SOA-C02 Exam Dumps - AWS Certified SysOps Administrator - Associate (SOA-C02)

Configuring Security Groups:

Security groups act as virtual firewalls for your instances to control inbound and outbound traffic.

Steps:

Go to the AWS Management Console.

Navigate to EC2.

Select "Security Groups" from the left-hand menu.

Find and select the security group associated with your EC2 instances.

Choose the "Inbound rules" tab and click "Edit inbound rules."

Add a rule to allow traffic from the security group associated with the NLB.

Type: Custom TCP (or the specific port your application uses)

Source: Select "Custom" and enter the ID of the NLB's security group.

This setup ensures that the EC2 instances accept traffic only from the NLB, enhancing security with minimal operational overhead.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html In governance mode, users can 't overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period. In compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened. Compliance mode helps ensure that an object version can't be overwritten or deleted for the duration of the retention period.

Using AWS CloudFormation stack sets allows you to manage CloudWatch alarms across multiple accounts efficiently:

Create Stack Set: Use a CloudFormation template that defines the required CloudWatch alarms and configures them to publish alerts to an SNS topic.

Specify SNS Topic: Ensure the SNS topic is located in the logging account and has the necessary permissions set to receive publications from all accounts in the organization.

Deploy Across Organization: Implement the stack set across all accounts, ensuring centralized management and standardized deployment.

AWS Documentation Reference:Learn more about deploying resources with CloudFormation StackSets: Working with AWS CloudFormation StackSets.

To provide both incoming and outgoing connectivity to the internet for EC2 instances, you need to ensure that the instances are in a subnet that has a route to an internet gateway. Here are the required steps:

Create an Internet Gateway:

Open the Amazon VPC console at Amazon VPC Console.

In the navigation pane, choose Internet Gateways.

Choose Create Internet Gateway.

Enter a name for the internet gateway and choose Create.

Attach the internet gateway to your VPC by selecting the created internet gateway, then choosing Actions, and Attach to VPC.

Modify Route Table:

In the Amazon VPC console, go to the Route Tables section.

Select the route table associated with the subnet where your EC2 instances are located.

Choose Edit routes and add a new route:

Destination: 0.0.0.0/0

Target: Select the internet gateway you created.

These steps ensure that the instances can send and receive traffic to and from the internet.

References:

Creating and Attaching an Internet Gateway

Route Tables

Amazon CloudWatch Synthetics:

CloudWatch Synthetics allows you to create canaries to monitor your endpoints and API calls, simulating user behavior to detect issues before users do.

Steps:

Go to the AWS Management Console.

Navigate to CloudWatch and select "Synthetics."

Click on "Create canary."

Choose "Heartbeat monitoring" as the blueprint.

Configure the canary to point to the FQDN of the website.

Set the frequency and retention settings as per your requirement.

Create the canary.

This setup continuously checks the operational status of your website, alerting you if it becomes unreachable or has issues.

To provision AWS accounts for each team with a defined baseline and governance guardrails in a scalable and efficient way, using AWS Control Tower is the best solution.

AWS Control Tower:

AWS Control Tower provides a straightforward way to set up and govern a secure, multi-account AWS environment based on best practices.

It uses Account Factory, a feature that automates the creation of new AWS accounts with predefined configurations.

Creating Accounts with Control Tower:

Navigate to the AWS Control Tower console.

Use Account Factory to create a new account.

Customize the account template to include the necessary configurations, such as organizational units (OUs), guardrails, and baselines.

Advantages:

Ensures consistent security and compliance across all accounts.

Automates account creation and configuration, saving time and reducing errors.

References:

AWS Control Tower

Setting Up Account Factory

To restrict EC2 resource deployment in a specific region and restrict root credentials usage:

Create Service Control Policies (SCPs):

Use AWS Organizations to create SCPs that restrict actions for all member accounts.

Create an SCP to deny the creation of EC2 instances in the ap-southeast-2 region.

Create an SCP to deny the use of root credentials in member accounts.

Modifying the DB instance to a Multi-AZ deployment is the recommended solution for failover and high availability in RDS. Multi-AZ RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone, allowing automatic failover in case of an instance or Availability Zone failure.

Multi-AZ Deployment: Provides resilience with automatic failover and minimizes application downtime.

No Application Changes Needed: Multi-AZ is managed by AWS, so the failover is transparent to the application.

Read replicas and Auto Scaling groups do not provide automatic failover for write operations, and RDS Proxy only improves connection management rather than high availability.