PDF SOA-C02 Study Guide

Page: 4 / 6

Question 16

A company is creating a new multi-account architecture. A Sysops administrator must implement a login solution to centrally manage

user access and permissions across all AWS accounts. The solution must be integrated with AWS Organizations and must be connected to a third-party Security Assertion Markup Language (SAML) 2.0 identity provider (IdP).

What should the SysOps administrator do to meet these requirements?

Options:

Configure an Amazon Cognito user pool. Integrate the user pool with the third-party IdP.

Enable and configure AWS Single Sign-On with the third-party IdP.

Federate the third-party IdP with AWS Identity and Access Management (IAM) for each AWS account in the organization.

Integrate the third-party IdP directly with AWS Organizations.

Question 17

A SysOps Administrator is managing a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an

EC2 Auto Scaling group. The administrator wants to set an alarm for when all target instances associated with the ALB are unhealthy.

Which condition should be used with the alarm?

Options:

AWS/ApplicationELB HealthyHostCount <= 0

AWS/ApplicationELB UnhealthyHostCount >= 1

AWS/EC2 StatusCheckFailed <= 0

AWS/EC2 StatusCheckFailed >= 1

Question 18

A company needs to automatically monitor an AWS account for potential unauthorized AWS Management Console logins from multiple geographic locations.

Which solution will meet this requirement?

Options:

Configure Amazon Cognito to detect any compromised 1AM credentials.

Set up Amazon Inspector. Scan and monitor resources for unauthorized logins.

Set up AWS Config. Add the iam-policy-blacklisted-check managed rule to the account.

Configure Amazon GuardDuty to monitor the UnauthorizedAccess:IAMUser/ConsoleLoginSuccess finding.

Question 19

A SysOps administrator trust manage the security of An AWS account Recently an IAM users access key was mistakenly uploaded to a public code repository. The SysOps administrator must identity anything that was changed by using this access key.