SOA-C02 Practice Test 11 — 15 Questions

Question 1

A company is using Amazon CloudWatch Logs to collect logs from multiple AWS services. The SysOps administrator needs to query logs across multiple log groups in real-time. Which THREE of the following are capabilities of CloudWatch Logs Insights?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run queries in real-time against incoming log data.. CloudWatch Logs Insights supports real-time queries against incoming log data, allowing you to analyze logs as they are ingested. This is enabled by its ability to query live streams without requiring data to be indexed first, making it suitable for real-time troubleshooting and monitoring.

Answer

Export query results directly to an S3 bucket.

Answer

Schedule queries to run at a specific time.

Question 2

Which TWO actions can be used to protect data in transit between an EC2 instance and an S3 bucket? (Choose two.)

Accepted Answer

Use HTTPS instead of HTTP when accessing S3 from the EC2 instance.. Option C is correct because using HTTPS (TLS) when accessing S3 from the EC2 instance encrypts the data in transit between the instance and S3, protecting it from interception or tampering on the network. Option E is correct because an S3 VPC endpoint (gateway endpoint for S3) keeps traffic between the VPC and S3 on the AWS private network, so it does not traverse the public internet, reducing exposure to interception. Option A is incorrect because security groups control which traffic is allowed to and from the instance but do not encrypt or otherwise protect the data in transit. Option B is incorrect because the x-amz-server-side-encryption header relates to server-side encryption of data at rest, not protection of data in transit. Option D is incorrect because S3 default encryption (SSE-S3) encrypts objects at rest in the bucket, not data moving between the EC2 instance and S3.

Answer

Configure security group rules on the EC2 instance to allow only S3 traffic.

Answer

Apply an S3 bucket policy that denies access unless the request includes the x-amz-server-side-encryption header.

Answer

Enable S3 default encryption (SSE-S3) on the bucket.

Question 3

A SysOps administrator is configuring an Amazon RDS for MySQL Multi-AZ deployment. What is the primary benefit of using Multi-AZ?

Accepted Answer

Automatic failover to a standby instance in a different Availability Zone.. In Amazon RDS for MySQL Multi-AZ deployments, the primary benefit is automatic failover to a standby instance in a different Availability Zone. This is achieved through synchronous replication to a standby in a separate AZ, ensuring that if the primary instance fails, RDS automatically promotes the standby to become the new primary, minimizing downtime and maintaining data durability.

Answer

Improved read performance by distributing queries across multiple instances.

Answer

Synchronous replication across AWS Regions.

Answer

Automatic creation of read replicas for disaster recovery.

Question 4

A SysOps administrator is troubleshooting an issue where an EC2 instance has failed a status check. The instance is still running but is unresponsive. Which THREE actions should the administrator take to diagnose and resolve the issue? (Choose THREE.)

Accepted Answer

Check the system status checks in the EC2 console.. System status checks (Option B) monitor the underlying physical host for issues like network or power loss, while instance status checks (like system log in Option C) detect OS-level problems. Reviewing the system log helps identify kernel panics or boot failures. Stopping and starting the instance (Option E) forces a migration to a new physical host, which can resolve host-level impairments without losing the instance's configuration or data.

Answer

Reboot the instance.

Answer

Restore the instance from the latest AMI.

Question 5

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application stores session data on local instance storage. Users report that they are unexpectedly logged out during peak traffic. Which action should the SysOps Administrator take to improve reliability?

Accepted Answer

Configure an ElastiCache Redis cluster to store session state externally.. Storing session data on local instance storage is ephemeral; if an instance is terminated or replaced during scaling events, session data is lost, causing users to be logged out. Moving session state to an external, highly available service like ElastiCache Redis ensures persistence across instance lifecycles and improves reliability under peak traffic.

Answer

Move the session storage to an instance store volume.

Answer

Enable sticky sessions on the Application Load Balancer.

Answer

Increase the size of the Auto Scaling group to handle peak traffic.

Question 6

A SysOps administrator deploys the above CloudFormation template. The stack creation fails with an error. What is the most likely reason?

Accepted Answer

The VolumeAttachment resource is missing the Device property.. The VolumeAttachment resource in AWS CloudFormation requires the Device property to specify the device name (e.g., /dev/sdf) for the attached EBS volume. Without this property, CloudFormation cannot determine the mount point, causing the stack creation to fail. The error occurs because the template omits this required field.

Answer

The EBS volume must specify a SnapshotId.

Answer

The template uses a deprecated AWSTemplateFormatVersion.

Answer

The instance and volume are in different Availability Zones.

Question 7

A company uses CloudWatch Logs to store application logs from EC2 instances. The SysOps team needs to search for specific error patterns across all log groups. What is the most efficient way to perform this search?

Accepted Answer

Use CloudWatch Logs Insights to run a query across the log groups.. CloudWatch Logs Insights is purpose-built for ad-hoc querying and analysis of log data across multiple log groups. It allows you to run SQL-like queries (using a query language) to search for specific patterns, filter results, and aggregate data without needing to set up additional infrastructure. This is the most efficient method for the SysOps team's requirement because it provides immediate, interactive search capabilities directly within the AWS Management Console or via the AWS CLI.

Answer

Define a CloudWatch metric filter to count errors and view the metric.

Answer

Create a subscription filter to stream logs to Amazon ES and use Kibana.

Answer

Export the logs to Amazon S3 and use S3 Select to search.

Question 8

An application running on Amazon ECS (Fargate) is experiencing intermittent failures. The logs show 'CannotPullContainerError: error pulling image configuration: download failed after attempts=6'. The SysOps team has verified that the image exists in Amazon ECR and the task role has permissions to pull from ECR. What is the most likely cause?

Accepted Answer

The ECS tasks are in a private subnet without a NAT gateway or VPC endpoints for ECR and S3.. The error 'CannotPullContainerError: error pulling image configuration: download failed after attempts=6' indicates that the ECS task is unable to download the image layers from Amazon ECR. Since the image exists and the task role has permissions, the most likely cause is a network connectivity issue. When ECS tasks run in a private subnet without a NAT gateway or VPC endpoints for ECR and S3, they cannot reach the public ECR API endpoints or the S3 buckets that store image layers, causing the pull to fail after multiple retries.

Answer

The container image is corrupted.

Answer

The ECR repository policy is not allowing the task role.

Answer

The ECS task definition has an incorrect memory allocation.

Question 9

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified when a stack creation fails. Which solution meets this requirement with the LEAST effort?

Accepted Answer

Configure an SNS topic in the CloudFormation stack's 'NotificationARNs' parameter.. CloudFormation natively supports specifying an SNS topic in the 'NotificationARNs' parameter, which automatically sends notifications on stack events such as creation failure. This requires no additional infrastructure, scripting, or monitoring setup, making it the least-effort solution.

Answer

Create a CloudWatch alarm that triggers when the CloudFormation stack status is 'CREATE_FAILED'.

Answer

Use AWS CloudTrail to monitor CreateStack API calls and trigger an SNS notification.

Answer

Write a custom script that polls the CloudFormation API every minute and sends an SNS notification on failure.

Question 10

A SysOps administrator needs to grant cross-account access to an S3 bucket in Account A for an IAM user in Account B. The bucket policy in Account A allows the IAM user's account root principal. What additional configuration is required?

Accepted Answer

Attach an IAM policy to the user in Account B that allows the required S3 actions. D is correct because cross-account access to an S3 bucket requires both a bucket policy that grants access to the root principal of the target account (Account B) and an IAM policy attached to the user in Account B that explicitly allows the desired S3 actions. Without the IAM policy, the user in Account B has no permissions to perform any S3 operations, even though the bucket policy in Account A permits the account root. The IAM policy acts as the identity-based permission that authorizes the specific user to invoke the S3 API calls.

Answer

Modify the AWS KMS key policy to allow the user in Account B

Answer

Add a bucket ACL granting access to the user in Account B

Answer

Add an AWS Organizations service control policy to allow access

Question 11

A company is experiencing intermittent performance issues with an application running on an EC2 instance. The CloudWatch metrics show high CPU utilization but no correlation with the timing of the issue. The SysOps administrator needs to collect detailed performance data to identify the root cause. Which AWS service should the administrator use to capture network-level metrics and logs?

Accepted Answer

Enable VPC Flow Logs for the EC2 instance's subnet.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet count) at the network interface level, which is essential for diagnosing network-related performance issues. Since the problem is intermittent and uncorrelated with CPU, network-level metrics can reveal issues like packet loss, throttling, or latency that application logs or CPU metrics alone cannot. This directly addresses the need for detailed network-level data.

Answer

Configure a CloudWatch Logs agent on the instance to send application logs.

Answer

Use AWS CloudTrail to log all API calls made to the instance.

Answer

Enable AWS Config to track configuration changes to the instance.

Question 12

A SysOps administrator is troubleshooting an issue where an EC2 instance's CPU utilization is consistently above 90%, but no CloudWatch alarm is triggered. The alarm is configured to monitor the 'CPUUtilization' metric with a threshold of 80% for 2 consecutive periods of 5 minutes. What is the most likely cause?

Accepted Answer

The CPU utilization spikes above 80% for less than 10 minutes at a time.. The CloudWatch alarm requires 2 consecutive periods of 5 minutes (i.e., 10 minutes total) where the CPU utilization exceeds 80%. If the CPU utilization spikes above 80% for less than 10 minutes at a time, the alarm will not trigger because it never meets the consecutive evaluation period requirement. The alarm evaluates each 5-minute period independently, and only when both consecutive periods breach the threshold does the alarm state change to ALARM.

Answer

The alarm is in the 'OK' state and not 'INSUFFICIENT_DATA'.

Answer

The CPUUtilization metric is not enabled by default for EC2 instances.

Answer

The alarm period is set to 5 minutes, but the metric is reported every 1 minute.

Question 13

A SysOps administrator is troubleshooting connectivity issues between Amazon EC2 instances in two different VPCs that are connected via a VPC peering connection. The instances can successfully send ICMP (ping) traffic, but TCP connections on port 443 (HTTPS) fail. The security groups of both instances allow all inbound and outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The Network ACL associated with the subnets is blocking the return traffic for TCP connections on ephemeral ports. The Network ACL (NACL) is stateless, meaning it must explicitly allow both inbound and outbound traffic. While ICMP (ping) works because it doesn't rely on ephemeral ports for return traffic, TCP connections on port 443 require the return traffic to come from the target instance on a high ephemeral port (typically 1024-65535). If the NACL's outbound rules block these ephemeral ports, the TCP handshake fails, even though the security groups allow all traffic.

Answer

The VPC peering connection is not properly configured for TCP traffic

Answer

The route tables in the VPCs do not contain a route for the other VPC's CIDR

Answer

The security group on the EC2 instance is blocking inbound TCP traffic on port 443

Question 14

A company runs a multi-tier application that uses an Amazon RDS for PostgreSQL database. The SysOps administrator needs to monitor the database for performance anomalies, such as sudden spikes in connections or query latencies. The administrator wants to receive alerts when metrics deviate from their expected baseline. The solution must automatically adjust to changes in normal behavior over time, such as seasonal patterns. Which AWS service or feature should the administrator use?

Accepted Answer

Configure Amazon CloudWatch Anomaly Detection on the relevant RDS metrics (e.g., DatabaseConnections, ReadLatency, WriteLatency) and set an alarm to notify when the metric breaches the anomaly band.. Amazon CloudWatch Anomaly Detection uses machine learning to continuously analyze metric patterns and establish a dynamic baseline that adapts to seasonal trends and gradual changes in normal behavior. By applying anomaly detection to RDS metrics like DatabaseConnections, ReadLatency, and WriteLatency, the administrator can set an alarm that triggers when a metric deviates outside the calculated anomaly band, automatically adjusting to evolving traffic patterns without manual threshold updates.

Answer

Use Amazon RDS Performance Insights to analyze database load and set CloudWatch alarms on the DBLoad metric with static thresholds.

Answer

Enable Amazon CloudWatch Metrics Explorer to create a dashboard that visualizes the metrics and manually review for anomalies.

Answer

Use AWS X-Ray to trace database queries and set alarms on trace segment durations.

Question 15

A company uses Amazon CloudWatch Logs to store application logs. The SysOps administrator needs to count the occurrences of the string 'ERROR' in the logs and trigger an Amazon SNS notification when more than 10 errors occur within a 5-minute window. Which steps should the administrator take?

Accepted Answer

Create a metric filter on the log group and then create a CloudWatch alarm on the resulting metric. A metric filter on a CloudWatch Logs log group extracts a numeric metric (e.g., count of 'ERROR' occurrences) and publishes it to a CloudWatch custom metric. A CloudWatch alarm can then be configured on that metric to evaluate a threshold (e.g., >10) over a specified period (e.g., 5 minutes) and trigger an SNS notification when breached. This is the native, serverless, and cost-effective approach for counting log patterns and alerting.

Answer

Create a CloudWatch alarm directly on the log group

Answer

Create an AWS Lambda function to parse the logs and send a notification to Amazon SNS

Answer

Create an Amazon EventBridge rule to filter log events and send to SNS