SOA-C02 Practice Test 13 — 15 Questions

Question 1

Drag and drop the steps to configure an Amazon Route 53 failover routing policy into the correct order.

Accepted Answer

Create health checks, then create primary failover record, then create secondary failover record, then test failover.. Create health checks first, then create primary and secondary records with failover types, then test.

Answer

Create primary failover record, then create health checks, then create secondary failover record, then test failover.

Answer

Create health checks, then create secondary failover record, then create primary failover record, then test failover.

Answer

Create health checks, then create primary failover record, then test failover, then create secondary failover record.

Question 2

A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon EC2 instance. The administrator wants to update the instance type from t3.medium to t3.large without recreating the instance. The instance type change is supported as a simple update in CloudFormation. Which stack update method should the administrator use to apply this change with the least disruption?

Accepted Answer

Directly update the stack by modifying the template and submitting the update via the AWS Management Console, AWS CLI, or API.. Changing an EC2 instance type from t3.medium to t3.large is a supported simple update in CloudFormation, meaning the resource can be updated in-place without replacement. By directly updating the stack via the AWS Management Console, AWS CLI, or API, the administrator applies the change immediately with minimal disruption, as CloudFormation will stop the instance, modify the instance type, and restart it. This method avoids the overhead of creating a change set or deleting and recreating the stack, which would cause unnecessary downtime or complexity.

Answer

Create a change set to review the changes, then execute the change set.

Answer

Apply a stack policy to the EC2 instance to allow the update, then update the stack.

Answer

Delete the existing stack and create a new stack with the updated instance type.

Question 3

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB terminates SSL/TLS and forwards traffic to the instances over HTTP. The SysOps administrator needs to capture the original client IP address in the instance logs. How should the administrator configure this?

Accepted Answer

Enable the X-Forwarded-For header on the ALB.. When an Application Load Balancer terminates SSL/TLS and forwards traffic to EC2 instances over HTTP, the original client IP address is preserved by the ALB in the X-Forwarded-For header. By enabling this header on the ALB, the SysOps administrator ensures that the web server or application can log the true client IP, which is essential for analytics, security, and troubleshooting.

Answer

Enable stickiness on the ALB target group.

Answer

Configure the ALB to use Proxy Protocol v2.

Answer

Enable access logs on the ALB and store them in Amazon S3.

Question 4

A company stores sensitive data in an S3 bucket. The security team requires that all objects uploaded to the bucket be encrypted at rest using an AWS KMS customer-managed key. Which S3 bucket policy statement should be added to enforce this requirement?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. It denies any PutObject request that does not use KMS encryption (s3:x-amz-server-side-encryption != 'aws:kms') OR that does not include a KMS key ID (s3:x-amz-server-side-encryption-aws-kms-key-id is null). This enforces that objects are encrypted with a KMS customer-managed key. Option A is incorrect because it denies only if encryption is not KMS, but allows KMS without requiring a key ID, which could permit using the default AWS-managed KMS key rather than a customer-managed key. Option B is incorrect because it denies only if no encryption header is present, but allows any encryption type including SSE-S3 or SSE-KMS without a key ID. Option D is incorrect because it denies encryption that is not AES256, which is SSE-S3, and would incorrectly allow SSE-KMS.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 5

A SysOps administrator needs to ensure high availability for a web application running on EC2 instances across multiple Availability Zones. Which TWO actions should the administrator take?

Accepted Answer

Launch EC2 instances in at least two different Availability Zones.. Options A and D are correct. Launching EC2 instances across multiple Availability Zones (A) provides fault isolation, and registering them with an Application Load Balancer that has health checks enabled (D) ensures traffic is routed only to healthy instances. Option B is incorrect because CloudFront is a CDN, not a load balancer; it improves performance but does not directly provide high availability by health checking instances. Option C is incorrect because all instances in a single Availability Zone creates a single point of failure. Option E is incorrect because EBS volumes are tied to a specific Availability Zone and real-time replication does not address instance-level failures across zones.

Answer

Place a CloudFront distribution in front of the instances.

Answer

Launch all EC2 instances in a single Availability Zone for consistency.

Answer

Attach an EBS volume to each instance and replicate data in real-time.

Question 6

An administrator is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS Elastic Beanstalk. The build succeeds, but the deployment fails with 'Access Denied' when Elastic Beanstalk tries to read the artifact from S3. What should the administrator check?

Accepted Answer

The IAM role assumed by the Elastic Beanstalk environment. The Elastic Beanstalk environment's IAM service role must have permissions to read the artifact from the S3 bucket. If this role lacks the necessary s3:GetObject permission, the deployment fails with 'Access Denied'. Option B is incorrect because the CodeBuild role handles build tasks, not deployment actions. Option C is incorrect because CodePipeline can manage cross-region artifacts; the region mismatch is unlikely to cause an access-denied error. Option D is incorrect because the artifact bucket is managed by CodePipeline and its bucket policy is typically configured correctly; the issue is more likely with the Elastic Beanstalk service role's permissions.

Answer

The IAM role used by CodeBuild

Answer

Whether the artifact bucket is in the same region as the pipeline

Answer

The S3 bucket policy for the artifact bucket

Question 7

A company uses S3 to store sensitive data. To meet compliance requirements, all S3 buckets must be encrypted at rest. The security team notices that some objects in a bucket are not encrypted. What is the MOST efficient way to enforce encryption for all future objects?

Accepted Answer

Create an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption header is not present. A bucket policy that denies PutObject unless the `x-amz-server-side-encryption` header is present enforces encryption at the API level, preventing any unencrypted object from being uploaded. This is the most efficient approach as it proactively blocks non-compliant uploads without requiring post-upload remediation or manual intervention.

Answer

Use AWS Config managed rule to identify unencrypted objects and re-upload them manually

Answer

Use S3 Inventory to list unencrypted objects and apply encryption via S3 Batch Operations

Answer

Enable default encryption on the bucket using AES-256

Question 8

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. The SysOps administrator needs to run a script on all instances that have a specific tag (Environment: Production). The script must be executed immediately and only once. Which approach should be used?

Accepted Answer

Use Run Command with a target based on the tag.. Run Command enables you to run commands on EC2 instances immediately and only once, using tags to target specific instances. Option A is incorrect because Patch Manager is designed for applying patches, not running arbitrary scripts. Option B is incorrect because Automation documents are for multi-step workflow orchestration, not simple one-time script execution. Option D is incorrect because State Manager is for recurring configurations or ensuring a desired state over time, not immediate one-time execution.

Answer

Use Patch Manager to apply the script as a patch baseline.

Answer

Create an Automation document and execute it.

Answer

Create a State Manager association with the script.

Question 9

A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all IAM API calls, providing a detailed audit trail of changes. Option C is correct because AWS Config tracks changes to IAM resource configurations and can evaluate them against rules. Option E is correct because Amazon CloudWatch Logs can store and monitor CloudTrail logs, enabling alerting on specific IAM changes. Option B is wrong because Amazon GuardDuty is for threat detection, not auditing configuration changes. Option D is wrong because AWS Trusted Advisor provides best-practice checks but does not log or track changes to IAM resources.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 10

A company requires that all users in an AWS account must authenticate with multi-factor authentication (MFA) before they can perform any actions on Amazon EC2 instances. The SysOps administrator needs to implement this requirement using IAM policies. Which IAM policy condition key should be used to enforce MFA?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key checks whether the user authenticated using a valid MFA device before making the API request. By setting this condition to `true` in an IAM policy, you can enforce that all actions on EC2 instances require MFA authentication, meeting the company's requirement.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

iam:PassedToService

Question 11

Refer to the exhibit. An IAM policy is attached to a user. Which statement about the user's access is correct?

Accepted Answer

The user can get objects only over HTTPS.. The GetObject action has a condition requiring SecureTransport to be true, meaning only HTTPS is allowed. Option A is incorrect because HTTP is not allowed for GetObject. Option B is incorrect because ListBucket does not have the SecureTransport condition, so HTTP is allowed for listing objects. Option C is incorrect because listing objects is allowed over HTTP.

Answer

The user can get objects over HTTP.

Answer

The user can list objects in the bucket over HTTP.

Answer

The user can list objects only over HTTPS.

Question 12

A company has an S3 bucket policy as shown. A developer tries to upload an object using the AWS CLI without the --no-verify-ssl flag. What will happen?

Accepted Answer

The upload will succeed because the CLI uses HTTPS by default.. The bucket policy denies requests that do not use secure transport (HTTP) but allows HTTPS requests. The AWS CLI uses HTTPS by default, and since the developer did not use --no-verify-ssl, the request is made over HTTPS. Therefore, the upload succeeds. Option D is correct. Option A is incorrect because the CLI uses HTTPS, not HTTP. Option B is incorrect because the policy does not deny all s3:* actions; it only denies requests over HTTP. Option C is incorrect because the policy requires HTTPS, and the CLI complies, so the upload does not fail.

Answer

The upload will succeed only if the developer uses HTTP.

Answer

The upload will fail because the policy denies all s3:* actions.

Answer

The upload will fail because the policy requires explicit HTTPS.

Question 13

An application runs on c5.xlarge EC2 instances 24 hours a day, 7 days a week in us-east-1. The workload is stable and will not change instance type for at least 12 months. The team wants to reduce compute costs by 30 to 40 percent compared to On-Demand pricing. Which purchasing option achieves this with the lowest financial risk?

Accepted Answer

Purchase a 1-year Standard Reserved Instance for c5.xlarge in us-east-1 with All Upfront or Partial Upfront payment. A 1-year Standard Reserved Instance (RI) with All Upfront or Partial Upfront payment offers a 30-40% discount over On-Demand pricing for a stable, always-on workload. This option provides the lowest financial risk because it commits to a fixed instance type and region for only one year, matching the workload's stable nature without the flexibility premium of Convertible RIs or the interruption risk of Spot Instances.

Answer

Use Spot Instances with an interruption tolerance of 5 minutes for the workload

Answer

Enable EC2 Auto Scaling with a target tracking policy to scale down to zero instances during off-peak hours

Answer

Purchase a 3-year Convertible Reserved Instance to maximize the discount percentage

Question 14

Developers are allowed to create IAM roles for their Lambda functions. However, the security team is concerned that developers could create roles with Administrator access, granting Lambda functions more permissions than the developers themselves have. What IAM feature prevents privilege escalation in this scenario?

Accepted Answer

Attach a permission boundary to each developer IAM user that limits them to creating roles with only the permissions they are allowed to grant. Permission boundaries are an IAM feature that allow you to set the maximum permissions that an identity-based policy can grant to a principal. By attaching a permission boundary to each developer IAM user that restricts them to creating roles with only the permissions they are allowed to grant, you prevent the developer from creating a Lambda execution role with AdministratorAccess or any other policy that exceeds the boundary. This directly addresses the privilege escalation concern because the boundary acts as a ceiling on the permissions the developer can delegate to the role.

Answer

Enable IAM Access Analyzer to detect when developers create overly permissive roles

Answer

Require MFA for all IAM API calls so developers must re-authenticate before creating roles

Answer

Enable CloudTrail logging for all IAM API calls and set up a CloudWatch alarm for iam:CreateRole events

Question 15

A company's security team requires that all API calls to AWS services are encrypted in transit using TLS 1.2 or higher. Which TWO actions should be taken to enforce this?

Accepted Answer

Use AWS CloudTrail to monitor for API calls using TLS 1.0 and generate alerts.. Options C and E are correct. Using AWS CloudTrail to monitor for API calls using TLS 1.0 allows the security team to detect non-compliant requests and generate alerts. Creating an SCP that denies AWS API calls using protocols lower than TLS 1.2 enforces encryption in transit at the organizational level. Option A is incorrect because CloudTrail logging alone does not enforce encryption; it only records events. Option B is incorrect because EC2 security groups control network traffic to instances, not API calls to AWS services. Option D is incorrect because IAM policies can require HTTPS via the aws:SecureTransport condition, but cannot enforce a specific TLS version like 1.2.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Configure EC2 security groups to only allow HTTPS traffic.

Answer

Create an IAM policy that denies access unless the request uses TLS 1.2.