policies Amazon Route 53 Geolocation Routing.

To meet regulatory and compliance requirements for archiving sensitive data on Amazon S3 Glacier with no modifications allowed by any account, attaching a vault lock policy to an S3 Glacier vault and validating the vault lock policy after 24 hours is the most appropriate solution.

Vault Lock Policy:

Amazon S3 Glacier Vault Lock allows you to easily deploy and enforce compliance controls for individual S3 Glacier vaults via a lockable policy.

You can specify controls such as Write Once Read Many (WORM) in a vault lock policy and lock the policy from future edits.

Implementing Vault Lock:

Attach a vault lock policy to the S3 Glacier vault that contains the archived data.

Initiate the vault lock process, which involves providing a policy and locking it after a validation period of 24 hours.

Steps:

Open the S3 Glacier console.

Select the vault and configure a vault lock policy with the required compliance controls.

Use the InitiateVaultLock API to set the policy and start the lock process.

Validate and complete the lock process after 24 hours using the lock ID.

References:

Amazon S3 Glacier Vault Lock

Managing S3 Glacier Vault Lock Policies

To ensure high availability and disaster recovery for the RDS for MySQL database, follow these steps:

Create a Cross-Region Read Replica:

In the RDS console, create a cross-Region read replica of the primary database instance. This read replica will provide high availability and the lowest RTO and RPO in case of a disaster.