SOA-C02 Practice Test 13 — 15 Questions

Question 1

A company is running a critical application on Amazon RDS for MySQL. The database is experiencing high read traffic, causing performance issues. The SysOps administrator needs to improve read performance while keeping costs low. Which solution should the administrator choose?

Accepted Answer

Add one or more Read Replicas in the same Region. Option A is correct because adding Read Replicas offloads read traffic from the primary DB, improving performance at low cost. Multi-AZ is for high availability, not read scaling. Larger instance class increases cost. ElastiCache can help but may be overkill and adds complexity and cost.

Answer

Enable Multi-AZ deployment

Answer

Increase the DB instance class to a larger size

Answer

Use Amazon ElastiCache to cache read results

Question 2

A company stores log files in Amazon S3. The logs are accessed frequently for the first 30 days, then rarely after that. The company wants to automatically transition objects to a lower-cost storage class after 30 days. Which S3 feature should be configured?

Accepted Answer

S3 Lifecycle rule. Option D is correct because S3 Lifecycle rules automate transitions between storage classes. S3 Versioning is for object versions. S3 Object Lock is for retention. S3 Transfer Acceleration speeds up uploads.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 3

A SysOps administrator notices that a Lambda function is timing out after 30 seconds. The function processes large files from S3. How can the administrator improve performance while minimizing cost?

Accepted Answer

Increase the memory allocation of the Lambda function.. Option A is correct because increasing memory also increases CPU and network, which can speed up processing. Increasing timeout alone won't improve speed. Using a larger instance type is not applicable. Provisioned Concurrency adds cost.

Answer

Increase the timeout value to 5 minutes.

Answer

Enable Provisioned Concurrency.

Answer

Deploy the function on an EC2 instance.

Question 4

An application writes logs to an S3 bucket. The logs are accessed frequently for the first 30 days, then rarely after that, but must be retained for 7 years. Which THREE steps should be taken to optimize cost? (Choose three.)

Accepted Answer

Use an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 90 days.. Options A, C, and E are correct. S3 Lifecycle rules can transition objects to lower-cost storage classes. S3 Standard-IA is for infrequent access, and Glacier Deep Archive is for long-term archiving. Option B is incorrect because Intelligent-Tiering has monitoring costs. Option D is incorrect because deleting logs violates retention requirement.

Answer

Delete logs older than 30 days.

Answer

Use S3 Intelligent-Tiering to automatically optimize costs.

Question 5

A SysOps administrator is troubleshooting connectivity issues between two VPCs in different AWS Regions. Both VPCs are connected via a VPC Peering connection. The route tables in both VPCs have routes pointing to the peering connection. Security groups allow all traffic. However, an EC2 instance in VPC A cannot ping an EC2 instance in VPC B. What is the most likely cause?

Accepted Answer

The route tables in the subnets where the instances reside do not include a route to the peered VPC's CIDR.. Option D is correct because VPC Peering does not support transitive routing; each VPC must have explicit routes to the other VPC's CIDR. If the route tables are correctly configured, the issue is likely that the instances do not have the other VPC's CIDR in their route tables. Option A is incorrect because VPC Peering works across regions. Option B is incorrect because the security groups can reference each other if the peered VPC's CIDR is added, but not by security group ID across regions. Option C is incorrect because NACLs are stateless and need rules for both directions.

Answer

The network ACLs in subnets are blocking ICMP traffic.

Answer

VPC Peering is not supported across AWS Regions.

Answer

The security groups do not allow traffic from the peered VPC's security group ID.

Question 6

A company has an application that requires UDP traffic to be distributed across multiple EC2 instances. Which AWS load balancer type should be used?

Accepted Answer

Network Load Balancer. Option C is correct because Network Load Balancer (NLB) supports UDP traffic. Application Load Balancer (ALB) only supports HTTP/HTTPS. Option A is incorrect because ALB does not support UDP. Option B is incorrect because Classic Load Balancer supports TCP/SSL but not UDP. Option D is incorrect because CloudFront is a CDN, not a load balancer.

Answer

Classic Load Balancer

Answer

Amazon CloudFront

Answer

Application Load Balancer

Question 7

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download software patches from the internet. Which component should be used to provide internet access to the instance?

Accepted Answer

NAT Gateway in a public subnet. Option B is correct because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic. Option A is incorrect because an Internet Gateway is used for public subnets, not private. Option C is incorrect because a VPC Endpoint is for accessing AWS services privately. Option D is incorrect because a VPN connection is for on-premises connectivity, not internet access.

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway attached to the VPC

Answer

VPC Endpoint for Amazon S3

Question 8

A company has multiple VPCs in the same account that need to communicate with each other. The VPCs are in the same region. Which solution provides the simplest and most scalable connectivity?

Accepted Answer

Create a Transit Gateway and attach all VPCs.. Option A is correct because a Transit Gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management. Option B is incorrect because VPC Peering is a one-to-one connection and becomes complex with many VPCs. Option C is incorrect because Direct Connect is for on-premises connectivity, not VPC-to-VPC. Option D is incorrect because PrivateLink is for exposing services, not general VPC connectivity.

Answer

Set up AWS Direct Connect and route through a single VPC.

Answer

Use AWS PrivateLink to connect the VPCs.

Answer

Create VPC Peering connections between each pair of VPCs.

Question 9

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a database. Which TWO components are required to allow an EC2 instance in the public subnet to connect to the database?

Accepted Answer

A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR.. Options A and D are correct. The security group of the database must allow inbound traffic from the EC2 instance's security group or IP, and the network ACL of the private subnet must allow inbound traffic from the public subnet. Option B is incorrect because a NAT Gateway is for outbound internet, not inbound. Option C is incorrect because an Internet Gateway is for internet traffic, not VPC internal traffic. Option E is incorrect because a VPC Endpoint is for accessing AWS services, not EC2-to-RDS.

Answer

A NAT Gateway in the public subnet.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Endpoint for the database service.

Question 10

Which TWO actions should a SysOps administrator take to improve the availability and reduce latency for a web application hosted on EC2 instances behind an Application Load Balancer?

Accepted Answer

Implement Auto Scaling to add instances based on CPU utilization.. Deploying across multiple Availability Zones increases fault tolerance. Using Auto Scaling helps maintain performance during traffic spikes by adding or removing instances. Option C is incorrect because increasing instance size might help but does not provide the same resilience as distributing across AZs. Option D is incorrect because reducing health check interval increases load but not availability. Option E is incorrect because using a single EBS volume does not improve availability.

Answer

Use larger EC2 instance types to handle more traffic.

Answer

Configure the ALB health check to have a shorter interval.

Answer

Use an Amazon CloudFront distribution in front of the ALB to cache content at edge locations.

Question 11

Which THREE configurations are required to enable an EC2 instance in a private subnet to access the internet for software updates while preventing inbound internet traffic?

Accepted Answer

Attach an Internet Gateway to the VPC.. A NAT gateway in a public subnet provides outbound internet access. The private subnet route table must have a default route to the NAT gateway. The NAT gateway itself needs an internet gateway in the public subnet route table. Option D is incorrect because an elastic IP is assigned to the NAT gateway, not the instance. Option E is incorrect because a bastion host is for administrative access, not for outbound internet.

Answer

Assign an Elastic IP address to the EC2 instance.

Answer

Deploy a bastion host in the private subnet.

Question 12

Which TWO are valid methods to secure traffic between a client and an Application Load Balancer?

Accepted Answer

Configure a listener on port 443 with an SSL certificate from AWS Certificate Manager.. HTTPS listeners terminate SSL/TLS at the ALB, ensuring encryption between client and ALB. Using an SSL certificate from AWS Certificate Manager (ACM) is required for HTTPS. Option C is incorrect because security groups restrict traffic based on IP, not encryption. Option D is incorrect because network ACLs are stateless and do not encrypt. Option E is incorrect because a VPN connection is for site-to-site, not client-to-ALB.

Answer

Use a security group that only allows HTTPS traffic from the client's IP.

Answer

Set up an IPsec VPN connection between the client and the ALB.

Answer

Configure a network ACL to allow only port 443.

Answer

Enable the ALB's built-in SSL/TLS encryption without a certificate.

Question 13

A company hosts a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. Which step should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Verify the target group health check settings.. The 503 error indicates the load balancer cannot connect to the targets. Checking the target group health check configuration is the first step to identify if targets are marked unhealthy.

Answer

Enable cross-zone load balancing.

Answer

Increase the idle timeout on the load balancer.

Answer

Add more subnets to the load balancer.

Question 14

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which step is necessary?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. To use IPv6, the VPC must be associated with an Amazon-provided IPv6 CIDR block, and subnets must have IPv6 CIDR blocks assigned. Instances must be launched with IPv6 addresses.

Answer

Attach an internet gateway that supports IPv6.

Answer

Create a new VPC with an IPv6 CIDR block and migrate resources.

Answer

Enable DNS64 in the VPC.

Question 15

A SysOps administrator receives an alert that a VPN connection between a VPC and an on-premises network is down. The VPN uses static routing. After verifying the on-premises side is functioning, what should the administrator check in AWS?

Accepted Answer

Verify that the customer gateway device is configured with the correct IP address.. For static VPNs, the tunnel status and BGP (if dynamic) are irrelevant. The VPN connection's tunnel details and route propagation need to be checked. The most common issue is that the tunnel is down due to misconfiguration or network issues.

Answer

Check the BGP session status.

Answer

Reboot the virtual private gateway.

Answer

Ensure the route table has a route to the virtual private gateway.