SOA-C02 Practice Test 10 — 10 Questions

Question 1

A company uses AWS Backup to back up its Amazon EFS file system daily. The backup retention policy is set to 30 days. Recently, a user accidentally deleted a critical directory. The company wants to restore the directory as it existed 2 days ago. What is the MOST cost-effective and quickest way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restore the backup from 2 days ago to a new EFS file system, then copy the directory to the original file system.. AWS Backup creates point-in-time snapshots of EFS file systems. Restoring a backup from 2 days ago to a new EFS file system allows you to mount that new file system, copy the specific directory back to the original file system, and then delete the temporary file system. This is the most cost-effective and quickest approach since it avoids moving data to on-premises servers and uses native AWS services without additional replication costs.

Answer

Use the EFS console to recover the directory from the .Trash folder.

Answer

Enable EFS replication to another region and then fail back.

Answer

Use AWS Backup to restore the entire file system to an on-premises server, then copy the directory back.

Question 2

A SysOps administrator needs to centrally collect operating system-level metrics from a fleet of Amazon EC2 instances running Amazon Linux 2. The metrics should include memory usage and disk I/O. Which solution should the administrator implement?

Accepted Answer

Install and configure the CloudWatch agent on the EC2 instances.. The CloudWatch agent is the correct solution because it can collect custom OS-level metrics such as memory usage and disk I/O from EC2 instances running Amazon Linux 2. Unlike the default CloudWatch metrics, which only capture hypervisor-level metrics (e.g., CPU, network), the CloudWatch agent uses the procstat and disk plugins to gather detailed system metrics and publish them to CloudWatch as custom namespaces.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log OS-level metrics.

Answer

Use AWS Systems Manager Inventory to collect metrics.

Question 3

A company runs a stateful web application on a single EC2 instance. The SysOps Administrator wants to improve fault tolerance. Which design should they implement?

Accepted Answer

Place instances in an Auto Scaling group across two Availability Zones, use an Application Load Balancer, and store session state in ElastiCache.. It distributes the web application across multiple Availability Zones for high availability, uses an Application Load Balancer to route traffic to healthy instances, and stores session state externally in ElastiCache. This decouples the stateful session data from the EC2 instances, allowing any instance to handle any request without losing session context, which is essential for fault tolerance in a stateful application.

Answer

Create a Multi-AZ RDS instance and attach it to the existing EC2 instance.

Answer

Add a second EC2 instance in the same Availability Zone and use a Network Load Balancer.

Answer

Use an Auto Scaling group with a launch configuration that stores session data on instance store.

Question 4

An organization wants to ensure that all changes to an S3 bucket policy are logged and immediately trigger a notification to the security team. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutBucketPolicy API call and triggers an SNS topic.. CloudWatch Events (now Amazon EventBridge) can capture the PutBucketPolicy API call via a service-specific event pattern and route it to an SNS topic for immediate notification. This approach is the most efficient as it directly monitors the API call in real-time without polling or additional configuration, ensuring the security team is alerted the moment the policy changes.

Answer

Create a CloudWatch Alarm that monitors the S3 bucket's policy.

Answer

Use AWS Config with a managed rule to detect policy changes.

Answer

Enable S3 event notifications on the bucket for 'PutBucketPolicy' events.

Question 5

A company has an RDS PostgreSQL database with a Multi-AZ deployment. The primary instance fails. What happens to the application connections?

Accepted Answer

The application must reconnect to the same endpoint; it will be redirected to the standby instance.. When the primary RDS PostgreSQL instance fails in a Multi-AZ deployment, AWS automatically fails over to the standby instance in a different Availability Zone. The DNS endpoint (CNAME) remains the same, but its resolution is updated to point to the standby instance's IP address. The application must reconnect to the same endpoint, as existing connections to the failed primary are dropped; after reconnection, traffic is seamlessly routed to the new primary.

Answer

The application will be automatically redirected to a read replica.

Answer

The administrator must manually change the CNAME to point to the standby.

Answer

The application must use a new endpoint in a different AWS Region.

Question 6

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

Accepted Answer

AWS Config with a custom rule and AWS Lambda. AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Answer

AWS CloudTrail and Amazon CloudWatch Events

Answer

AWS Service Catalog and AWS Organizations

Answer

Amazon Inspector and AWS Systems Manager

Question 7

Refer to the exhibit. A SysOps administrator creates an IAM policy to allow an EC2 instance to upload objects to an S3 bucket. However, the instance is unable to upload objects. What is the MOST likely reason?

Accepted Answer

The IAM role is not attached to the EC2 instance.. The IAM role must be attached to the EC2 instance as an instance profile for the instance to assume the role and obtain temporary credentials. Without this attachment, the instance has no valid AWS credentials to sign API requests, so the s3:PutObject action will fail regardless of the permissions defined in the role's policy.

Answer

The S3 bucket has server-side encryption enabled.

Answer

The policy does not include s3:GetObject permission.

Answer

The bucket policy denies all access.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack enters a ROLLBACK_IN_PROGRESS state. Which TWO methods can achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the CloudFormation stack status change.. Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack status changes, including ROLLBACK_IN_PROGRESS, by matching the 'CloudFormation Stack Status Change' event pattern. This allows you to trigger a notification action (e.g., via SNS or Lambda) in real time when the stack enters that state.

Answer

Use AWS Config rules to evaluate the stack state.

Answer

Configure a CloudWatch Logs subscription filter to detect the stack state.

Answer

Create a CloudTrail trail and monitor the UpdateStack API call.

Question 9

Which THREE of the following are valid options for connecting a VPC to an on-premises network? (Select THREE.)

Accepted Answer

Transit gateway with VPN attachment. A Transit Gateway with a VPN attachment allows you to connect your VPC to an on-premises network by acting as a central hub that interconnects VPCs and on-premises networks via IPsec VPN tunnels. This is a valid option because the Transit Gateway can terminate multiple VPN connections, enabling hybrid connectivity with centralized routing and scalability.

Answer

VPC peering

Answer

VPC endpoint

Question 10

Which TWO configurations can improve the performance of an Amazon RDS for PostgreSQL database that is experiencing high read latency? (Choose TWO.)

Accepted Answer

Enable provisioned IOPS on the DB instance.. Enabling Provisioned IOPS on an Amazon RDS for PostgreSQL database provides consistent and predictable I/O performance, which directly reduces read latency by ensuring sufficient IOPS for read-intensive workloads. Option C is correct because creating a read replica offloads read traffic from the primary DB instance to the replica, reducing contention and improving read latency for the primary instance.

Answer

Upgrade to a larger instance size.

Answer

Enable Multi-AZ deployment.

Answer

Enable storage auto-scaling.