SOA-C02 Practice Test 12 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple AWS accounts. The security team requires that all Amazon S3 buckets in every account be encrypted at rest using AWS KMS customer managed keys. The SysOps administrator needs to enforce this requirement centrally without requiring changes in each account individually. Which approach should the administrator use?

Accepted Answer

Create a service control policy (SCP) in the management account that denies creation of S3 buckets without KMS encryption. Option C is correct because a service control policy (SCP) applied at the AWS Organizations management account can centrally deny the creation of S3 buckets that do not have AWS KMS encryption enabled, affecting all member accounts without requiring individual account changes. SCPs act as a permission guardrail that restricts what actions accounts can perform, even for account administrators, making them ideal for enforcing organization-wide security policies like mandatory KMS encryption on S3 bucket creation.

Answer

Create an IAM policy in each account that denies creation of unencrypted S3 buckets

Answer

Configure an S3 bucket policy on each bucket to require encryption

Answer

Enable AWS Config rules in each account to detect and remediate non-compliant buckets

Question 2

A SysOps administrator needs to grant a developer access to view only the logs of a specific Amazon RDS instance. Which IAM action should be allowed?

Accepted Answer

rds:DescribeDBLogFiles. Option A is correct because rds:DescribeDBLogFiles lists the available log files for an RDS instance. Option B is wrong because rds:DownloadDBLogFilePortion downloads a log file, not just view. Option C is wrong because rds:DescribeDBInstances describes instance details, not logs. Option D is wrong because rds:DescribeEvents describes events, not logs.

Answer

rds:DownloadDBLogFilePortion

Answer

rds:DescribeDBInstances

Answer

rds:DescribeEvents

Question 3

A SysOps administrator notices that an Amazon CloudWatch Logs log group is growing rapidly and suspects that an EC2 instance is sending sensitive data to the logs. What is the most effective way to detect and redact sensitive data in real-time?

Accepted Answer

Create a CloudWatch Logs subscription filter that invokes a Lambda function for redaction.. Option D is correct because CloudWatch Logs subscription filters can send logs to Lambda for real-time processing, including redaction. Option A is wrong because CloudWatch Logs Insights is for querying, not real-time redaction. Option B is wrong because Kinesis Data Firehose can transform data but requires a Lambda function for custom redaction. Option C is wrong because S3 event notifications are not real-time for log streams.

Answer

Use CloudWatch Logs Insights to query and mask sensitive data.

Answer

Enable S3 event notifications to trigger a Lambda function for redaction.

Answer

Send logs to Amazon Kinesis Data Firehose and use Lambda for redaction.

Question 4

A company wants to provide low-latency access to static content (images, CSS) for global users. The content is stored in an S3 bucket. Which service should be used to cache content at edge locations?

Accepted Answer

Amazon CloudFront. Option A is correct because Amazon CloudFront is a CDN that caches content at edge locations for low-latency delivery. Option B is incorrect because S3 Transfer Acceleration speeds up uploads, not downloads. Option C is incorrect because Global Accelerator improves TCP/UDP performance but does not cache content. Option D is incorrect because ElastiCache is a caching layer for databases, not for static content delivery.

Answer

Amazon ElastiCache

Answer

S3 Transfer Acceleration

Answer

AWS Global Accelerator

Question 5

A SysOps administrator needs to audit all IAM user activity in the AWS account for the last 90 days. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls including IAM actions for the last 90 days by default in the event history. Option A is wrong because AWS Config records resource configuration changes, not user activity. Option B is wrong because Amazon GuardDuty is for threat detection. Option D is wrong because AWS Trusted Advisor is for cost optimization and best practices.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 6

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences variable traffic patterns. The SysOps team wants to optimize costs without impacting performance. Which EC2 purchasing option should the team use for the instances?

Accepted Answer

On-Demand Instances. Option C is correct because On-Demand instances provide flexibility and no upfront commitment, suitable for variable traffic. Savings Plans offer lower prices but require a 1- or 3-year commitment, which may not align with variable patterns. Reserved Instances also require commitment. Spot Instances are not suitable for a web application that needs consistent availability.

Answer

Savings Plans

Answer

Spot Instances

Answer

Reserved Instances

Question 7

A SysOps administrator is asked to ensure that all objects in an S3 bucket are encrypted at rest using a customer-managed KMS key. The bucket currently has default encryption set to SSE-S3. What must be done to meet the requirement?

Accepted Answer

Update the bucket's default encryption to SSE-KMS using the customer-managed key, and re-upload existing objects.. Option B is correct because changing the default encryption to SSE-KMS with the customer key will encrypt new objects. Existing objects must be copied to re-encrypt with the new key. Option A is wrong because bucket policies can enforce encryption but do not change default encryption. Option C is wrong because SCPs are not for bucket-level settings. Option D is wrong because enabling versioning does not change encryption.

Answer

Add a bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.

Answer

Apply a service control policy to enforce SSE-KMS across the organization.

Answer

Enable S3 Versioning and set the bucket's default encryption to SSE-KMS.

Question 8

A SysOps administrator needs to ensure that an Amazon RDS for MySQL database is compliant with PCI DSS requirements. Which THREE configurations should be implemented?

Accepted Answer

Require SSL/TLS connections to the database.. Options A, C, and E are correct. Encryption at rest (RDS encryption), encryption in transit (SSL/TLS), and logging (audit logs) are PCI DSS requirements. Option B is wrong because Multi-AZ is for high availability, not security. Option D is wrong because automated backups are for data recovery, not security.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Configure automated backups with a retention period of 30 days.

Question 9

A SysOps administrator notices that the monthly bill for Amazon RDS is higher than expected. The environment includes multiple DB instances with low CPU and memory utilization. Which action will most effectively reduce costs while maintaining performance?

Accepted Answer

Resize the DB instances to a smaller instance class. Option D is correct because Rightsizing instances down to a smaller instance class can reduce costs when utilization is low. Option A may increase costs by adding read replicas. Option B may improve performance but at higher cost. Option C reduces storage cost but doesn't address compute waste.

Answer

Enable Multi-AZ deployment for high availability

Answer

Delete unused RDS snapshots

Answer

Provisioned IOPS (io1) storage for better performance

Question 10

A company uses S3 Standard for all data, but some objects are accessed only once per year. Which storage class provides the lowest cost for this use case while maintaining the same durability?

Accepted Answer

S3 Glacier Deep Archive. Option B is correct because S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival data accessed rarely. S3 Standard is expensive for infrequent access. S3 One Zone-IA is cheaper but not as durable. S3 Intelligent-Tiering has monitoring costs and may not be ideal.

Answer

S3 One Zone-Infrequent Access (S3 One Zone-IA)

Answer

S3 Intelligent-Tiering

Answer

S3 Standard-Infrequent Access (S3 Standard-IA)

Question 11

A SysOps team is using CloudWatch to monitor CPU utilization of EC2 instances. They want to receive a notification when average CPU exceeds 80% for 5 consecutive minutes. Which combination of services should they use?

Accepted Answer

CloudWatch Metrics, CloudWatch Alarm, and Amazon SNS. Option A is correct because CloudWatch Metrics collect CPU data, CloudWatch Alarm triggers when threshold is breached, and SNS sends notifications. CloudWatch Logs is for log data, not metrics. Lambda is not needed for simple notification. Systems Manager is for management, not monitoring.

Answer

CloudWatch Metrics, CloudWatch Alarm, and AWS Lambda

Answer

AWS Config, CloudWatch Alarm, and Amazon SNS

Answer

CloudWatch Logs, CloudWatch Alarm, and AWS Lambda

Question 12

An application running on EC2 instances sends large amounts of data to an S3 bucket. The SysOps administrator wants to reduce data transfer costs while ensuring the traffic stays within AWS. What is the most cost-effective solution?

Accepted Answer

Create a VPC Endpoint for S3 (Gateway type) and use it from the EC2 instances.. Option B is correct because using a VPC Endpoint for S3 allows traffic to stay within the AWS network, avoiding internet data transfer costs. Option A is incorrect because NAT Gateways incur charges for data processing and transfer. Option C is incorrect because S3 Transfer Acceleration is for faster uploads, not cost savings. Option D is incorrect because Direct Connect is a dedicated connection that incurs monthly fees and is overkill for this use case.

Answer

Set up an AWS Direct Connect connection.

Answer

Use S3 Transfer Acceleration.

Answer

Route traffic through a NAT Gateway in a public subnet.

Question 13

A company is running a stateful web application on EC2 instances in an Auto Scaling group. The application requires low latency and high throughput. Currently, the application is experiencing performance degradation during peak hours. Which scaling strategy should the SysOps administrator implement to improve performance and optimize cost?

Accepted Answer

Predictive scaling policy. Option B is correct because predictive scaling uses historical data to forecast capacity needs, scaling in advance to handle peak loads, improving performance and cost. Simple scaling may react too slowly. Step scaling is better than simple but still reactive. Scheduled scaling works for predictable patterns but not dynamic ones.

Answer

Step scaling policy based on memory utilization

Answer

Scheduled scaling with fixed times

Answer

Simple scaling policy based on CPU utilization

Question 14

A company wants to reduce data transfer costs for traffic between EC2 instances in the same AWS Region. Which action should the SysOps administrator take?

Accepted Answer

Ensure instances communicate using private IP addresses within the same VPC. Option D is correct because using private IP addresses avoids data transfer charges over the internet. Public IPs incur costs. VPC endpoints are for accessing AWS services, not for instance-to-instance traffic. NAT Gateway adds cost. Direct Connect is for on-premises connectivity and is expensive.

Answer

Use Elastic IP addresses for all instances

Answer

Place instances in public subnets and route traffic through a NAT Gateway

Answer

Use VPC endpoints to communicate between instances

Question 15

A company has multiple AWS accounts and wants to centrally track costs and usage across all accounts. Which AWS service should the SysOps administrator use?

Accepted Answer

AWS Organizations. Option B is correct because AWS Organizations allows you to consolidate billing and get a single bill for all accounts, enabling cost tracking. AWS Budgets and Cost Explorer help analyze costs but require consolidated view. AWS Config tracks configuration, not costs. Trusted Advisor provides recommendations but not central cost tracking.

Answer

AWS Budgets

Answer

AWS Config

Answer

AWS Trusted Advisor