SOA-C02 Exam Questions and Answers

AWS Direct Connect

AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet entirely. It satisfies the low-latency and privacy constraints by using a physical cross-connect at an AWS Direct Connect location, delivering consistent network performance rather than variable internet routing.

Enable DNS resolution for the VPC peering connection.

When a VPC peering connection has DNS resolution enabled in both VPCs, instances can resolve private DNS hostnames of the peer VPC through the Amazon-provided DNS resolver, which returns private IP addresses instead of public ones. This keeps all cross-VPC traffic on the AWS backbone, avoiding the extra latency of routing over the public internet. Without this setting, private DNS names may fail to resolve or map to public endpoints, forcing traffic outside the VPC and adding avoidable round-trip delay.

Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW)

The VGW is attached to the VPC and is the entry/exit point for Direct Connect. By adding a route with the on-premises destination and the VGW as the target, traffic is forced through the Direct Connect connection.

VPC Peering

VPC Peering establishes a direct, logical connection between exactly two VPCs, using a 1:1 relationship that relies on AWS's existing routing infrastructure—no gateways, virtual appliances, or dedicated physical lines are required. Traffic between the peered VPCs uses private IPv4 or IPv6 addresses and stays entirely on the AWS global network, avoiding public-internet exposure and providing low, predictable latency. It is cost-effective for a pair of VPCs because there is no hourly fee or minimum revenue commitment; you pay only for inter-VPC data transfer, which is usually significantly cheaper than traffic traversing the internet. Although VPC peering is non-transitive, that property is irrelevant for a two-VPC architecture, making it the simplest and most operationally efficient solution for this requirement.

Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.

Global Accelerator preserves the client source IP when the endpoint is an NLB. The NLB passes traffic to the ALB, which can see the original client IP in the X-Forwarded-For header. This satisfies both performance (using Global Accelerator) and logging requirements.

Latency routing

Latency routing uses measurements of latency between AWS regions and the user to direct traffic to the region with the lowest latency. When health checks are attached to the ALBs, latency routing automatically avoids unhealthy endpoints by excluding them from responses.

Add a read replica.

A read replica is an asynchronous MySQL replica that continuously syncs changes from the primary and can serve read-only traffic, including SELECT queries and reporting workloads. By routing non-critical reads to the replica, the primary's CPU cycles are freed up for write operations, reducing overall CPU utilization on the primary instance. This is a cost-effective scale-out approach because you add a smaller replica instance rather than resizing the primary, and read replicas can be promoted or removed as demand changes.

Standard Reserved Instances

Standard Reserved Instances are ideal for a steady, predictable 24/7 workload because they offer the deepest discount, up to 72% compared to On-Demand, when you commit to a 1-year or 3-year term. You can choose All Upfront, Partial Upfront, or No Upfront payment options, which further optimize cash flow while locking in the lowest hourly rate for a specific instance family and region. For a workload that runs continuously without interruption, this commitment maximizes cost savings while guaranteeing capacity, making it the most economical choice.

Use AWS Config with auto-remediation to tag new instances, and activate the tags as cost allocation tags. For existing instances, run the Tag Editor with a CSV import.

This correctly combines a compliance-driven enforcement mechanism with a retroactive bulk-editing tool. AWS Config can run a managed rule that checks instances for the required tags and, if non-compliant, trigger auto-remediation via an SSM Automation document to apply those tags, covering new and modified resources continuously. Activating those tags in the Billing and Cost Management console makes them appear in cost allocation reports, and the Tag Editor can perform bulk search-and-tag across regions using a CSV import for any existing instances that predate the rule. Together, these steps tag both new and existing resources and ensure cost reporting reflects the tags.

Spot Instances

Spot Instances operate using spare EC2 capacity that AWS makes available at a significantly reduced hourly rate—often up to 90% off On-Demand pricing. This is the best fit here because the nightly 2-hour batch is both short and fault-tolerant: if capacity is reclaimed, work can be re-queued or resumed without violating the batch window. You can further reduce interruption risk by using a Spot Fleet with multiple instance types and by implementing checkpointing so progress is saved between runs. The result is a dramatic cost reduction for a workload that would otherwise be idling and paying full price.

Implement a read replica for the RDS instance and modify the application to route read queries to the read replica

Implementing a read replica creates a separate RDS instance that uses asynchronous replication to maintain a copy of the primary database, and it has its own endpoint that can handle read traffic. By modifying the application to route SELECT queries to the read replica (and keeping write operations on the primary), you offload CPU-intensive read workloads from the primary instance, directly alleviating high CPU utilization. This is a proven pattern for read-heavy applications because it scales read capacity independently and is more cost-effective than scaling up the primary, as you only size the primary for write throughput.

Scheduled scaling

Scheduled scaling allows you to define a recurring or one-time schedule to adjust the desired capacity of an Auto Scaling group at a future time. Because the company's workload follows a predictable pattern (e.g., a morning peak), scheduled scaling can proactively add EC2 instances before the traffic arrives, eliminating the lag inherent in reactive methods. After the initial configuration, it runs automatically without manual intervention, making it the most efficient choice for a known, consistent demand curve.

The CloudTrail trail is not enabled for that region.

CloudTrail trails are regional resources by default. If the trail was created for a single region, it captures API calls only in that region, and you must explicitly configure a multi-region trail or create separate trails for other regions. The absence of logs for a specific region strongly indicates that no trail is enabled in that region.

Use AWS X-Ray to trace the Lambda function and view segment details.

AWS X-Ray is the correct choice because it provides end-to-end distributed tracing for Lambda invocations, capturing a segment for the entire execution and subsegments for each downstream operation, such as DynamoDB queries, HTTP calls, or custom code blocks. When the X-Ray SDK is installed and the function is instrumented with wrappers or decorators, you can view segment details to see the exact duration of each subsegment, pinpointing which line or API call is slow. Even without custom instrumentation, X-Ray shows the overall execution time and any downstream service traces, but adding subsegments yields the precise line-level breakdown needed for this troubleshooting.

Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda

A CloudWatch alarm monitors the CPU metric and publishes to an SNS topic when the threshold is breached. The SNS topic triggers a Lambda function that calls the EC2 StopInstances API to stop the instance. This is a clean, low-overhead solution.

Set up an Amazon CloudWatch alarm on the DatabaseConnections metric that triggers an AWS Lambda function to modify the DB instance class via the RDS API.

Correct: you create a CloudWatch alarm on DatabaseConnections with a threshold (e.g., high connections for 5 minutes); when it enters ALARM, it sends a notification to an SNS topic that triggers a Lambda function, or uses an alarm action to invoke Lambda directly. The Lambda function calls the RDS ModifyDBInstance API with the desired DBInstanceClass and the DBInstanceIdentifier, and RDS performs the scaling. This is an event-driven, low-latency pattern that requires no polling and is a supported, commonly used approach for automated RDS instance-class scaling.

Create a CloudWatch alarm on the 'UnHealthyHostCount' metric for the ALB target group, with a threshold of 2 and an evaluation period of 5 minutes. Configure the alarm to send an Amazon SNS notification.

CloudWatch automatically receives the UnHealthyHostCount metric from the ALB's target group, so a CloudWatch alarm can directly monitor unhealthy host counts without any custom code. Setting the threshold to 2 and an evaluation period of 5 minutes triggers the alarm when the count exceeds 2 for that duration, and the alarm's SNS action sends a notification to subscribed endpoints. This is the simplest and most reliable approach because it uses native AWS monitoring.

Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.

Amazon EventBridge natively listens for AWS service events, including CloudTrail API calls. By creating a rule with a custom event pattern that matches the specific API call, you can directly send the event to multiple targets (SNS, CloudWatch Logs, Lambda, etc.) without needing metric filters or alarms. This is the recommended low-overhead solution.

Use DynamoDB global tables.

Global tables are DynamoDB's multi-Region replication feature, providing active-active copies of a table in up to six AWS Regions. When enabled, all data mutations are automatically propagated to every replica, and each replica supports both reads and writes with conflict resolution, so application traffic can be failed over to a healthy Region. This availability and automatic synchronization directly address the requirement to survive a regional outage.

Reboot the DB instance and select 'Reboot with failover'.

Selecting 'Reboot with failover' performs a forced failover by rebooting the primary instance and automatically promoting the Multi-AZ standby to primary. Because the standby is kept synchronously replicated through the same Multi-AZ architecture, this operation validates the failover path without any data loss and only incurs a brief availability interruption during the promotion. This is the officially supported method to test failover behavior in an Amazon RDS Multi-AZ deployment.

Launch EC2 instances in two different Availability Zones and place them behind an Application Load Balancer.

Launching EC2 instances in two different Availability Zones and placing them behind an Application Load Balancer is the canonical web-tier high availability pattern. The ALB performs continuous health checks and distributes traffic to healthy targets across both AZs. If an entire AZ becomes unhealthy, the ALB automatically reroutes requests to instances in the remaining AZ, preserving the application's availability. This design eliminates the AZ as a single point of failure for the web tier.

Create an AMI from the instance, store data on an Amazon EFS file system, and use an Auto Scaling group with a lifecycle hook to associate the Elastic IP

The AMI provides a pre-configured launch template. EFS provides durable, shared storage for application data. The Auto Scaling group automatically launches a new instance if the current one fails, and the lifecycle hook script associates the Elastic IP to the new instance, ensuring continuity with the same IP.

AWS Personal Health Dashboard

The AWS Personal Health Dashboard (PHD) is the correct resource because it surfaces service health events that are specific to your AWS account and resources. For an RDS Multi-AZ failover, PHD provides a detailed event with the exact time, date, affected database instance, and the cause of the failover (e.g., infrastructure maintenance, hardware degradation, or patching). PHD also includes a timeline of activity and often links to related operational guidance, making it the authoritative source for reviewing automated failover details. Unlike generic service health dashboards, PHD filters events down to your particular resources, ensuring you see the actual failover incident that occurred.

Configure the Auto Scaling group with subnets in at least two Availability Zones and ensure the ALB has subnets in the same AZs.

Correctly designed for failure domain isolation: an Auto Scaling group spanning subnets in at least two Availability Zones (AZs) lets EC2 instances be provisioned across independent infrastructure, and an ALB with subnets in those same AZs can route traffic to healthy instances in any AZ. If one AZ becomes unavailable, the ALB continues distributing requests to instances in the remaining AZs, while Auto Scaling replaces failed instances in the other AZs. This provides high availability because the application is stateless and can serve all traffic from a single AZ when needed.

The health check grace period on the Auto Scaling group is too short.

The health check grace period on the Auto Scaling group is too short. When a deployment launches new instances, the ASG considers an instance healthy only after the grace period expires; if the period is shorter than the time CodeDeploy needs to install the application and pass its own validation, the ASG will prematurely flag the instance as failing ELB health checks. Auto Scaling then terminates and replaces the instance mid-deployment, which CodeDeploy sees as a failed deployment ("too many individual instances"), and the cycle repeats for each new replacement. The correct fix is to increase the grace period to exceed the typical deployment duration.

Change sets

Change sets in AWS CloudFormation let you create a summary of proposed modifications to a stack without applying them. They provide a preview of exactly which resources will be added, modified, or removed, and indicate whether a change will cause replacement or simple updates. This review capability is especially valuable for production stacks, as it lets you catch unintended destructive actions before they execute.

Create a blue/green deployment by configuring CodeDeploy to launch new instances and shift traffic after validation.

A blue/green deployment with CodeDeploy provisions a new, separate fleet of EC2 instances (green) and installs the new revision on them while the original fleet (blue) continues to serve traffic. After validation of the green instances—through health checks, tests, or a manual approval—you can shift traffic from the blue fleet to the green fleet using an Application Load Balancer. This approach isolates the new version from production traffic until it is verified, and if a problem arises you can instantly reroute traffic back to the blue fleet, ensuring zero downtime.

Change sets

Change sets are the correct method for previewing CloudFormation updates. They generate a summary of the actions CloudFormation will perform when you execute the change set, explicitly flagging each resource as 'Static' (no change), 'Update' (in-place modification), or 'Replace' (recreation with a new physical ID). This allows you to inspect the exact impact before committing, so you can avoid unintended resource recreation and associated data loss or downtime.

Modify the Auto Scaling group's health check type to ELB

When the health check type is set to ELB, the Auto Scaling group uses the Application Load Balancer's health checks. If the test hook fails, the instance will be marked unhealthy by the ALB, and the Auto Scaling group will terminate and replace it, ensuring only healthy instances remain.

Parameters

Parameters are the only CloudFormation construct here that accept runtime input. When you create or update a stack, you supply values, either interactively, via CLI, or via a stack template, and those values are referenced with Ref to set resource properties. Because the same template can be reused with different parameter values, parameters are the correct way to make a stack deployable to multiple environments with different configuration.

s3-bucket-encryption-enabled

The AWS Config managed rule s3-bucket-encryption-enabled evaluates whether an S3 bucket has default encryption enabled, which is satisfied by configuring either SSE-S3 or SSE-KMS. This ensures new objects written to the bucket are automatically encrypted at rest, directly meeting the organization's encryption requirement. Without this rule, a bucket could store plaintext objects, making it the correct choice.

Create a listener that redirects HTTP requests (port 80) to HTTPS (port 443).

An Application Load Balancer listener rule can define a redirect action that responds to every HTTP (port 80) request with a 301 or 302 status and the corresponding HTTPS URL, preserving the path and query parameters. This is the native, supported pattern to force HTTPS because it transparently upgrades the client before the request reaches any target. The redirect action is evaluated before routing to target groups, so no compute resources are needed to enforce the policy.

Enable S3 Block Public Access at the account level and attach an SCP to deny changes to it.

This is the only correct answer because it provides a centralized, preventive, and tamper-proof control. Enabling S3 Block Public Access at the account level immediately denies all public read/write access to every current and future bucket in that account. Attaching an SCP that denies s3:PutAccountPublicAccessBlock and s3:PutBucketPublicAccessBlock prevents users—even those with full S3 permissions—from modifying those settings, because SCPs cannot be overridden by IAM policies within the member account.

AWS Config with a custom rule and AWS Lambda

A custom AWS Config rule can evaluate EC2 instances when they are created (configuration change trigger) and invoke an AWS Lambda function to terminate instances lacking the required tag or having an invalid value. This provides continuous compliance enforcement.

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning

AWS Config's s3-bucket-versioning-enabled managed rule continuously evaluates every bucket in the account, including both existing resources and newly created ones. When a bucket is found noncompliant—whether it never had versioning or had it disabled—an automatic remediation action invokes an AWS Systems Manager Automation document (such as AWS-EnableS3BucketVersioning) to enable versioning immediately. This closed-loop approach ensures ongoing compliance without manual effort, and it covers all buckets regardless of how they were created or modified. AWS Config evaluates configuration changes in near real time, making this a truly detective and corrective control.

Use AWS Config with the 's3-bucket-public-read-prohibited' managed rule and configure automatic remediation to block public access.

AWS Config's 's3-bucket-public-read-prohibited' managed rule evaluates every S3 bucket against the defined parameter (blocking public read access) on a continuous basis. Because it is a managed rule, there is no custom code to write or maintain, and when coupled with automatic remediation (using an AWS Systems Manager Automation document that applies the 'block all public access' setting or removes bucket policies), noncompliant buckets are corrected within minutes. This is the only option that provides both automated detection and automated remediation using a pre-built, low-maintenance AWS service, meeting the five-minute requirement without manual intervention.