Amazon Web Services Updated SOA-C02 Exam Questions and Answers by jeremiah

https://docs.aws.amazon.com/zh_tw/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html

To give the application the ability to resolve internal domain names, the SysOps administrator should create an Amazon Route 53 Resolver outbound endpoint and configure it to forward DNS queries to the on-premises DNS server.

Route 53 Resolver Outbound Endpoint:

An outbound endpoint enables DNS queries to be forwarded from AWS resources in a VPC to an on-premises DNS server.

Steps to Implement:

In the Route 53 console, create a new outbound endpoint in the VPC.

Configure the outbound endpoint with the IP address of the on-premises DNS server.

Update the VPC DNS settings to use the Route 53 Resolver.

Route 53 Resolver Endpoints

Creating an Outbound Endpoint

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html

Based on the attached policy, the following actions are allowed for the IAM user:

Allow Amazon RDS DescribeDBInstances Action:

The policy allows rds:Describe* actions on all resources without any condition, so the user can describe RDS instances in any region.

Example action:

rds:DescribeDBInstances

To enforce MFA for API calls using the AWS CLI, the users must use temporary security credentials obtained through the get-session-token command. Here’s how to do it:

Enable MFA for IAM Users:

Ensure that MFA is enabled and properly configured for each IAM user.

Configure IAM Policy for MFA Enforcement:

Attach an IAM policy that denies API calls unless MFA is used. This policy should be attached to all users.

Obtain Temporary Security Credentials Using MFA:

Users need to use the aws sts get-session-token command to obtain temporary credentials. This command requires the MFA token.

sh

Copy code

aws sts get-session-token --serial-number arn:aws:iam::123456789012:mfa/user --token-code 123456

Use Temporary Credentials for API Calls:

After obtaining the temporary credentials, set them as environment variables or configure them in the AWS CLI profile to make API calls.

export AWS_ACCESS_KEY_ID=...

export AWS_SECRET_ACCESS_KEY=...

export AWS_SESSION_TOKEN=...

Enabling MFA for IAM Users

Using Temporary Security Credentials

AWS CLI get-session-token