SOA-C02 Practice Test 13 — 15 Questions

Question 1

A SysOps administrator needs to monitor Amazon EC2 instances for disk space usage. Disk space metrics are not available by default in Amazon CloudWatch. The administrator wants to collect disk space metrics from all EC2 instances across multiple AWS accounts and aggregate them in a single CloudWatch dashboard. Which combination of steps should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the CloudWatch agent on each instance using SSM Run Command, configure the agent to collect disk metrics, and use CloudWatch cross-account observability to aggregate metrics from multiple accounts.. The CloudWatch agent is required to collect custom metrics like disk space from EC2 instances, as these are not available by default. SSM Run Command enables scalable, agentless installation across instances. CloudWatch cross-account observability allows you to aggregate metrics from multiple AWS accounts into a single monitoring account, meeting the requirement for a unified dashboard.

Answer

Enable detailed monitoring on the EC2 instances, create a custom metric in CloudWatch for disk space, and use CloudWatch Logs to forward logs to a central account.

Answer

Use AWS Config to track disk space and send metrics to CloudWatch.

Answer

Use AWS Trusted Advisor to monitor disk space and send alerts via SNS.

Question 2

A company wants to ensure that all Amazon S3 buckets have versioning enabled to protect against accidental deletion of objects. A SysOps administrator needs to automatically detect any buckets that do not have versioning enabled and receive notifications. Which AWS service should the administrator use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules, such as 's3-bucket-versioning-enabled', that continuously evaluate your S3 buckets against desired configuration states. When a bucket is non-compliant (versioning disabled), AWS Config can trigger an Amazon SNS notification to alert the administrator, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 3

A company uses AWS Organizations to manage multiple AWS accounts. The security team requires that all Amazon S3 buckets in every account be encrypted at rest using AWS KMS customer managed keys. The SysOps administrator needs to enforce this requirement centrally without requiring changes in each account individually. Which approach should the administrator use?

Accepted Answer

Create a service control policy (SCP) in the management account that denies creation of S3 buckets without KMS encryption. A service control policy (SCP) applied at the AWS Organizations management account can centrally deny the creation of S3 buckets that do not have AWS KMS encryption enabled, affecting all member accounts without requiring individual account changes. SCPs act as a permission guardrail that restricts what actions accounts can perform, even for account administrators, making them ideal for enforcing organization-wide security policies like mandatory KMS encryption on S3 bucket creation.

Answer

Create an IAM policy in each account that denies creation of unencrypted S3 buckets

Answer

Configure an S3 bucket policy on each bucket to require encryption

Answer

Enable AWS Config rules in each account to detect and remediate non-compliant buckets

Question 4

A company uses AWS CloudFormation to deploy infrastructure. The SysOps administrator has a template that creates an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to reuse the same template for development, test, and production environments, where the only differences are the EC2 instance type and the RDS DB instance class. Which CloudFormation feature should be used to define these environment-specific values?

Accepted Answer

Parameters. Parameters are the correct CloudFormation feature because they allow you to pass environment-specific values (such as EC2 instance type and RDS DB instance class) into the template at stack creation or update time. This enables reuse of the same template across development, test, and production environments without modifying the template itself, simply by providing different parameter values for each environment.

Answer

Nested stacks

Answer

Mappings

Answer

Conditions

Question 5

A company uses an RDS for MySQL Multi-AZ DB instance. They want to minimize downtime during a planned maintenance update that requires a database engine version upgrade. What should the SysOps administrator do?

Accepted Answer

Use the AWS Console to apply the maintenance update immediately; the Multi-AZ configuration will minimize downtime.. RDS for MySQL Multi-AZ deployments perform engine version upgrades with automatic failover, which minimizes downtime by updating the standby instance first, then promoting it to primary. The Multi-AZ configuration ensures that the upgrade process is applied with reduced impact, typically causing only a brief interruption during the failover rather than a full outage.

Answer

Modify the DB instance to be a Single-AZ deployment, then apply the upgrade.

Answer

Take a snapshot, restore it as a new instance, and upgrade that instance.

Answer

Create a read replica in the same region, upgrade the replica, and promote it.

Question 6

A SysOps administrator manages multiple AWS accounts and wants to create a single Amazon CloudWatch dashboard that displays real-time metrics from all accounts in one view. The administrator needs to avoid managing separate dashboards for each account. Which solution should the administrator implement?

Accepted Answer

Use CloudWatch cross-account observability by setting up a monitoring account and sharing metrics from source accounts.. CloudWatch cross-account observability allows you to designate a monitoring account that can view metrics, logs, and traces from multiple source accounts. This feature uses AWS Organizations or CloudWatch cross-account links to share observability data in real time, enabling a single dashboard that aggregates metrics from all accounts without needing separate dashboards.

Answer

Export CloudWatch metrics to Amazon QuickSight and create a dashboard there.

Answer

Use AWS Config aggregator to collect metrics and display in CloudWatch.

Answer

Create a Lambda function that periodically pulls metrics from each account and publishes to a central account's CloudWatch.

Question 7

A SysOps administrator manages a web application running on Amazon EC2 instances that run 24/7 for the next 12 months. The workload is steady and predictable. Which EC2 purchasing option provides the highest cost savings for this use case?

Accepted Answer

Standard Reserved Instances. Standard Reserved Instances provide the highest cost savings for a steady, predictable 24/7 workload over a 12-month period because they offer a significant discount (up to 72% compared to On-Demand) in exchange for a commitment to a specific instance family, region, and term length. Since the workload runs continuously without interruption, the upfront payment or partial upfront payment for a 1-year term maximizes savings without the risk of interruption or the need for flexibility.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Savings Plans (Compute)

Question 8

A SysOps administrator deploys a web application using AWS Elastic Beanstalk. The administrator wants to deploy a new application version with zero downtime and minimize the risk of failure by launching a completely new set of instances before swapping traffic. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option D) is correct because it launches a completely new set of instances in a separate Auto Scaling group, deploys the new application version to them, and then swaps the Elastic Load Balancer (ELB) traffic from the old instances to the new ones in a single, atomic swap. This ensures zero downtime and minimizes risk by keeping the original environment fully intact until the new instances pass health checks, allowing an immediate rollback by simply swapping traffic back.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 9

A SysOps administrator is creating an AWS CloudFormation template to deploy a web server. The template must define an Amazon EC2 instance, a security group, and an Elastic IP. In which section of the template should these resources be declared?

Accepted Answer

Resources. In an AWS CloudFormation template, the Resources section is the mandatory block where all AWS resources (such as EC2 instances, security groups, and Elastic IPs) are declared and configured. The template's logic for creating, updating, and deleting these infrastructure components is defined exclusively within this section, making B the correct choice.

Answer

Parameters

Answer

Outputs

Answer

Mappings

Question 10

A company uses AWS CloudTrail to log API activity. The SysOps administrator needs to receive an email notification whenever a new IAM user is created. Which AWS services should be used together to meet this requirement with the least operational overhead?

Accepted Answer

CloudTrail, Amazon EventBridge, and Amazon SNS. Amazon EventBridge can directly capture CloudTrail API events (such as CreateUser) and route them to an SNS topic for email notification without needing any custom code or additional infrastructure. This pattern minimizes operational overhead by using a fully managed event bus with built-in filtering and target routing, eliminating the need for Lambda functions or metric filter configurations.

Answer

CloudTrail, Amazon SNS, and AWS Lambda

Answer

CloudTrail, Amazon CloudWatch Logs, and a metric filter with an alarm

Answer

AWS Config and Amazon SNS

Question 11

A company has multiple AWS accounts managed under AWS Organizations. The SysOps administrator needs to deploy a common AWS CloudFormation template to all accounts in a specific organizational unit (OU), ensuring consistent security group configurations across the organization. Which AWS service should the administrator use to perform this deployment?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy a common template across multiple accounts and regions from a single management account. In this scenario, the administrator can target the specific organizational unit (OU) within AWS Organizations, ensuring consistent security group configurations are applied to all member accounts without manual intervention.

Answer

AWS CodePipeline with cross-account actions

Answer

AWS Service Catalog portfolio

Answer

AWS Systems Manager Automation

Question 12

A company has a production RDS for PostgreSQL instance. They need to recover from a logical corruption that occurred 2 hours ago. Which recovery method will minimize data loss?

Accepted Answer

Perform a point-in-time recovery to a time just before the corruption occurred.. Point-in-time recovery (PITR) for RDS PostgreSQL allows you to restore the database to any second within the backup retention period, using automated backups and transaction logs. By restoring to a time just before the logical corruption occurred (2 hours ago), you can recover the database to its state before the corruption, minimizing data loss to only transactions that happened after that point. This is the only option that can target a specific moment before the corruption, unlike a snapshot which is a fixed point in time.

Answer

Restore from the latest automated snapshot taken 1 hour ago.

Answer

Use pg_dump to export the database and restore it.

Answer

Fail over to the read replica in another AZ.

Question 13

A company runs a production application on Amazon EC2 instances in an Auto Scaling group across two Availability Zones. The application uses an Amazon RDS Multi-AZ DB instance. The SysOps administrator wants to test the application's behavior during an Availability Zone failure of the database. Which action should the administrator take to simulate a failure with minimal impact on production?

Accepted Answer

Reboot the DB instance with the 'Reboot with failover' option. Rebooting the RDS Multi-AZ DB instance with the 'Reboot with failover' option forces a synchronous failover to the standby replica in the other Availability Zone. This simulates an AZ failure of the primary database with minimal impact because the application's Auto Scaling group spans two AZs and the RDS Multi-AZ deployment provides automatic failover, so the application should experience only a brief interruption during the DNS change to the new primary.

Answer

Modify the DB instance to be a single-AZ deployment

Answer

Delete the standby replica in the other Availability Zone

Answer

Stop the DB instance

Question 14

A company uses AWS Global Accelerator to improve the performance of a web application hosted in multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region as the endpoint. Users report that traffic is not being routed to the closest region. What could be the cause?

Accepted Answer

The health checks for the ALBs are failing, so traffic is diverted to other regions.. Global Accelerator uses health checks to determine endpoint availability. If the health checks for an ALB in a user's closest region are failing, Global Accelerator will consider that endpoint unhealthy and route traffic to the next closest healthy region. This causes users to be directed to a region farther away, even though a closer region exists.

Answer

The Global Accelerator is not configured with a custom routing accelerator.

Answer

The ALBs are not configured to allow cross-region communication.

Answer

The endpoints are configured in the same AWS region.

Question 15

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for EC2 instances to download updates. Which THREE components are required to achieve this? (Choose three.)

Accepted Answer

Route table in the private subnets with a default route pointing to the NAT Gateway. A route table associated with private subnets must have a default route (0.0.0.0/0) pointing to a NAT Gateway to direct outbound internet traffic from EC2 instances through the NAT device. This allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet.

Answer

Egress-only Internet Gateway

Answer

AWS Site-to-Site VPN connection