SOA-C02 Practice Test 14 — 15 Questions

Question 1

A company has a VPC that requires DNS resolution for custom domain names within the VPC. They want to use a private hosted zone in Amazon Route 53. Which resource is required to associate the private hosted zone with the VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A VPC. To associate a private hosted zone with a VPC in Amazon Route 53, you must specify the VPC ID and the AWS Region of the VPC. The VPC itself is the required resource because the private hosted zone is scoped to one or more VPCs, enabling DNS resolution for custom domain names only within those VPCs. Without a VPC association, the private hosted zone cannot serve DNS queries.

Answer

A resolver rule

Answer

A public hosted zone

Answer

A CNAME record

Question 2

A company uses an Amazon DynamoDB table with on-demand capacity mode. The table handles a workload with a steady baseline of 500 writes per second but spikes to 2,000 writes per second for a few hours each day. The SysOps administrator wants to reduce costs without affecting application performance during spikes. Which action should the administrator take?

Accepted Answer

Switch to provisioned capacity with auto scaling to handle the spikes.. On-demand capacity mode is ideal for unpredictable workloads but costs more per write than provisioned capacity. Since this workload has a predictable baseline and spikes, switching to provisioned capacity with auto scaling allows you to pay a lower rate for the steady 500 writes per second while auto scaling automatically adds capacity to handle the 2,000 writes per second spikes, reducing overall cost without impacting performance.

Answer

Enable DynamoDB Accelerator (DAX) to cache reads.

Answer

Create a global table to distribute write traffic.

Answer

Use Amazon ElastiCache to buffer write requests.

Question 3

A company is using Amazon Route 53 as its DNS service. The company has a web application running on an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that if the ALB fails, traffic is automatically redirected to a static error page hosted on an Amazon S3 bucket. Which Route 53 routing policy should be used to achieve this?

Accepted Answer

Failover routing policy. The Failover routing policy in Amazon Route 53 is designed to route traffic to a primary resource (the ALB) and automatically redirect to a secondary resource (the S3 bucket static error page) when the primary health check fails. This ensures high availability by failing over to the static error page if the ALB becomes unhealthy, meeting the requirement precisely.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 4

A web application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. To achieve high availability, what is the minimum number of Availability Zones (AZs) that must be configured for the Auto Scaling group?

Accepted Answer

2. For high availability, an Auto Scaling group must span at least two Availability Zones (AZs) to ensure that if one AZ fails, the application remains available from the other AZ. A single AZ would create a single point of failure, violating the high-availability requirement. The Application Load Balancer distributes traffic across healthy instances in all configured AZs, so two AZs are the minimum to achieve fault tolerance.

Answer

1

Answer

3

Answer

4

Question 5

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The administrator has a template that creates an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to reuse the same template for development, test, and production environments, where the only differences are the EC2 instance type and the RDS DB instance class. Which CloudFormation feature should be used to define these environment-specific values?

Accepted Answer

Parameters. Parameters are the correct CloudFormation feature to define environment-specific values because they allow you to input custom values (e.g., EC2 instance type and RDS DB instance class) at stack creation or update time without modifying the template. This enables reuse of the same template across development, test, and production environments by simply passing different parameter values for each environment.

Answer

Mappings

Answer

Conditions

Answer

Outputs

Question 6

A SysOps administrator notices that an Amazon RDS DB instance is running at 10% CPU utilization consistently. The instance has 8 vCPUs and 32 GB RAM. The application's performance is adequate. Which action will reduce costs without affecting performance?

Accepted Answer

Change the DB instance to a smaller instance type.. The DB instance is over-provisioned for the current workload, as evidenced by the consistently low CPU utilization (10%) and adequate application performance. By changing to a smaller instance type, you reduce compute costs directly while maintaining sufficient capacity for the workload. This is the most straightforward cost optimization action when performance requirements are already met.

Answer

Enable Multi-AZ deployment for the DB instance.

Answer

Change the storage type from gp2 to gp3.

Answer

Increase the provisioned IOPS.

Question 7

A company runs a web application on Amazon EC2 instances. The SysOps administrator needs to monitor two metrics: high CPU utilization (greater than 90%) and high memory utilization (greater than 85%). An alarm should trigger when both conditions are true simultaneously for a period of 5 minutes. Which CloudWatch feature should the administrator use to create this alarm?

Accepted Answer

Composite alarm. A composite alarm in Amazon CloudWatch allows you to create an alarm that evaluates multiple conditions using logical operators (AND, OR, NOT). In this scenario, the administrator needs the alarm to trigger only when both CPU utilization > 90% AND memory utilization > 85% are true simultaneously for 5 minutes. Composite alarms evaluate the state of underlying metric alarms (e.g., two separate simple alarms for CPU and memory) and combine them with an AND condition, making it the correct feature for this requirement.

Answer

Metric math

Answer

Anomaly detection

Answer

Logs Insights

Question 8

A SysOps administrator is tasked with automating the creation of IAM roles and policies using AWS CloudFormation. The template includes an IAM role and a managed policy. The stack creation fails with the error 'Policy arn:aws:iam::123456789012:policy/MyManagedPolicy not found'. The policy is created in the same template. What is the MOST likely solution?

Accepted Answer

Add a 'DependsOn' clause to the IAM role resource for the managed policy, and reference the policy ARN using the 'Ref' intrinsic function.. The error occurs because CloudFormation attempts to create the IAM role before the managed policy is fully created, even though both are defined in the same template. Adding a 'DependsOn' clause to the IAM role resource ensures that CloudFormation waits for the managed policy to be created first. Using the 'Ref' intrinsic function to reference the policy ARN is correct because 'Ref' for an AWS::IAM::ManagedPolicy returns the policy ARN, which is needed for the role's 'ManagedPolicyArns' property.

Answer

Remove the policy document from the template and create the policy separately.

Answer

Use a custom resource to create the policy before the role.

Answer

Create the IAM role in a separate stack.

Question 9

A company runs a production database on an Amazon RDS for PostgreSQL DB instance in a single Availability Zone. The SysOps administrator needs to improve the database's availability to meet an SLA of 99.99% and ensure automatic failover in case of a database failure. Which configuration change should be made?

Accepted Answer

Enable a Multi-AZ deployment. Enabling a Multi-AZ deployment for an Amazon RDS PostgreSQL DB instance automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a database failure or an Availability Zone outage, Amazon RDS automatically fails over to the standby replica, typically within 60-120 seconds, meeting the 99.99% SLA requirement without manual intervention.

Answer

Create a read replica in a different AWS Region

Answer

Configure automated backups with cross-region copy

Answer

Enable deletion protection on the DB instance

Question 10

A SysOps administrator is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to ensure that updates to the stack do not accidentally replace the RDS instance if the RDS configuration is changed in a way that would require replacement. Which CloudFormation attribute should be added to the RDS resource?

Accepted Answer

UpdateReplacePolicy with Retain. The `UpdateReplacePolicy` attribute with `Retain` tells CloudFormation to preserve the existing RDS DB instance if a stack update would otherwise require its replacement. This prevents accidental deletion and recreation of the RDS instance when its configuration changes in a way that forces a new physical resource, such as modifying the DB engine version or storage type. The `UpdateReplacePolicy` is specifically designed for update scenarios, unlike `DeletionPolicy` which only applies during stack deletion.

Answer

DeletionPolicy with Retain

Answer

StackPolicy

Answer

CreationPolicy

Question 11

A company uses Amazon S3 to store sensitive customer data. A SysOps administrator needs to ensure that any S3 bucket that is incorrectly configured to allow public read access is automatically remediated within five minutes. The administrator wants to use native AWS services with minimal custom code. Which solution should be used?

Accepted Answer

Use AWS Config with the 's3-bucket-public-read-prohibited' managed rule and configure automatic remediation to block public access.. AWS Config with the 's3-bucket-public-read-prohibited' managed rule can automatically evaluate S3 bucket configurations against the desired state. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action (e.g., applying an S3 bucket policy or blocking public access) using AWS Systems Manager Automation documents, all within the required five-minute window and with minimal custom code.

Answer

Create an Amazon EventBridge (CloudWatch Events) rule that triggers an AWS Lambda function to check and fix public read access.

Answer

Apply an S3 bucket policy to each bucket that denies public read access.

Answer

Use AWS Trusted Advisor to check for public read access and manually remediate when notified.

Question 12

A SysOps administrator notices that an IAM user can access the AWS Management Console but cannot use the AWS CLI. The user has a password and an access key. What is the most likely cause?

Accepted Answer

The IAM policy denies CLI access unless MFA is present. The most likely cause is that the user's IAM policy includes a condition that denies CLI access unless MFA is present. The AWS CLI uses access keys for authentication, and if a policy explicitly requires MFA for API calls (e.g., via `aws:MultiFactorAuthPresent` condition key), CLI requests will be denied even though console access (which can enforce MFA separately via a sign-in policy) remains functional. This scenario is common when an administrator has attached a policy like `DenyAllExceptWithMFA` to the user or a group.

Answer

The secret access key was not saved during creation

Answer

The user's access key is inactive

Answer

The user is using the wrong password for the CLI

Question 13

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 5xx errors. CloudWatch metrics show that the ALB's 'HTTPCode_ELB_5XX_Count' is elevated. What is the MOST likely cause?

Accepted Answer

The load balancer is timing out waiting for a response from the target.. When the ALB's 'HTTPCode_ELB_5XX_Count' is elevated, it indicates that the load balancer itself is generating the 5xx error, not the target. The most common cause is that the load balancer is timing out while waiting for a response from the target instances, which occurs when the target takes longer than the configured idle timeout (default 60 seconds) to respond. This results in the ALB returning a 504 Gateway Timeout error, which is counted in the ELB 5xx metric.

Answer

The target instances are returning HTTP 503 errors.

Answer

The target instances have high latency but are still responding.

Answer

Client requests are malformed and being rejected by the load balancer.

Question 14

A company has multiple VPCs in the same AWS account and Region, each with overlapping CIDR blocks (10.0.0.0/16). The SysOps administrator needs to establish connectivity between all VPCs and the on-premises network via AWS Transit Gateway. Additionally, certain VPCs must be isolated from each other while still reaching on-premises. How should the administrator configure the Transit Gateway to meet these requirements?

Accepted Answer

Create multiple Transit Gateway route tables: one for each group of VPCs that need to communicate, and associate each VPC attachment with the appropriate route table. Add static routes to the on-premises network in each route table.. AWS Transit Gateway supports multiple route tables, allowing you to isolate VPC attachments from each other while still providing a common route to the on-premises network. By creating separate route tables for each group of VPCs that need to communicate, and associating the appropriate VPC attachments with those tables, you can enforce isolation between groups. Adding static routes to the on-premises network in each route table ensures all VPCs can reach on-premises, even when they cannot communicate with each other.

Answer

Create a single Transit Gateway route table and add routes for all VPCs and the on-premises network.

Answer

Use VPC peering instead of Transit Gateway to connect VPCs, and use Direct Connect Gateway for on-premises connectivity.

Answer

Configure VPN connections between each VPC and the on-premises network, bypassing Transit Gateway.

Question 15

A SysOps administrator receives an alert that a VPN connection between a VPC and an on-premises network is down. The VPN uses static routing. After verifying the on-premises side is functioning, what should the administrator check in AWS?

Accepted Answer

Verify that the customer gateway device is configured with the correct IP address.. Since the VPN uses static routing, BGP is not in use, so checking BGP session status (Option A) is irrelevant. Rebooting the virtual private gateway (Option B) is a disruptive action that should not be a first step without identifying the root cause. Ensuring the route table has a route to the virtual private gateway (Option C) is important for traffic flow but does not address the VPN tunnel being down. The correct first step is to verify that the customer gateway device is configured with the correct IP address (Option D), because a mismatch in the public IP address of the on-premises VPN endpoint will prevent the IPsec tunnel from establishing, even if the on-premises side is functioning internally.

Answer

Check the BGP session status.

Answer

Reboot the virtual private gateway.

Answer

Ensure the route table has a route to the virtual private gateway.