SOA-C02 Practice Test 11 — 15 Questions

Question 1

A company runs a global e-commerce application that uses Amazon DynamoDB as its primary database. The application requires single-digit millisecond read and write latency from any region and must continue to operate during a regional outage with minimal data loss. Which DynamoDB feature should the SysOps administrator enable to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DynamoDB global tables. DynamoDB global tables provide multi-Region, multi-active replication, enabling single-digit millisecond reads and writes from any Region while offering automatic failover and recovery during a regional outage. This feature uses DynamoDB Streams to replicate data across Regions with eventual consistency, meeting the requirement for continued operation with minimal data loss.

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB Point-in-Time Recovery (PITR)

Answer

DynamoDB Auto Scaling

Question 2

Refer to the exhibit. A SysOps administrator runs this CloudWatch Logs Insights query against an application log group. The query returns no results, even though the administrator knows that errors occurred in the last hour. What is the most likely cause?

Accepted Answer

The log group contains too many log events, causing the query to time out.. In CloudWatch Logs Insights, `stats count() by bin(5m)` is valid syntax; `bin()` does not require a preceding field. Therefore option A is not the cause. The most likely cause among the options is that the log group contains too many log events, causing the query to time out before results are returned. Retention policy does not affect events from the last hour, and `@message` is a valid field.

Answer

The 'stats' command requires a 'by' clause with a field name, but 'bin(5m)' is invalid.

Answer

The @message field is not a valid field in CloudWatch Logs Insights.

Answer

The log group's retention policy is set to 1 day and the data is older than the retention period.

Question 3

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts have encryption enabled. What is the most efficient way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies S3 actions without encryption.. A service control policy (SCP) applied to the root organizational unit in AWS Organizations can centrally enforce encryption requirements for all S3 buckets across every member account. By denying S3 actions (such as s3:PutObject) unless the request includes encryption parameters (e.g., x-amz-server-side-encryption), the SCP acts as a guardrail that cannot be overridden by account-level IAM policies, ensuring compliance without per-account configuration.

Answer

Configure an IAM role in the master account to enforce encryption via cross-account access.

Answer

Create an IAM policy in each account that denies s3:PutObject without encryption.

Answer

Use AWS CloudFormation StackSets to deploy a bucket policy to each account.

Question 4

A company has a production environment with multiple EC2 instances running a web application. The SysOps administrator wants to automate the remediation of instances that fail the EC2 status check. Which approach should the administrator use?

Accepted Answer

Create an Amazon EventBridge rule that matches EC2 status check failures and triggers an AWS Lambda function to terminate the instance and launch a new one.. It provides a fully automated, event-driven remediation workflow. When an EC2 instance fails a status check, an EventBridge rule detects the state change and triggers a Lambda function that terminates the unhealthy instance and launches a replacement. This approach directly addresses the requirement to automate remediation without manual intervention.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure an SNS notification to alert the team.

Answer

Use AWS Systems Manager Automation to create a document that runs a script on the instance to fix the issue.

Answer

Configure the Auto Scaling group's health check to use EC2 status checks and set a custom termination policy.

Question 5

A company is deploying a new web application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) with specific software pre-installed. The SysOps administrator creates a custom AMI and configures Elastic Beanstalk to use it. However, during deployment, the instances fail to pass the health check. The health check endpoint is a simple 'index.html' file. What is the MOST likely cause?

Accepted Answer

The custom AMI does not have a web server installed and configured to serve the application.. Elastic Beanstalk expects the web server (e.g., Apache, Nginx) to be installed and configured to serve the application. If the custom AMI does not have a web server installed, the health check endpoint will not respond. Option A is incorrect because the environment URL is created regardless of the AMI. Option C is incorrect because Elastic Beanstalk does not require a specific AMI ID; it uses the one provided. Option D is incorrect because the health check is based on HTTP response, not instance status checks.

Answer

The Elastic Beanstalk environment was created before the custom AMI was registered.

Answer

The custom AMI is not registered with the same account that owns the Elastic Beanstalk environment.

Answer

The custom AMI does not have the latest patches, causing the instance to fail the EC2 status checks.

Question 6

An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?

Accepted Answer

The NAT gateway's subnet does not have a route to an internet gateway. The NAT gateway must be in a public subnet with a route table that includes a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, because the IGW is the only way to reach public IP addresses. The question states the NAT gateway is deployed in a public subnet, but if that subnet's route table lacks the IGW route, outbound traffic from the NAT gateway will fail.

Answer

The private subnet's network ACL blocks outbound HTTPS traffic

Answer

The security group attached to the NAT gateway does not allow outbound traffic

Answer

The private instances do not have a public IP address assigned

Question 7

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB) in the us-west-2 Region. Users are distributed globally and experience high latency. The SysOps administrator wants to improve latency and offload SSL termination to the edge. Which AWS service should be used with the ALB as the origin?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations worldwide, reducing latency for global users. It can offload SSL termination at the edge by accepting HTTPS requests from clients and forwarding them to the ALB over HTTP or HTTPS, thereby reducing the load on the origin. This directly addresses the requirements of improving latency and offloading SSL termination.

Answer

AWS Global Accelerator

Answer

AWS WAF (Web Application Firewall)

Answer

Amazon Route 53 with Latency Based Routing

Question 8

A SysOps administrator wants to deploy a new version of an application to an existing Auto Scaling group of Amazon EC2 instances. The deployment must minimize disruption by launching new instances, performing health checks, and shifting traffic to the new instances before terminating the old ones. Which AWS CodeDeploy deployment configuration should the administrator choose?

Accepted Answer

Blue/green. The blue/green deployment configuration in AWS CodeDeploy is designed to minimize disruption by provisioning a new set of instances (green environment), performing health checks against them, and then shifting traffic from the old instances (blue environment) to the new ones before terminating the old instances. This matches the requirement of launching new instances, health-checking, and shifting traffic before termination, which is not possible with in-place deployment types like rolling or all-at-once.

Answer

Rolling

Answer

AllAtOnce

Answer

Canary

Question 9

A SysOps administrator creates the above IAM policy for a user. The user reports that they cannot delete an object in the bucket 'my-bucket' even though they are using MFA. What is the likely cause?

Accepted Answer

The user is not using MFA when making the API call.. The policy requires MFA for all s3:DeleteObject actions, as indicated by the condition key aws:MultiFactorAuthPresent set to 'true'. If the user reports they cannot delete an object despite using MFA, the most likely cause is that they are not actually using MFA when making the API call — for example, they may have authenticated with long-term credentials (access key/secret key) without a multi-factor authentication session. The condition key checks the presence of an MFA-authenticated session token, not just whether the user has MFA enabled on their account.

Answer

The resource ARN is missing the bucket-level permission.

Answer

The condition key aws:MultiFactorAuthPresent is incorrectly spelled.

Answer

The policy does not include s3:DeleteObjectVersion.

Question 10

An organization uses AWS OpsWorks for configuration management. The SysOps administrator notices that a stack's instances are not receiving the updated custom cookbooks after a new deployment. The cookbooks are stored in a private GitHub repository. What is the most likely cause?

Accepted Answer

The SSH key for the Git repository is not configured in the stack.. AWS OpsWorks uses the SSH key configured in the stack to clone private Git repositories. Without a valid SSH key, the cookbook update fails silently. Option A is incorrect because cookbooks can be stored in S3 or Git; S3 is not required. Option B is incorrect because the OpsWorks agent must be running, but the symptom of a missing SSH key is specific to private repositories. Option C is incorrect while instances need internet access to reach GitHub, a missing SSH key is a more specific cause for private repos.

Answer

The cookbooks are not stored in an S3 bucket.

Answer

The OpsWorks agent is not running on the instances.

Answer

The instances do not have internet access.

Question 11

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending a notification via Amazon SNS, when a status check fails. This is the native AWS service designed for real-time monitoring and alerting on metric thresholds, making it the correct choice for this use case.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 12

A company runs a critical database on an RDS for PostgreSQL instance in a single Availability Zone. The database experiences high write latency. The SysOps Administrator needs to improve the database's reliability and performance without downtime. Which solution meets these requirements?

Accepted Answer

Modify the RDS instance to be Multi-AZ with a standby in another Availability Zone.. Enabling Multi-AZ for an RDS for PostgreSQL instance provisions a standby replica in a different Availability Zone and synchronously replicates data to it. This eliminates the single point of failure, improving reliability. The modification is performed as a zero-downtime operation via a DNS update, meeting the requirement for no downtime. Note that Multi-AZ improves availability but does not reduce write latency; performance improvement may come from offloading backups and other administrative tasks to the standby.

Answer

Create a Multi-AZ deployment in the same Availability Zone.

Answer

Increase the allocated storage for the RDS instance.

Answer

Create a read replica in another Availability Zone and redirect read traffic.

Question 13

A SysOps administrator needs to allow traffic from a specific IP address range (203.0.113.0/24) to access an Amazon EC2 instance in a VPC. Which configuration step should be performed?

Accepted Answer

Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.. Security groups act as a virtual firewall for EC2 instances, allowing you to specify inbound rules to permit traffic from specific IP ranges like 203.0.113.0/24. Option A is incorrect because IAM policies manage permissions for AWS actions, not network traffic filtering. Option B is incorrect because network ACLs provide stateless filtering at the subnet level, but security groups are more appropriate for instance-level control and are stateful. Option C is incorrect because route tables control the direction of outbound traffic and do not restrict inbound access to instances.

Answer

Create an IAM policy that allows inbound traffic from 203.0.113.0/24.

Answer

Add a rule to the network ACL associated with the subnet to allow inbound traffic from 203.0.113.0/24.

Answer

Modify the route table of the subnet to include a route for 203.0.113.0/24 to the internet gateway.

Question 14

A SysOps administrator is troubleshooting an application that runs on an EC2 instance. The application is experiencing high latency, and the administrator suspects a memory leak. Which metrics should the administrator examine first?

Accepted Answer

Custom CloudWatch metrics published by the CloudWatch agent, such as mem_used_percent.. A memory leak causes the application to consume increasing amounts of memory over time, leading to high latency as the OS begins swapping or the kernel reclaims memory. The CloudWatch agent can publish custom metrics like `mem_used_percent`, which directly tracks memory usage percentage and is the most relevant metric to confirm a memory leak. Default EC2 metrics do not include memory utilization, so the administrator must rely on custom metrics from the CloudWatch agent.

Answer

CloudWatch metrics from the Detailed Monitoring feature, such as DiskReadOps.

Answer

CloudWatch metrics for the instance's Elastic Network Interface.

Answer

CloudWatch default EC2 metrics, such as CPUUtilization and NetworkIn.

Question 15

A company stores sensitive data in an RDS database. Which AWS service should be used to encrypt the database at rest?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) provides encryption keys that can be used to enable encryption at rest for Amazon RDS databases. Option A is incorrect because AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for encryption at rest. Option B is incorrect because AWS Identity and Access Management (IAM) manages user identities and permissions, not encryption keys. Option D is incorrect because AWS CloudHSM provides hardware security modules but is not the primary service used for RDS encryption; KMS is the simpler and recommended service for RDS encryption.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM