SOA-C02 Practice Test 12 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator needs to monitor the application's HTTP 5xx error rate and set an alarm when the error rate exceeds 5% over a 5-minute period. The alarm must trigger an Amazon SNS notification. Which metric should be used for the alarm?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HTTPCode_Target_5XX_Count. The alarm must monitor the error rate from the application targets (EC2 instances) behind the ALB. HTTPCode_Target_5XX_Count tracks HTTP 5xx responses generated by the targets themselves, which directly reflects application-level errors. To calculate the error rate, you would divide this metric by RequestCount, but the metric itself is the correct source for target-side 5xx errors.

Answer

HTTPCode_ELB_5XX_Count

Answer

RequestCount

Answer

TargetResponseTime

Question 2

A company runs a batch processing job on Amazon EC2 instances that runs for 3 hours each night. The job can be interrupted and can resume from the last checkpoint without data loss. The SysOps administrator wants to minimize compute costs for this workload. Which Amazon EC2 purchasing option should be used?

Accepted Answer

Spot Instances. Spot Instances are correct because the batch job is fault-tolerant (can be interrupted and resume from checkpoints) and runs for a fixed 3-hour window nightly. Spot Instances offer significant cost savings (up to 90% off On-Demand) by using spare EC2 capacity, which can be reclaimed by AWS with a 2-minute interruption notice. Since the workload can handle interruptions gracefully, Spot Instances minimize compute costs while meeting the job's requirements.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Hosts

Question 3

A company has an Application Load Balancer (ALB) that routes traffic to an Auto Scaling group of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The EC2 instances have a security group that allows inbound traffic from the ALB's security group. Users report intermittent 503 errors. What is the most likely cause?

Accepted Answer

The EC2 instances are not passing the ALB health checks.. The 503 Service Unavailable error from an Application Load Balancer typically indicates that the target instances are not healthy and are not passing the configured health checks. When the ALB's health checks fail, it stops routing traffic to those instances, resulting in 503 errors for users. Since the security group configurations appear correct (ALB allows inbound HTTP from 0.0.0.0/0 and EC2 allows traffic from the ALB's security group), the most likely cause is that the EC2 instances are failing health checks due to application-level issues, such as the web server not responding on the health check path or port.

Answer

The ALB is deployed in a private subnet without a NAT gateway.

Answer

The target group is configured with an incorrect protocol or port.

Answer

The security group on the ALB does not allow inbound traffic from the internet.

Question 4

A company has an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances in private subnets of a VPC. The SysOps administrator needs to ensure that the EC2 instances can download software updates from the internet, but they must not be directly accessible from the internet. The solution should minimize operational overhead. Which solution should the administrator implement?

Accepted Answer

Attach a NAT Gateway to a public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway.. A NAT Gateway (option B) allows EC2 instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. It is a fully managed AWS service that automatically scales and requires no patching, minimizing operational overhead compared to a NAT instance. The private subnet route table directs 0.0.0.0/0 traffic to the NAT Gateway, which is placed in a public subnet with an Elastic IP address to enable internet access.

Answer

Place the EC2 instances in a public subnet and configure security group inbound rules to block all traffic.

Answer

Launch a NAT instance in a public subnet with an Elastic IP address and configure route tables accordingly.

Answer

Attach an Internet Gateway to the VPC and add a route to the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.

Question 5

A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are configured with server-side encryption using AWS KMS (SSE-KMS). The administrator wants to automatically detect any S3 buckets that are not compliant and remediate them by enabling SSE-KMS. Which AWS service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled) that can continuously evaluate S3 buckets for compliance with SSE-KMS. When a non-compliant bucket is detected, AWS Config can trigger an AWS Systems Manager Automation document or a custom remediation action (via AWS Config Rules remediation) to automatically enable SSE-KMS on the bucket, ensuring automated enforcement without manual intervention.

Answer

AWS Trusted Advisor

Answer

AWS Service Catalog

Answer

AWS CloudFormation

Question 6

A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon RDS DB instance. The administrator needs to update the stack by changing a parameter that, if applied directly, would replace the database. The administrator wants to prevent accidental replacement during the update. Which CloudFormation feature should the administrator use?

Accepted Answer

Stack policy. A stack policy is a CloudFormation feature that defines which stack resources can be updated or replaced during a stack update. By setting a stack policy that explicitly denies replacement updates on the RDS DB instance, the administrator can prevent accidental replacement while still allowing other updates. This is the correct approach because it directly controls the update behavior at the resource level without requiring manual intervention.

Answer

Change sets

Answer

Resource-level permissions

Answer

Stack sets

Question 7

A company's security policy requires that the AWS account root user must have multi-factor authentication (MFA) enabled. A SysOps administrator needs to continuously verify compliance and automatically notify the security team if the root user is not configured with MFA. Which AWS service can be used to create a compliance rule for this requirement?

Accepted Answer

AWS Config with the managed rule 'root-account-mfa-enabled'. AWS Config provides a managed rule called 'root-account-mfa-enabled' that continuously evaluates whether the root user has an MFA device configured. When the rule detects non-compliance, it can trigger an Amazon SNS notification to alert the security team, meeting the requirement for automated compliance verification and alerting.

Answer

AWS Trusted Advisor

Answer

AWS Identity and Access Management (IAM) Access Analyzer

Answer

Amazon Inspector

Question 8

An organization is using AWS CloudFormation to deploy infrastructure. The SysOps administrator needs to receive notifications when stack creation fails. What is the simplest way to achieve this?

Accepted Answer

Provide an SNS topic ARN in the --notification-arns parameter when creating the stack.. The `--notification-arns` parameter in the AWS CLI `create-stack` command directly associates an SNS topic with the stack, causing CloudFormation to publish notifications for all stack events, including failures. This is the simplest method as it requires no additional services or configuration beyond specifying the SNS topic ARN at stack creation.

Answer

Create a CloudWatch alarm on the 'StackCreationFailure' metric.

Answer

Create an EventBridge rule that triggers on CloudFormation events.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' failures.

Question 9

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator needs to monitor the application's HTTP 5xx error rate and set an alarm when the error rate exceeds 5% over a 5-minute period. The alarm must trigger an Amazon SNS notification. Which metric should be used for the alarm?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

"HTTP 500". CloudWatch Logs metric filter patterns use literal string matching by enclosing the exact text in double quotes. The pattern "HTTP 500" will match any log line that contains the exact substring 'HTTP 500', which is the simplest and most reliable way to count occurrences of HTTP 500 errors.

Answer

[error, HTTP, 500]

Answer

"HTTP" && "500"

Answer

[HTTP, 500, ...]

Question 10

A company manages multiple AWS accounts using AWS Organizations. The security team wants to restrict the use of Amazon EC2 instance types to only those that are approved for production workloads (e.g., m5.large, m5.xlarge). The policy should be applied to all member accounts in the organization, and it should prevent any non-approved instance type from being launched. The SysOps administrator should implement this with minimal operational overhead. Which solution should be used?

Accepted Answer

Create an AWS Organizations Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the approved list.. AWS Organizations Service Control Policies (SCPs) can centrally enforce restrictions across all member accounts without requiring per-account configuration. By creating an SCP that denies ec2:RunInstances when the instance type is not in the approved list, the security team can prevent non-approved EC2 instance types from being launched with minimal operational overhead, as SCPs are applied at the organization, OU, or account level and do not require managing IAM policies in each account.

Answer

Create an IAM policy in each member account that denies ec2:RunInstances unless the instance type is in the approved list.

Answer

Use AWS Config with the managed rule 'ec2-instance-type-check' and an automatic remediation action that terminates non-compliant instances.

Answer

Use Amazon EventBridge to detect RunInstances API calls and invoke a Lambda function that terminates unapproved instances.

Question 11

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator needs to monitor the application's HTTP 5xx error rate and set an alarm when the error rate exceeds 5% over a 5-minute period. The alarm must trigger an Amazon SNS notification. Which metric should be used for the alarm?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scheduled scaling. Scheduled scaling is the correct choice because the traffic pattern is predictable with regular peaks during business hours and low traffic at night. This policy allows the administrator to define specific times to increase or decrease the desired capacity of the Auto Scaling group, matching capacity to demand without manual intervention and optimizing costs by reducing instances during off-peak hours.

Answer

Target tracking scaling

Answer

Simple scaling

Answer

Manual scaling

Question 12

A company stores critical data in an S3 bucket and wants to be notified immediately when any object is deleted from the bucket. Which combination of services should the SysOps administrator use?

Accepted Answer

Configure an S3 event notification for 's3:ObjectRemoved:*' events to send to an SNS topic.. S3 event notifications can be configured to trigger on 's3:ObjectRemoved:*' events, which cover both permanent and versioned object deletions. These notifications can be sent directly to an SNS topic, enabling immediate notification without additional compute or logging overhead. This is the simplest and most direct approach for real-time alerts on object deletions.

Answer

Enable S3 server access logging and send logs to CloudWatch Logs, then create a metric filter and alarm.

Answer

Use S3 event notifications to invoke a Lambda function that checks the object and sends an email.

Answer

Use AWS CloudTrail to log DeleteObject calls and create a CloudWatch Events rule to send an SNS notification.

Question 13

A company runs a critical application on Amazon EC2 instances with data stored on Amazon EBS volumes. The SysOps administrator needs to implement a backup strategy that supports point-in-time recovery with a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 4 hours. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Backup to schedule hourly EBS snapshots and restore to a new volume when needed.. AWS Backup provides a fully managed, policy-based backup service that can schedule EBS snapshots hourly, meeting the 1-hour RPO. Restoring from an AWS Backup snapshot to a new EBS volume and attaching it to an EC2 instance can be completed within the 4-hour RTO, with minimal operational overhead as it eliminates the need for custom scripts or lifecycle management.

Answer

Use Amazon Data Lifecycle Manager (DLM) to take hourly snapshots and create an AWS CloudFormation template to launch a new instance from the snapshot.

Answer

Use custom scripts to copy snapshots to an Amazon S3 bucket and restore from there.

Answer

Use Amazon S3 Lifecycle policies to transition data to Amazon S3 Glacier.

Question 14

A company runs a stateful application on a single Amazon EC2 instance with an attached EBS volume. The SysOps administrator needs to ensure that in the event of an instance failure, a new instance can be launched quickly with the same data. The Recovery Point Objective (RPO) is 15 minutes and the Recovery Time Objective (RTO) is 30 minutes. Which strategy should the administrator implement?

Accepted Answer

Configure an Amazon EC2 automatic recovery action using a CloudWatch alarm. Amazon EC2 automatic recovery, triggered by a CloudWatch alarm based on status checks, can restart the instance on new hardware while preserving the attached EBS volume and its data. This meets the RPO of 15 minutes (data is current on the EBS volume) and the RTO of 30 minutes (recovery is typically within a few minutes). The stateful application remains intact because the same EBS volume is reattached to the replacement instance.

Answer

Schedule EBS snapshots every 15 minutes and use a Lambda function to launch a new instance from the latest snapshot

Answer

Use an Auto Scaling group with a custom AMI that is updated every 15 minutes

Answer

Use an Application Load Balancer with health checks to redirect traffic to a standby instance

Question 15

A company stores database credentials in AWS Secrets Manager. The security policy requires that the credentials be rotated automatically every 30 days. Which action should the SysOps administrator take to enforce this requirement?

Accepted Answer

Enable automatic rotation in the Secrets Manager console and specify a rotation interval of 30 days using a Lambda rotation function.. AWS Secrets Manager natively supports automatic rotation using a Lambda function. By enabling automatic rotation in the console and specifying a 30-day interval, the administrator meets the security policy without manual intervention. Secrets Manager handles the rotation schedule and invokes the Lambda function automatically.

Answer

Configure an AWS Lambda function to rotate the secret and set a CloudWatch Events rule to trigger it every 30 days.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and configure a State Manager association for rotation.

Answer

Create an IAM policy that forces users to rotate the secret manually every 30 days.