SOA-C02 Practice Test 11 — 15 Questions

Question 1

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent timeouts. The web server logs show HTTP 503 errors. Which configuration is MOST likely causing the issue?

Accepted Answer

The target group health checks are misconfigured or the instances are unhealthy.. HTTP 503 errors from an ALB indicate that the load balancer cannot route requests to healthy targets. Misconfigured health checks or unhealthy instances cause the ALB to mark targets as unhealthy, leading to 503 responses even if the instances are running. This is the most direct cause of intermittent timeouts when the web server logs show 503 errors.

Answer

The ALB idle timeout is set too low.

Answer

The target group is not configured with enough capacity.

Answer

The security group for the ALB does not allow inbound traffic on port 80.

Question 2

Which TWO features are provided by Amazon CloudFront to secure content delivery? (Choose two.)

Accepted Answer

AWS WAF integration to filter requests based on rules. Options A and C are correct: AWS WAF integration with CloudFront allows you to filter malicious requests, and signed URLs/cookies provide access control to content. Option B is wrong because CloudFront supports custom SSL certificates via SNI or dedicated IP, not by default. Option D is wrong because CloudFront uses the AWS global network, not a VPN. Option E is wrong because CloudFront does not provide DDoS protection by default; AWS Shield is the DDoS protection service.

Answer

Default support for custom SSL certificates without additional configuration

Answer

AWS Shield Advanced for DDoS protection

Answer

VPN connection between CloudFront and the origin

Question 3

Refer to the exhibit. An IAM role has the trust policy shown. Which entity can assume this role?

Accepted Answer

Any IAM user in the AWS account 123456789012. Option B is correct because the trust policy allows the root user of the same account (arn:aws:iam::123456789012:root) to assume the role. This includes all IAM users in that account. Option A is incorrect because the policy does not specify any user ARN. Option C is incorrect because the policy does not allow external accounts. Option D is incorrect because the condition is empty and does not require MFA.

Answer

Only the IAM user with the ARN arn:aws:iam::123456789012:user/Admin

Answer

Any IAM user in any AWS account

Answer

Only users who have MFA enabled

Question 4

A company wants to enforce that all IAM users in an AWS account must use multi-factor authentication (MFA) to access the AWS Management Console. Which IAM policy effect should be used to deny access if MFA is not present?

Accepted Answer

Deny with a condition that aws:MultiFactorAuthPresent is false. The correct approach is to use a Deny effect in a condition that checks if MFA is present. Option B is correct because it denies access when the condition 'aws:MultiFactorAuthPresent' is false. Option A is wrong because Allow would grant access even without MFA. Option C is wrong because it allows access only when MFA is present, but does not deny when missing. Option D is wrong because it allows access when MFA is not present.

Answer

Allow with a condition that aws:MultiFactorAuthPresent is false

Answer

Allow with a condition that aws:MultiFactorAuthPresent is true

Answer

Deny with a condition that aws:MultiFactorAuthPresent is true

Question 5

A company uses AWS CloudTrail to log API calls. The SysOps team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and triggers an automated response. Which combination of services should be used? (Choose two.)

Accepted Answer

AWS Lambda. The correct answer is A and D. CloudWatch Events (Amazon EventBridge) can match a pattern for StopLogging API calls and trigger a Lambda function to take corrective action (e.g., re-enable logging). Options B and C are wrong because AWS Config records resource changes but is not real-time for event-driven responses. Option E is wrong because SQS alone does not process events.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon Simple Queue Service (SQS)

Question 6

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to maintain user session state. Which configuration ensures session stickiness with minimal performance impact?

Accepted Answer

Enable sticky sessions on the Application Load Balancer using a load balancer-generated cookie.. Option B is correct because ALB sticky sessions use a cookie to bind a user's session to a specific target, which is the simplest and most efficient method. Option A is incorrect because an NLB does not natively support sticky sessions with cookies. Option C is incorrect because DynamoDB would add latency and complexity. Option D is incorrect because CloudFront is for content delivery, not session stickiness.

Answer

Use Amazon CloudFront with origin stickiness enabled.

Answer

Use a Network Load Balancer (NLB) with target group stickiness.

Answer

Store session state in Amazon DynamoDB and have each instance read from DynamoDB.

Question 7

A SysOps administrator needs to grant an IAM user the ability to rotate their own access keys. What is the minimum set of permissions required?

Accepted Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey. The minimum permissions are iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, and iam:UpdateAccessKey. Option B is correct. Option A is wrong because it includes iam:PutUserPolicy which is unnecessary. Option C is wrong because it grants global key management. Option D is wrong because it includes iam:GetUser which is not needed.

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:PutUserPolicy

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, kms:*

Answer

iam:GetUser, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey

Question 8

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any member account can create access keys that are more than 90 days old. What is the most efficient way to enforce this?

Accepted Answer

Use a service control policy (SCP) to deny the iam:CreateAccessKey action unless a condition is met. The most efficient way is to use a service control policy (SCP) that denies the creation of access keys if the user does not have an existing key older than 90 days, or by using a condition on the CreateAccessKey action. Option D is correct. Option A is wrong because it requires per-account Config rules. Option B is wrong because CloudTrail does not enforce. Option C is wrong because it is reactive, not preventive.

Answer

Use CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to disable old keys

Answer

Use AWS Config rules in each account to detect keys older than 90 days and automatically delete them

Answer

Create an IAM policy that denies CreateAccessKey if the user has any key older than 90 days

Question 9

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot pull secrets from AWS Secrets Manager. The instance has an IAM role with a policy that allows secretsmanager:GetSecretValue. The secret is in the same account and region. What are possible reasons for the failure? (Choose THREE.)

Accepted Answer

The EC2 instance is in a private subnet with no route to the internet or a VPC endpoint for Secrets Manager. Possible reasons include: the secret is encrypted with a KMS CMK that the role does not have access to (A), the VPC endpoint policy for Secrets Manager denies the action (B), and the instance is in a private subnet without a VPC endpoint or NAT gateway (C). Option D is wrong because cross-account is not needed. Option E is wrong because the instance profile is already associated with the role.

Answer

The secret is in a different AWS account

Answer

The IAM role is not attached to the instance profile

Question 10

A SysOps administrator is configuring CloudTrail to log all management events and data events for S3 buckets. Which of the following are true about CloudTrail logging? (Choose THREE.)

Accepted Answer

CloudTrail logs include the identity of the user who made the API call. Data events for S3 can be logged, but they incur additional costs (option A). Management events are logged by default (option B). CloudTrail cannot log events across all AWS services automatically; it must be configured per service (option C is wrong). Option D is correct because CloudTrail logs include API caller identity. Option E is correct because logs can be delivered to CloudWatch Logs.

Answer

Data events for S3 are logged by default for all buckets

Answer

CloudTrail can log events for all AWS services automatically

Question 11

A company wants to use AWS WAF to protect a web application behind an Application Load Balancer. Which of the following can AWS WAF inspect? (Choose THREE.)

Accepted Answer

HTTP headers. AWS WAF can inspect HTTP headers (A), URI paths (B), and query string parameters (C). Option D is wrong because WAF does not inspect the body of HTTPS requests by default; it can inspect the body if the request is HTTP. Option E is wrong because WAF does not inspect SSL certificate details.

Answer

SSL certificate of the client

Answer

Request body of HTTPS requests

Question 12

A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?

Accepted Answer

The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.. Option C is correct because ALB health checks originate from the ALB's private IP addresses within the VPC, not from the internet or the ALB's public IP. If the subnet's network ACL does not allow inbound traffic from the ALB's subnet CIDR, health checks will fail. Option A is incorrect because security groups are stateful; return traffic is allowed automatically. Option B is incorrect because the ALB can communicate within the VPC without an internet gateway. Option D is incorrect because the ALB uses its own security group, not the instance's.

Answer

The instance security group does not allow outbound traffic to the ALB.

Answer

The ALB security group does not allow outbound traffic to the instances.

Answer

The ALB is in a public subnet without an internet gateway.

Question 13

Refer to the exhibit. A SysOps administrator runs the commands shown. Which key(s) have automatic key rotation enabled?

Accepted Answer

Only the first key. The output shows that key 1234abcd-12ab-34cd-56ef-1234567890ab has KeyRotationEnabled set to true, so it has automatic rotation enabled. Key 0987fedc-87fe-65dc-43ba-abcdef123456 has false. Option A is correct. Options B, C, D are incorrect.

Answer

Only the second key

Answer

Neither key

Answer

Both keys

Question 14

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used to track these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including IAM policy changes. Option B is correct. Option A is wrong because AWS Config records resource configuration but not API calls. Option C is wrong because CloudWatch is for monitoring metrics. Option D is wrong because Trusted Advisor provides best practice checks.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Question 15

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts have encryption enabled. What is the most efficient way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies S3 actions without encryption.. Option D is correct because using a service control policy (SCP) in AWS Organizations allows you to centrally enforce permissions across all accounts. Option A is wrong because SCPs are the tool for this, not individual account policies. Option B is wrong because CloudFormation StackSets would require manual deployment. Option C is wrong because IAM roles don't enforce bucket encryption.

Answer

Configure an IAM role in the master account to enforce encryption via cross-account access.

Answer

Create an IAM policy in each account that denies s3:PutObject without encryption.

Answer

Use AWS CloudFormation StackSets to deploy a bucket policy to each account.