SOA-C02 Practice Test 12 — 15 Questions

Question 1

A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?

Accepted Answer

Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.. Options A, B, and D are correct. A bucket policy with a condition for vpc:SourceVpce, a VPC endpoint for S3, and route table updates are required. Option C is wrong because IAM users alone do not restrict access by VPC; a bucket policy with a VPC condition is needed. Option E is wrong because security groups cannot be attached to S3 buckets as they are not network interfaces.

Answer

Create IAM users and assign them permissions to access the bucket.

Answer

Attach a security group to the S3 bucket.

Question 2

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The operations team uses CloudWatch alarms to monitor the application's health. Recently, they noticed that the application's error rate has increased sporadically, but the CPU utilization and memory usage remain normal. The team suspects that the issue is related to a specific HTTP endpoint returning 5xx errors. They want to set up monitoring that will alert them when the error rate exceeds 5% of total requests over a 5-minute period. The application logs are already sent to CloudWatch Logs. Which combination of steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Create a metric filter in CloudWatch Logs to extract error codes and total requests from the application logs. Create two custom metrics: one for error count and one for total requests. Then create a CloudWatch alarm using a math expression that calculates error rate (error count / total requests) and triggers when >0.05 for 5 minutes.. It creates a metric filter on the log group to count errors and total requests, then an alarm on the error rate. Option B is wrong because AWS X-Ray is for tracing, not for error rate monitoring from logs. Option C is wrong because it relies on the CloudWatch agent to generate metrics, which is not already set up. Option D is wrong because it uses the ALB's HTTPCode_ELB_5XX metric, but the issue is application-specific, not ALB-level.

Answer

Enable AWS X-Ray on the application to trace requests and identify error patterns. Create a CloudWatch alarm on the X-Ray error rate metric.

Answer

Install the CloudWatch agent on the EC2 instances to collect application-level metrics. Configure the agent to emit a custom metric for error rate. Then create an alarm on that metric.

Answer

Enable detailed monitoring on the ALB and create a CloudWatch alarm on the HTTPCode_ELB_5XX metric with a threshold of 5% of the request count. Use the ALB's RequestCount metric to compute the percentage.

Question 3

A SysOps administrator is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. What should the administrator check FIRST?

Accepted Answer

The ApplicationStop lifecycle event hook script in the AppSpec file. The ApplicationStop lifecycle event hook script in the AppSpec file often fails with a non-zero exit code, causing the deployment to fail with this error. The error indicates that too many instances failed or are unhealthy, and the most common cause is a faulty script. Option A is incorrect because the CodeDeploy agent version is not the first thing to check; the error is about instance failures during deployment, not agent issues. Option B is incorrect because the Auto Scaling group's minimum size is already set to 2, and the error is not about group size but about individual instance health. Option C is incorrect because a load balancer health check configuration problem would result in a different error related to health check failures, not the specific message about instance deployment failures.

Answer

The CodeDeploy agent version on the instances

Answer

The Auto Scaling group's minimum size

Answer

The load balancer health check configuration

Question 4

A SysOps administrator notices that the monthly bill for Amazon S3 has increased significantly. The company uses S3 for storing application logs and user uploads. The logs are accessed rarely but must be retained for 3 years. User uploads are accessed frequently for the first 30 days, then rarely after. Which S3 lifecycle policy will optimize storage costs?

Accepted Answer

Transition logs to S3 Glacier Deep Archive after 30 days, and transition user uploads to S3 Standard-IA after 30 days, then to Glacier Deep Archive after 90 days.. This lifecycle policy optimizes costs by transitioning logs (rarely accessed but need retention) directly to S3 Glacier Deep Archive after 30 days, and for user uploads (frequently accessed for the first 30 days, then rarely), transition to S3 Standard-IA after 30 days, then to Glacier Deep Archive after 90 days. Option B is wrong because it transitions user uploads (initially frequent access) to Glacier Deep Archive too early, causing retrieval costs. Option C is wrong because logs should be archived, but deleting user uploads after 1 year may be premature. Option D is wrong because it transitions logs to Standard-IA, which is not cost-effective for long-term retention, and user uploads to One Zone-IA, which lacks durability.

Answer

Transition user uploads to S3 Glacier Deep Archive after 30 days, and transition logs to S3 Glacier after 90 days.

Answer

Move logs to S3 Glacier Deep Archive after 30 days, and delete user uploads after 1 year.

Answer

Transition logs to S3 Standard-IA after 30 days, and transition user uploads to S3 One Zone-IA after 30 days.

Question 5

A company wants to securely store secrets such as database credentials and API keys used by applications running on Amazon EC2. Which AWS service should be used to manage and rotate these secrets automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to manage secrets, including automatic rotation. Option A is wrong because IAM is for AWS user credentials and permissions, not for storing application secrets. Option C is wrong because AWS KMS is for encryption keys, not secrets management. Option D is wrong because AWS Systems Manager Parameter Store can store secrets but does not support automatic rotation natively (requires custom Lambda).

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 6

A company is using AWS KMS to encrypt data. The security team wants to ensure that a specific IAM role can use a KMS key, but only when the request comes from a specific VPC. Which THREE conditions should be included in the KMS key policy? (Choose three.)

Accepted Answer

aws:SourceVpc equals the VPC ID.. The aws:SourceArn condition key is used to restrict access based on the ARN of the resource that is the source of the request, such as an S3 bucket or Lambda function; it is not appropriate for restricting access to a specific IAM role ARN. Therefore, option B is incorrect. Option C is correct: aws:SourceVpc restricts use to requests originating from a specific VPC. Option E is correct: aws:SourceVpce restricts use to requests coming through a specific VPC endpoint. Option A is incorrect because aws:SourceSubnet is not a valid condition key. Option D is incorrect because aws:SourceIp restricts based on IP address, which does not reliably correspond to a VPC (for example, traffic through a NAT gateway would appear from the NAT’s IP).

Answer

aws:SourceSubnet equals the subnet ID.

Answer

aws:SourceArn equals the IAM role ARN.

Answer

aws:SourceIp equals the VPC CIDR.

Question 7

A SysOps administrator is implementing an automated backup solution for Amazon RDS databases. The solution must support point-in-time recovery and cross-region disaster recovery. Which TWO AWS services or features should be used?

Accepted Answer

Automated backups with a retention period.. Automated backups (Option C) enable point-in-time recovery within a specified retention period, meeting the backup requirement. Automated cross-region snapshot copy (Option E) provides cross-region disaster recovery by automatically copying snapshots to another AWS region. Manual DB snapshots (Option A) are not automated, so they do not satisfy the automation requirement. Cross-region read replicas (Option B) are designed for read scaling and do not serve as a backup solution. Amazon S3 lifecycle policies (Option D) are used for managing object storage, not for RDS backup automation.

Answer

Manual DB snapshots.

Answer

Cross-region read replicas.

Answer

Amazon S3 lifecycle policies.

Question 8

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Accepted Answer

Use AWS WAF with rate-based rules. AWS Shield Advanced provides DDoS protection. Using a web application firewall (WAF) at the edge helps filter malicious traffic. Security groups and NACLs are not effective against DDoS at scale.

Answer

Apply network ACLs with deny rules

Answer

Use restrictive security groups

Answer

Enable VPC Flow Logs

Question 9

A company wants to ensure that their Amazon S3 bucket policy only allows access from a specific VPC endpoint. Which TWO condition keys can be used in the bucket policy? (Choose TWO.)

Accepted Answer

aws:SourceVpc. The correct condition keys are 'aws:SourceVpc' (option C) and 'aws:SourceVpce' (option E). 'aws:SourceVpc' restricts access to all VPC endpoints within a specified VPC, while 'aws:SourceVpce' restricts access to a specific VPC endpoint. Option A 's3:SourceVpce' is not a valid condition key. Option B 'aws:SourceIp' is used for IP address restrictions, not VPC endpoints. Option D 'ec2:Vpc' is not applicable in S3 bucket policies.

Answer

s3:SourceVpce

Answer

aws:SourceIp

Answer

ec2:Vpc

Question 10

A company uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The SysOps administrator wants to deploy a new version of the application by first shifting 10% of traffic to the new version, monitoring for errors, and then after manual approval, shifting the remaining 90%. Which deployment configuration should be used?

Accepted Answer

Blue/green deployment with Canary10Percent configuration. A Blue/green deployment with Canary10Percent configuration shifts 10% of traffic to the new version, waits for a specified period (default 10 minutes), and then automatically shifts the remaining 90%. Note that manual approval is not natively supported by this configuration; it would need to be implemented separately (e.g., via a lifecycle hook). The question's requirement for manual approval is not directly met by the deployment configuration itself, but among the options, Canary10Percent is the only one that shifts traffic in the described pattern of 10% first then 90%.

Answer

In-place deployment

Answer

Blue/green deployment with Linear10PercentEvery10Minutes configuration

Answer

Blue/green deployment with AllAtOnce configuration

Question 11

A company wants to monitor AWS API calls for suspicious activity. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. Options B and E are correct. AWS CloudTrail logs all API calls made to the AWS environment, providing an audit trail. Amazon CloudWatch Logs can ingest CloudTrail logs and use metric filters to detect patterns indicative of suspicious activity. Option A (VPC Flow Logs) captures IP traffic information, not API calls. Option C (Amazon Inspector) is a vulnerability assessment service. Option D (AWS Config) records resource configuration changes, not API calls.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS Config

Question 12

A company has an S3 bucket that stores sensitive data. The security team requires an alert whenever an object in the bucket is deleted. What is the MOST efficient way to achieve this?

Accepted Answer

Enable S3 event notifications and send them to Amazon EventBridge, then create a rule to publish to SNS.. S3 event notifications can be sent directly to Amazon EventBridge, which allows you to create a rule that triggers an SNS topic for real-time alerts on object deletions. This approach is the most efficient as it avoids the overhead of log analysis or polling, providing immediate notification with minimal latency.

Answer

Configure S3 access logs and stream them to CloudWatch Logs, then create a metric filter.

Answer

Use S3 Inventory to generate a daily report and check for deletes.

Answer

Enable AWS CloudTrail data events for the S3 bucket and create a CloudWatch metric filter.

Question 13

An application running on EC2 instances behind an Application Load Balancer (ALB) sends custom metrics to CloudWatch. The team wants to set an alarm that triggers when the error rate exceeds 5% over a 5-minute period. The alarm must evaluate the metric every minute. Which configuration is required?

Accepted Answer

Period = 60 seconds, Statistic = Average, Evaluation Periods = 5, Datapoints to Alarm = 5. The alarm must evaluate the error rate every minute (period = 60 seconds) over a 5-minute window. With evaluation periods = 5 and datapoints to alarm = 5, the alarm requires all five 1-minute datapoints to exceed the 5% threshold, ensuring the error rate is sustained for the full 5-minute period. The Average statistic is appropriate because the error rate is a percentage metric that should be averaged over each period.

Answer

Period = 300 seconds, Statistic = Average, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 300 seconds, Statistic = Sum, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 60 seconds, Statistic = Sum, Evaluation Periods = 5, Datapoints to Alarm = 5

Question 14

Refer to the exhibit. An IAM policy is attached to an IAM user. Which action can the user perform?

Accepted Answer

Stop an EC2 instance.. The IAM policy grants the ec2:StopInstances action, which allows the user to stop EC2 instances. The condition restricts the action to instances with a specific tag, but the core permission is for stopping instances, making option C correct.

Answer

Start an EC2 instance.

Answer

Describe EC2 instances.

Answer

Terminate an EC2 instance.

Question 15

A company requires that all Amazon S3 buckets in its AWS account must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to detect any bucket that does not have KMS encryption enabled and automatically remediate it by enabling encryption. Which AWS service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously monitor S3 bucket configurations against a desired encryption state using managed rules like 's3-bucket-server-side-encryption-enabled' or custom Lambda rules. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-KMS encryption, enforcing compliance without manual intervention.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor