PDF SOA-C02 Study Guide

To give the application the ability to resolve internal domain names, the SysOps administrator should create an Amazon Route 53 Resolver outbound endpoint and configure it to forward DNS queries to the on-premises DNS server.

Route 53 Resolver Outbound Endpoint:

An outbound endpoint enables DNS queries to be forwarded from AWS resources in a VPC to an on-premises DNS server.

Steps to Implement:

In the Route 53 console, create a new outbound endpoint in the VPC.

Configure the outbound endpoint with the IP address of the on-premises DNS server.

Update the VPC DNS settings to use the Route 53 Resolver.

Route 53 Resolver Endpoints

Creating an Outbound Endpoint

Step-by-Step Explanation:

Understand the Problem:

A user cannot upload an object to an S3 bucket using a presigned URL, even though the URL is valid and the bucket has no policy applied.

Analyze the Requirements:

Determine the cause of the issue preventing the upload via the presigned URL.

Evaluate the Options:

Option A: The user has not properly configured the AWS CLI.

CLI configuration is not relevant to using a presigned URL.

Option B: The SysOps administrator does not have the necessary permissions.

The administrator's permissions are required to generate a valid presigned URL with sufficient permissions.

Option C: A bucket policy is required.

A bucket policy is not necessary if the presigned URL has the correct permissions.

Option D: The object has already been uploaded.

A presigned URL remains valid until it expires or the specified permissions are revoked.

Select the Best Solution:

Option B: Ensuring that the SysOps administrator has the necessary permissions to upload objects to the S3 bucket is crucial for generating valid presigned URLs.

Amazon S3 Presigned URLs

IAM Policies for Amazon S3

The SysOps administrator must have the necessary permissions to upload objects to the S3 bucket, ensuring that the presigned URL generated allows the user to upload successfully.

Ensuring that all the EC2 instances have an instance profile with Systems Manager access is the most effective way to fix this issue. Having an instance profile with Systems Manager access will allow the SysOps administrator to configure the inventory collection for all the instances in the subnet, regardless of whether or not they are managed by Systems Manager.

To share Amazon RDS database snapshots between different accounts while ensuring all data is encrypted at rest, follow these steps:

Update the KMS Key Policy:

Navigate to the AWS KMS console.

Select the KMS key used to encrypt the RDS snapshots.

Update the key policy to grant the relevant AWS accounts permission to use the key.