SOA-C02 Exam Questions and Answers

Create a CloudWatch metric filter on the log group, create a CloudWatch alarm on the metric, and configure the alarm to post to an SNS topic that triggers the Lambda function.

Correct. This uses native CloudWatch features with minimal overhead, meeting the 5-minute requirement through alarm evaluation intervals.

Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda

A CloudWatch alarm monitors the CPU metric and publishes to an SNS topic when the threshold is breached. The SNS topic triggers a Lambda function that calls the EC2 StopInstances API to stop the instance. This is a clean, low-overhead solution.

Set up an Amazon CloudWatch alarm on the DatabaseConnections metric that triggers an AWS Lambda function to modify the DB instance class via the RDS API.

Correct: you create a CloudWatch alarm on DatabaseConnections with a threshold (e.g., high connections for 5 minutes); when it enters ALARM, it sends a notification to an SNS topic that triggers a Lambda function, or uses an alarm action to invoke Lambda directly. The Lambda function calls the RDS ModifyDBInstance API with the desired DBInstanceClass and the DBInstanceIdentifier, and RDS performs the scaling. This is an event-driven, low-latency pattern that requires no polling and is a supported, commonly used approach for automated RDS instance-class scaling.

Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.

Amazon EventBridge natively listens for AWS service events, including CloudTrail API calls. By creating a rule with a custom event pattern that matches the specific API call, you can directly send the event to multiple targets (SNS, CloudWatch Logs, Lambda, etc.) without needing metric filters or alarms. This is the recommended low-overhead solution.

Amazon CloudWatch alarm with an AWS Systems Manager Automation action.

CloudWatch alarms support a native 'Systems Manager Automation' action that directly invokes an SSM automation runbook, such as the pre-built AWS-RestartRDSInstance runbook, when the alarm enters an alarm state. This runbook encapsulates the RDS reboot API call and includes appropriate wait/verify steps, all without requiring you to write or maintain any custom code. The integration is purpose-built for metric-driven remediation and is the minimal-effort, fully managed way to automatically restart an RDS DB instance.

Create a CloudWatch alarm on the CPUUtilization metric and configure the alarm to send a notification to an Amazon SNS topic with email subscriptions.

This is the simplest approach. CloudWatch natively monitors EC2 metrics and can trigger SNS notifications without any custom code.

Create an AMI from the instance, store data on an Amazon EFS file system, and use an Auto Scaling group with a lifecycle hook to associate the Elastic IP

The AMI provides a pre-configured launch template. EFS provides durable, shared storage for application data. The Auto Scaling group automatically launches a new instance if the current one fails, and the lifecycle hook script associates the Elastic IP to the new instance, ensuring continuity with the same IP.

Create a read replica of the ElastiCache Redis cluster in the DR region using the native cross-region replication feature. Use Route 53 with failover routing to point to the DR region ALB when the primary health check fails. Pre-configure EC2 instances in an Auto Scaling group in the DR region.

Global Datastore for Redis provides cross-Region replication with low RPO. Pre-configured Auto Scaling groups in the DR region ensure that compute capacity is ready. Route 53 failover routing automatically redirects traffic when the primary ALB health check fails. This combination meets the RPO and RTO requirements with minimal manual effort.

Create an Amazon CloudWatch Events rule that matches the 'RDS DB Instance Event' for 'failover' and sends the event to an Amazon SNS topic for notification and logging.

Amazon CloudWatch Events (now part of Amazon EventBridge) natively integrates with RDS event notifications, emitting a structured event whenever a DB instance experiences a failover. By creating a rule that matches the 'RDS DB Instance Event' source and the specific detail type for failover, you can route that event to an SNS topic in near-real time, enabling automated alerting, logging, and downstream remediation. This is the intended, low-overhead approach because RDS already publishes these lifecycle events, and no polling or custom detection logic is required.

Implement an Auto Scaling warm pool with a minimum number of pre-initialized instances in a 'Stopped' state. Configure the scaling policy to move instances from the warm pool to the Auto Scaling group when needed.

A warm pool maintains instances that have been fully launched and configured but are stopped or in a standby state. When scale-out occurs, instances from the warm pool are started or moved into service quickly, drastically reducing the time to handle traffic.

Migrate session state to Amazon ElastiCache for Redis, store critical data in Amazon EFS, create an Auto Scaling group across multiple AZs, and place it behind an ALB.

This option makes the application stateless at the compute layer by externalizing session state to ElastiCache for Redis, which all instances can access, and storing critical application data on Amazon EFS, a shared regional file system. An Auto Scaling group spanning multiple Availability Zones ensures that an instance failure or entire AZ outage triggers replacement, while the ALB distributes traffic only to healthy instances and performs health checks. This architecture achieves both high availability and horizontal scalability because no unique state is tied to any individual EC2 instance.

Disable sticky sessions on the ALB and configure the application to store session data in an external session store like Amazon ElastiCache for Redis.

Disabling sticky sessions and moving session state to an external service like ElastiCache for Redis decouples user session data from individual EC2 instance lifecycles. When an ALB routes requests to any healthy instance, the instance can retrieve the session from Redis, so a failed or terminated instance does not lose state. Because ElastiCache replicates across AZs, sessions also survive single-cache-node failures, making the app tier effectively stateless and highly resilient.

Modify the Auto Scaling group's health check type to ELB

When the health check type is set to ELB, the Auto Scaling group uses the Application Load Balancer's health checks. If the test hook fails, the instance will be marked unhealthy by the ALB, and the Auto Scaling group will terminate and replace it, ensuring only healthy instances remain.

Add a stage between source and deploy that uses an AWS CodeBuild action to run unit tests defined in a buildspec file. The pipeline will automatically stop if the build action fails.

CodeBuild is the ideal service for running automated tests in a controlled environment. It integrates natively with CodePipeline: if the CodeBuild build fails, the pipeline transitions to a failed state, stopping further execution and optionally sending notifications via Amazon SNS.

Directly update the stack by modifying the template and submitting the update via the AWS Management Console, AWS CLI, or API.

A direct stack update is the correct method because CloudFormation compares the modified template against the current stack and applies the changed InstanceType property to the existing EC2 instance without replacement. The update can be submitted via the AWS Management Console, AWS CLI, or API, and because this is a simple, in-place attribute change, it minimizes downtime and avoids extra operational overhead. This approach is the fastest and least disruptive way to achieve the desired configuration.

Create a maintenance window with a cron schedule of cron(0 2 ? * TUE#2 *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.

This schedule correctly specifies the second Tuesday of each month at 2 AM. The document and operation apply patches, and RebootIfNeeded only reboots if necessary.

Blue/green deployment with Canary10Percent configuration

Blue/green with Canary10Percent shifts 10% of traffic to the new version, waits, then automatically shifts the remaining 90%. It matches the pattern but does not natively support manual approval.

Use EC2 Image Builder to define a component with the PowerShell scripts, create a recipe, and schedule a pipeline to run weekly.

EC2 Image Builder is the purpose-built AWS service for producing golden AMIs. A component encapsulates the PowerShell script logic, a recipe bundles that component with a base image and OS settings, and a pipeline can be scheduled to run weekly to automatically build, validate, and register the AMI. It also supports post-build testing and cross-account/region distribution, giving a fully managed, auditable image lifecycle with minimal operational overhead.

AWS Config with a custom rule and AWS Lambda

A custom AWS Config rule can evaluate EC2 instances when they are created (configuration change trigger) and invoke an AWS Lambda function to terminate instances lacking the required tag or having an invalid value. This provides continuous compliance enforcement.

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning

AWS Config's s3-bucket-versioning-enabled managed rule continuously evaluates every bucket in the account, including both existing resources and newly created ones. When a bucket is found noncompliant—whether it never had versioning or had it disabled—an automatic remediation action invokes an AWS Systems Manager Automation document (such as AWS-EnableS3BucketVersioning) to enable versioning immediately. This closed-loop approach ensures ongoing compliance without manual effort, and it covers all buckets regardless of how they were created or modified. AWS Config evaluates configuration changes in near real time, making this a truly detective and corrective control.

Use the AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure automatic remediation for each rule using the corresponding AWS Systems Manager Automation runbook: 'AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup'.

This is the correct approach. Managed rules evaluate compliance, and automatic remediation using Systems Manager Automation runbooks applies the fix without custom code. The runbooks perform the necessary API calls to enable encryption and backups, meeting the policy requirements.

Use AWS Config with a custom rule backed by an AWS Lambda function that checks if the S3 bucket has default SSE-KMS encryption enabled, and auto-remediates by enabling SSE-KMS default encryption (e.g., calling the PutBucketEncryption API).

This uses AWS Config for detection and Lambda for remediation, which is a standard pattern. Bucket policy approach prevents future unencrypted uploads but does not encrypt existing objects; however, the requirement is to apply encryption configuration, which can be done via put-bucket-encryption API. The Lambda can call that API. This is a valid solution with managed services and minimal custom code (only the Lambda).

Create a Service Control Policy (SCP) in AWS Organizations that denies permissions to modify S3 bucket public access settings.

A Service Control Policy (SCP) attached at the organization root or an organizational unit (OU) is inherited by every AWS account underneath, and it operates as an allow-list or denial of AWS API actions at the account level. Because SCPs are evaluated by AWS Organizations before IAM policies, even an account root user with full administrative rights cannot override an explicit deny of s3:PutBucketPolicy, s3:PutBucketAcl, or s3:PutBucketPublicAccessBlock, making it a true preventative guardrail across the entire organization. This is why the correct answer is to use SCPs rather than account-local controls.

aws:ResourceTag

The aws:ResourceTag condition key allows you to control access based on tags attached to the resource being accessed (e.g., S3 bucket tag). You can use it in the 'Condition' element of an IAM policy to enforce the tag requirement.

AWS Direct Connect

Correct. AWS Direct Connect provides a dedicated private connection between on-premises and AWS, avoiding the public internet.

Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW)

The VGW is attached to the VPC and is the entry/exit point for Direct Connect. By adding a route with the on-premises destination and the VGW as the target, traffic is forced through the Direct Connect connection.

Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.

Global Accelerator preserves the client source IP when the endpoint is an NLB. The NLB passes traffic to the ALB, which can see the original client IP in the X-Forwarded-For header. This satisfies both performance (using Global Accelerator) and logging requirements.

Latency routing

Latency routing uses measurements of latency between AWS regions and the user to direct traffic to the region with the lowest latency. When health checks are attached to the ALBs, latency routing automatically avoids unhealthy endpoints by excluding them from responses.

Configure the ALB as an endpoint group in a Global Accelerator accelerator.

Global Accelerator is a networking service that provides two static anycast IP addresses at AWS edge locations and routes traffic over the AWS global network to the ALB endpoint. By adding the ALB as an endpoint in an endpoint group for the us-east-1 region, user traffic from Asia enters the AWS backbone at the nearest edge and traverses the private, low-latency AWS network instead of the congested public internet. This also brings health checking, automatic failover, and consistent performance even during internet disruptions.

VPC peering

VPC peering establishes a direct, private network connection between two VPCs using the AWS backbone. It is simple to set up, has low cost (no hourly fees, only data transfer charges), and provides high throughput with no bandwidth constraints.

Spot Instances

Spot Instances operate using spare EC2 capacity that AWS makes available at a significantly reduced hourly rate—often up to 90% off On-Demand pricing. This is the best fit here because the nightly 2-hour batch is both short and fault-tolerant: if capacity is reclaimed, work can be re-queued or resumed without violating the batch window. You can further reduce interruption risk by using a Spot Fleet with multiple instance types and by implementing checkpointing so progress is saved between runs. The result is a dramatic cost reduction for a workload that would otherwise be idling and paying full price.

Implement a read replica for the RDS instance and modify the application to route read queries to the read replica

Implementing a read replica creates a separate RDS instance that uses asynchronous replication to maintain a copy of the primary database, and it has its own endpoint that can handle read traffic. By modifying the application to route SELECT queries to the read replica (and keeping write operations on the primary), you offload CPU-intensive read workloads from the primary instance, directly alleviating high CPU utilization. This is a proven pattern for read-heavy applications because it scales read capacity independently and is more cost-effective than scaling up the primary, as you only size the primary for write throughput.

Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.

This lifecycle policy matches the access patterns: frequent access -> Standard-IA after 30 days, occasional access for next 60 days (still in IA), then rarely accessed -> Deep Archive after 90 days. Deep Archive is the lowest-cost storage option for long-term retention. Deleting after 7 years meets compliance. This is the most cost-effective configuration.

Upgrade the instance class of the read replicas to a larger type with more CPU and memory to handle the increased WAL replay rate.

Replica lag occurs when the replica cannot keep up with the rate of changes from the primary. Increasing the replica's instance size gives it more resources to apply WAL data faster, reducing lag. This directly addresses the performance bottleneck.

Purchase Compute Savings Plans for a 1-year or 3-year term with a commitment that covers the expected compute spend.

Compute Savings Plans are the right choice for a mixed EC2 and Fargate environment because the hourly commitment automatically applies to eligible compute usage across EC2 instances, Fargate tasks, and Lambda functions within the chosen region. Unlike EC2 Instance Savings Plans, they do not lock you to an instance family or size, so you can change instance types or refactor to containers without losing the discounted rate. A 1-year or 3-year term with a commitment that matches steady-state spend yields significant savings over On-Demand.

Use S3 Intelligent-Tiering.

S3 Intelligent-Tiering is the correct choice because it automatically monitors access patterns at the object level and moves data between Frequent Access, Infrequent Access, and Archive Instant Access tiers without any retrieval fees or user action. This provides low-latency access for actively requested large files while silently reducing storage cost for objects that become cold. It is ideal for unknown, unpredictable, or changing access patterns because there is no static lifecycle rule to misjudge when data will be accessed again. A small monthly monitoring and automation fee per object applies, but it is typically negligible compared to the savings and avoids the risk of archive-tier retrieval delays.