Amazon Web Services Updated SOA-C02 Exam Questions and Answers by michal

The requirement is to automate recovery if the service crashes on any of the EC2 instances.

Option A: Install the Amazon CloudWatch agent on the EC2 instances. Configure the CloudWatch agent to monitor the service. Set the CloudWatch action to restart if the service health check fails . This is a valid solution because the CloudWatch agent can be configured to monitor the service and take action (restart the service) if the health check fails .

Option C: Tag the EC2 instances. Use AWS Systems Manager State Manager to create an association that uses the AWS-RunShellScript document. Configure the association command with a script that checks if the service is running and that starts the service if the service is not running. For targets, specify the EC2 instance tag. Schedule the association to run every 5 minutes678. This is a valid solution because AWS Systems Manager State Manager can be used to maintain a consistent state of the EC2 instances. It can run a script to check if the service is running and start the service if it’s not running678.

Option B: Tag the EC2 instances. Create an AWS Lambda function that uses AWS Systems Manager Session Manager to log in to the tagged EC2 instances and restart the service. Schedule the Lambda function to run every 5 minutes . This is not a valid solution because AWS Lambda functions are not designed to log in to EC2 instances and restart services. They are used for running serverless applications.

Option D: Update the EC2 user data that is specified in the Auto Scaling group’s launch template to include a script that runs on a cron schedule every 5 minutes131415. This is not a valid solution because user data scripts are run only during the launch of an EC2 instance. They are not designed to run on a schedule.

Option E: Update the EC2 user data that is specified in the Auto Scaling group’s launch template to ensure that the service runs during startup. Redeploy all the EC2 instances in the Auto Scaling group with the updated launch template131416. This is not a valid solution because while user data can be used to ensure that the service runs during startup, it does not provide a solution for when the service crashes after the EC2 instance has started.

AWS Config can be used to monitor and enforce compliance of AWS resource configurations, including security group rules.

Steps:

Activate AWS Config Rule:

Open the AWS Config console.

Choose "Rules" and then "Add rule".

Search for and select the restricted-ssh managed rule.

Configure the rule to monitor all security groups for compliance.

Set Up Automatic Remediation:

In the AWS Config console, associate the restricted-ssh rule with the AWS-DisablePublicAccessForSecurityGroup Systems Manager Automation runbook.

This runbook will automatically remove any inbound SSH rule that allows traffic from 0.0.0.0/0.

Set Up Notifications:

Open the Amazon EventBridge console.

Create a new rule to monitor AWS Config compliance changes.

Configure the rule to send notifications to an Amazon SNS topic whenever the restricted-ssh rule is noncompliant.

Subscribe the SysOps team to the SNS topic to receive notifications.

To receive email notifications when IAM CreateUser API calls are made, you need to create an EventBridge rule that captures these events from CloudTrail and then routes them to an SNS topic that has an email subscription.

Enable CloudTrail:

Ensure AWS CloudTrail is enabled in your account to log API activity. Go to AWS CloudTrail Console and enable it if not already enabled.

Create SNS Topic:

Open the Amazon SNS console at Amazon SNS Console.

Create a new topic and name it (e.g., IAMCreateUserNotifications).

Create an email subscription for the topic by entering your email address and confirming the subscription via the email received.

Create EventBridge Rule:

Open the Amazon EventBridge console at Amazon EventBridge Console.

Create a new rule and provide a name and description.

For the Event source, select AWS events or EventBridge Schema.

In Event pattern, select AWS services and choose CloudTrail as the service.

Specify the event type as AWS API Call via CloudTrail.

In the Event source dropdown, select IAM and in the API operation, enter CreateUser.

Add Target:

Add a target and select SNS topic.

Choose the SNS topic you created earlier (IAMCreateUserNotifications).

Configure Permissions:

Ensure that the EventBridge rule has permission to publish to the SNS topic.

This configuration will trigger an email notification whenever an IAM CreateUser API call is made, keeping you informed of new user creations.

References:

Creating an EventBridge Rule That Triggers on an Event

Setting Up a CloudWatch Event to Trigger SNS

Creating CloudTrail Event Rules

To meet the requirement of using only IPv6 for all EC2 instances while allowing outbound internet access and preventing inbound internet access, an egress-only internet gateway is the correct solution. An egress-only internet gateway allows outbound communication over IPv6 and blocks inbound communication, ensuring that the instances can access the internet but are not directly accessible from the internet.

Create an Egress-Only Internet Gateway:

Open the Amazon VPC console at Amazon VPC Console.

In the navigation pane, choose Egress-only internet gateways.

Choose Create egress-only internet gateway, and then attach it to your VPC.

Create a Custom Route Table:

In the VPC console, navigate to Route Tables.

Create a new route table or select an existing one.

Add a route with the destination set to ::/0 (which represents all IPv6 addresses) and the target set to the egress-only internet gateway.

Attach the Route Table to IPv6-Only Subnets:

Associate the route table with the IPv6-only subnets in your VPC.

This configuration ensures that your IPv6-only EC2 instances can access the internet while being protected from inbound internet traffic.

References:

Egress-Only Internet Gateways

IPv6 Addresses