SOA-C02 Practice Test 1 — 10 Questions

Question 1

A company uses an Amazon DynamoDB table with on-demand capacity mode. The table handles a workload with a steady baseline of 500 writes per second but spikes to 2,000 writes per second for a few hours each day. The SysOps administrator wants to reduce costs without affecting application performance during spikes. Which action should the administrator take?

Accepted Answer

Switch to provisioned capacity with auto scaling to handle the spikes.. On-demand capacity mode is ideal for unpredictable workloads but costs more per write than provisioned capacity. Since this workload has a predictable baseline and spikes, switching to provisioned capacity with auto scaling allows you to pay a lower rate for the steady 500 writes per second while auto scaling automatically adds capacity to handle the 2,000 writes per second spikes, reducing overall cost without impacting performance.

Answer

Enable DynamoDB Accelerator (DAX) to cache reads.

Answer

Create a global table to distribute write traffic.

Answer

Use Amazon ElastiCache to buffer write requests.

Question 2

A company uses Amazon CloudWatch Logs to store application logs. The SysOps administrator needs to count the occurrences of the string 'ERROR' in the logs and trigger an Amazon SNS notification when more than 10 errors occur within a 5-minute window. Which steps should the administrator take?

Accepted Answer

Create a metric filter on the log group and then create a CloudWatch alarm on the resulting metric. A metric filter on a CloudWatch Logs log group extracts a numeric metric (e.g., count of 'ERROR' occurrences) and publishes it to a CloudWatch custom metric. A CloudWatch alarm can then be configured on that metric to evaluate a threshold (e.g., >10) over a specified period (e.g., 5 minutes) and trigger an SNS notification when breached. This is the native, serverless, and cost-effective approach for counting log patterns and alerting.

Answer

Create a CloudWatch alarm directly on the log group

Answer

Create an AWS Lambda function to parse the logs and send a notification to Amazon SNS

Answer

Create an Amazon EventBridge rule to filter log events and send to SNS

Question 3

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and send an alert when it exceeds 90% for 5 consecutive minutes. Which combination of AWS services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch metric (CPUUtilization), a CloudWatch alarm, and an Amazon SNS topic.. The correct approach is to use a CloudWatch metric for CPUUtilization, which is automatically published by EC2 instances. A CloudWatch alarm can be configured to evaluate this metric over a period of 5 consecutive minutes with a threshold of 90%, and when the alarm state is triggered, it publishes to an SNS topic to send notifications. This is the native, efficient, and recommended method for monitoring and alerting on EC2 CPU utilization.

Answer

Amazon CloudWatch Logs, a metric filter to extract CPU utilization from logs, and an alarm on that metric.

Answer

A CloudWatch dashboard and an AWS Lambda function that checks the dashboard periodically.

Answer

Amazon EventBridge (CloudWatch Events) and a Lambda function that calls the EC2 DescribeInstances API.

Question 4

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda. Option B is correct because it uses Amazon CloudWatch alarms to monitor CPU utilization metrics and trigger an SNS topic, which then invokes an AWS Lambda function. The Lambda function can execute the logic to stop the EC2 instance when the alarm state indicates CPU utilization above 90% for 30 minutes, providing automated cost control without manual intervention.

Answer

Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation

Answer

Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions

Answer

AWS CloudTrail + Amazon EventBridge + AWS CodePipeline

Question 5

A company's security policy requires that all Amazon S3 buckets must have server-side encryption enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and notify the security team. Which AWS service should be used to detect non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and evaluates the configuration of AWS resources against desired policies. By using an AWS Config managed rule such as `s3-bucket-server-side-encryption-enabled`, you can automatically detect any S3 bucket that lacks server-side encryption and trigger an SNS notification to the security team.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 6

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance. The administrator wants to ensure that if the stack is updated, the EC2 instance is not accidentally replaced if its properties change. The administrator wants the stack update to fail when a property change would require replacement. Which CloudFormation feature should the administrator use?

Accepted Answer

StackPolicy. Option C, StackPolicy, is correct because a stack policy is a JSON document that defines which stack resources can be updated or replaced during a stack update. By setting a Deny effect on update actions for the EC2 instance, the administrator can prevent any property change that would cause replacement, causing the update to fail instead of replacing the instance. This directly meets the requirement to block accidental replacement.

Answer

CreationPolicy

Answer

DeletionPolicy

Answer

UpdateReplacePolicy

Question 7

A company runs a production web application on a single Amazon EC2 instance. The application experiences a predictable and steady workload 24/7. The SysOps administrator wants to minimize compute costs for this instance while ensuring it remains available during the expected workload. Which EC2 purchasing option should the administrator use?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the most cost-effective option for a predictable, steady-state workload running 24/7. By committing to a 1- or 3-year term, you receive a significant discount (up to 72%) compared to On-Demand pricing, while still ensuring the instance remains available for the expected workload. This matches the requirement to minimize compute costs without sacrificing availability.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 8

A company hosts a web application on Amazon EC2 instances in two AWS regions: us-east-1 and eu-west-1. The application is behind an Application Load Balancer (ALB) in each region. The SysOps administrator wants to direct users to the region that provides the lowest latency, automatically routing traffic away from a region if it becomes unhealthy. Which Amazon Route 53 routing policy should be used?

Accepted Answer

Latency routing. Latency routing (B) is correct because it directs users to the region with the lowest network latency based on real-time measurements between the user and the AWS endpoints. When a region becomes unhealthy, Route 53 automatically stops routing traffic to that region's ALB, ensuring failover to the next lowest-latency healthy region. This meets the requirement of both low-latency and automatic health-based rerouting.

Answer

Geolocation routing

Answer

Weighted routing

Answer

Failover routing

Question 9

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning. AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Answer

Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning

Answer

Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action

Answer

Use AWS Service Catalog to enforce versioning on all buckets provisioned through it

Question 10

A company runs a critical application on Amazon EC2 instances across multiple Availability Zones. The application stores state data on a shared Amazon EFS file system. The SysOps administrator needs to ensure that the file system remains available if an entire Availability Zone fails. The file system must also provide low-latency access from all instances. Which configuration meets these requirements?

Accepted Answer

Create an EFS file system with the Standard storage class in the same Region, and mount it from all instances using the regional mount target.. Option C is correct because the EFS Standard storage class stores data redundantly across multiple Availability Zones (AZs) within a Region, ensuring high availability and durability even if an entire AZ fails. By mounting the file system using the regional mount target (which resolves to the EFS file system's regional DNS name), instances in any AZ can access the file system with low latency, as EFS automatically routes traffic to the most appropriate mount target in the same AZ. This configuration meets both the availability and low-latency requirements without additional replication or failover complexity.

Answer

Create an EFS file system with the One Zone storage class and mount it from all instances.

Answer

Create an EFS file system with the Standard storage class, enable replication to another Region, and use DNS failover.

Answer

Create an EFS file system with the Standard storage class, and enable Multi-AZ deployment.