SOA-C02 Practice Test 14 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a web application. The pipeline includes a stage that runs a database migration script. The SysOps administrator wants to ensure that if the migration script fails, the entire pipeline stops and the previous version of the application remains deployed. Which pipeline stage configuration should be used to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the migration step as a sequential action and set the OnFailure to ABORT.. Setting the migration step as a sequential action with OnFailure set to ABORT ensures that if the migration script fails, the pipeline immediately stops and does not proceed to any subsequent stages. This prevents the deployment of a new application version that depends on a failed database migration, thereby keeping the previous version deployed.

Answer

Use a parallel action group for the migration step so other steps continue.

Answer

Configure the migration step as a sequential action and set the OnFailure to ROLLBACK.

Answer

Use a manual approval step after the migration to verify success.

Question 2

A company is using Amazon CloudFront to distribute content globally. The company wants to restrict access to content so that only users from specific countries can access it. Which CloudFront feature should be used?

Accepted Answer

Geo restriction. CloudFront's geo restriction feature (also known as geo-blocking) allows you to allow or block access to your content based on the geographic location of the viewer's IP address. This is the correct choice because the requirement is specifically to restrict access by country, which is exactly what geo restriction does by using a country-level allowlist or blocklist.

Answer

AWS WAF

Answer

Signed URLs

Answer

Origin Access Identity (OAI)

Question 3

A security policy prohibits opening SSH port 22 on any EC2 instance. The operations team needs to run a shell script on 150 Linux instances to collect configuration inventory data. The script output must be captured for review. How should the team execute the script?

Accepted Answer

Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket. SSM Run Command with the AWS-RunShellScript document allows you to execute shell scripts on multiple EC2 instances without opening SSH port 22, as it operates over the AWS Systems Manager agent (SSM Agent) using HTTPS (port 443). The output can be directed to an S3 bucket for centralized review, satisfying both the security policy and the requirement to capture script output.

Answer

Create a bastion host with SSH access and use a for loop to SSH into each instance and run the script

Answer

Use EC2 Instance Connect to establish a temporary SSH session for each instance and run the script

Answer

Terminate all instances and re-launch them from a new AMI that includes the configuration inventory already baked in

Question 4

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an email notification when the metric exceeds 90% for 5 consecutive minutes. The solution should use the least operational overhead. Which combination of AWS services should be used?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric and configure the alarm to send a notification to an Amazon SNS topic with email subscriptions.. A CloudWatch alarm directly monitors the CPUUtilization metric for an EC2 instance and can be configured to evaluate whether the metric exceeds 90% for 5 consecutive minutes (e.g., 5 evaluation periods of 1 minute each). The alarm then publishes to an Amazon SNS topic, which sends email notifications to subscribed endpoints, requiring no additional infrastructure or code, thus minimizing operational overhead.

Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to check the CPUUtilization metric and send an email via Amazon SES.

Answer

Configure the EC2 instance to publish CPU logs to Amazon CloudWatch Logs, then create a metric filter to detect high CPU and trigger an SNS notification.

Answer

Use AWS CloudTrail to monitor EC2 CPU metrics and send notifications to an Amazon SQS queue.

Question 5

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline consists of a source stage (AWS CodeCommit) and a deploy stage (AWS CodeDeploy) that deploys to an Auto Scaling group. The SysOps administrator needs to add a stage to run automated unit tests before the deployment proceeds. The tests must be executed in an isolated environment, and if they fail, the pipeline must stop and notify the development team. Which action should the administrator take?

Accepted Answer

Add a stage between source and deploy that uses an AWS CodeBuild action to run unit tests defined in a buildspec file. The pipeline will automatically stop if the build action fails.. AWS CodeBuild is natively integrated with CodePipeline to run automated tests defined in a buildspec file. When the build action fails, CodePipeline automatically stops the pipeline execution and can send notifications via Amazon SNS, meeting the requirement for an isolated test environment and automatic failure notification without manual intervention.

Answer

Add a manual approval action between the source and deploy stages. The development team will manually run the tests on their local machines and then approve the pipeline to proceed.

Answer

Insert a test stage after the source stage with an AWS CloudFormation action that deploys a test stack and runs tests using a custom resource Lambda function.

Answer

Add a Lambda function as an action in the pipeline that runs the unit tests. The Lambda function writes the test results to an S3 bucket, and a subsequent approval action checks the results.

Question 6

A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application uses Amazon EBS volumes (gp2) for data storage. The SysOps administrator notices that the storage costs are high, and the application's IOPS requirements are consistently below 3000. The administrator wants to reduce storage costs without affecting performance. Which action should the administrator take?

Accepted Answer

Convert the EBS volumes from gp2 to gp3 volume type.. Gp3 volumes offer a baseline performance of 3000 IOPS and 125 MB/s throughput at a lower cost than gp2 volumes, making them ideal for workloads with IOPS requirements consistently below 3000. By converting from gp2 to gp3, the administrator can reduce storage costs without any performance impact, as gp3 provides the same or better baseline performance at a lower price per GB.

Answer

Modify the EBS volumes to use Provisioned IOPS (io1) volumes and set IOPS to 2000.

Answer

Implement an Amazon EBS snapshot lifecycle policy to delete old snapshots and reduce storage costs.

Answer

Enable EBS optimization on the EC2 instances to improve throughput and reduce costs.

Question 7

A SysOps administrator manages a fleet of EC2 instances that run a batch processing job. The job runs every hour and takes about 45 minutes to complete. The administrator wants to be notified if any job takes longer than 1 hour. Currently, the administrator uses CloudWatch Logs to capture job start and end times from application logs. The job writes a log message at start with 'JOB_START' and at end with 'JOB_END'. The administrator wants to create a metric filter that counts jobs that exceed 1 hour. However, the administrator is unsure how to achieve this with CloudWatch Logs. What should the administrator do?

Accepted Answer

Use CloudWatch Events to capture the log events and trigger a Lambda function to compute duration.. CloudWatch Events (now part of Amazon EventBridge) can capture log events in real-time and trigger a Lambda function. The Lambda function can then compute job duration by correlating JOB_START and JOB_END events (e.g., using a DynamoDB table to store start times) and publish a custom metric or trigger an alarm if duration exceeds 1 hour. This approach handles the per-job correlation that metric filters cannot achieve.

Answer

Use CloudWatch Logs Insights to run a query every hour and check the duration.

Answer

Create a metric filter that extracts the timestamp of JOB_START and JOB_END and computes the duration in a custom metric.

Answer

Create a Lambda function that is triggered by S3 to process the logs and publish a custom metric.

Question 8

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Linux 2 AMI with specific security agents installed. The company wants to ensure that all environment instances use this custom AMI. Which combination of steps should be taken? (Choose two.)

Accepted Answer

Create a custom AMI using the Elastic Beanstalk platform as the base.. To ensure all environment instances use a custom AMI with specific security agents, you must create the custom AMI from the Elastic Beanstalk platform (C) to maintain compatibility. Then configure the .ebextensions folder to set the AMI ID in the Auto Scaling launch configuration using the aws:autoscaling:launchconfiguration namespace (D). Option A is incorrect because the AMI ID is set in the environment configuration, not a CloudFormation template. Option B is incorrect because CodeDeploy deploys application code, not the AMI itself. Option E is incorrect because while Packer can be used to create AMIs, it is not required; the custom AMI must be based on the Elastic Beanstalk platform, not any base image.

Answer

Set the AMI ID in a CloudFormation template and associate it with the environment.

Answer

Use AWS CodeDeploy to deploy the application to the custom AMI.

Answer

Use Packer to create the custom AMI from any base image.

Question 9

An Auto Scaling group launches new EC2 instances when CPU exceeds 70 percent. The instances take 4 minutes to bootstrap (install software, register with a service discovery system, and warm up caches). Without a hook, the load balancer routes traffic to new instances before they are ready, causing 503 errors. What is the correct solution?

Accepted Answer

Add a lifecycle hook on the autoscaling:EC2_INSTANCE_LAUNCHING transition; signal CompleteLifecycleAction(CONTINUE) when bootstrap finishes. Lifecycle hooks allow the Auto Scaling group to pause instance launch until a custom action (e.g., bootstrap completion) is finished. By adding a hook on the autoscaling:EC2_INSTANCE_LAUNCHING transition, the instance is held in a 'pending:wait' state. Once the bootstrap script calls CompleteLifecycleAction with the CONTINUE result, the instance transitions to 'InService' and can then be registered with the load balancer, preventing premature traffic and 503 errors.

Answer

Increase the load balancer health check grace period to 10 minutes to give instances time to bootstrap

Answer

Increase the warm-up time in the Auto Scaling group's instance refresh configuration

Answer

Use a weighted target group with 0 weight for new instances until they are confirmed healthy

Question 10

Which TWO actions can be taken to improve the availability of a web application hosted on EC2 instances behind an Application Load Balancer? (Select two.)

Accepted Answer

Configure an Auto Scaling group with health checks to replace unhealthy instances.. An Auto Scaling group with health checks can automatically replace unhealthy EC2 instances, improving availability. Option C is correct because deploying instances across multiple Availability Zones provides fault tolerance; if one AZ fails, your application continues to run in another. Option B is incorrect because using larger instance types improves performance, not availability. Option D is incorrect because using a single region makes the application vulnerable to region-wide failures, reducing availability. Option E is incorrect because placing all instances in a single subnet creates a single point of failure; distributing across AZs is necessary for high availability.

Answer

Use larger EC2 instance types.

Answer

Use a single AWS Region for all instances.

Answer

Place all EC2 instances in a single subnet.

Question 11

Users are intermittently reporting 502 Bad Gateway errors when accessing the application through an Application Load Balancer. The team needs to identify which target IPs are associated with the failures and the request processing time for those requests. Application logs on instances do not capture failures before the ALB connection. What should be enabled?

Accepted Answer

Enable ALB access logs, specify an S3 bucket destination, and query the logs to filter on elb_status_code=502. ALB access logs capture detailed information about each request, including the target IP address, request processing time, and the HTTP status code returned by the ALB. By enabling these logs and querying for `elb_status_code=502`, you can identify which target IPs were associated with the failures and the `request_processing_time` for those requests. This directly addresses the need to correlate failures with specific targets and timing, without relying on application instance logs that miss pre-connection failures.

Answer

Enable AWS X-Ray on the ALB to trace each request end-to-end from client to target

Answer

Configure a VPC Flow Log on the subnets containing the ALB to capture all network traffic

Answer

Install an agent on the application instances that logs all incoming connection attempts from the ALB

Question 12

A security team applied Network ACL rules to a subnet to allow inbound TCP traffic on port 443 (HTTPS). Users connecting from the internet can initiate connections, but they never receive responses. The NACL is applied to the subnet containing the web servers. What is missing?

Accepted Answer

Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports. Network ACLs are stateless, meaning they evaluate each packet independently without tracking connection state. While the inbound rule allows HTTPS traffic (TCP 443) to reach the web servers, the outbound response traffic from the servers to the clients' ephemeral ports (typically 1024–65535) is blocked by the default deny-all outbound rule. Adding an outbound NACL rule allowing TCP traffic on destination ports 1024–65535 permits the response traffic to flow back to the clients, resolving the issue.

Answer

Enable stateful packet inspection on the NACL by toggling the 'track connections' setting in the VPC console

Answer

Add a security group outbound rule allowing all traffic because NACL rules only apply to inbound traffic

Answer

Change port 443 to allow both TCP and UDP protocols in the inbound NACL rule

Question 13

EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?

Accepted Answer

Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway. An S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.

Answer

Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately

Answer

Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway

Answer

Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT

Question 14

Regulatory requirements mandate that all RDS and EBS backups are replicated to a secondary AWS region within 24 hours of creation. The company has workloads in us-east-1 and must replicate backups to eu-west-1. Restoring from the secondary region must be possible without manual copying steps during a disaster. What service and configuration implements this requirement?

Accepted Answer

Create an AWS Backup plan with a cross-Region copy rule that replicates recovery points to a backup vault in eu-west-1 within 24 hours. AWS Backup is the correct service because it natively supports cross-Region copy rules that automatically replicate recovery points (including RDS snapshots and EBS snapshots) to a backup vault in a secondary Region within a specified time window. This meets the 24-hour replication requirement and enables direct restores from the secondary Region without manual copying, as the backup vault in eu-west-1 contains the replicated recovery points ready for use.

Answer

Schedule a Lambda function that calls CreateDBSnapshot and CopyDBSnapshot to replicate RDS snapshots, and CreateSnapshot and CopySnapshot for EBS volumes to eu-west-1

Answer

Enable RDS automated backups with cross-region replication and configure EBS snapshot copy separately using Data Lifecycle Manager

Answer

Use S3 Cross-Region Replication to replicate the backup bucket containing RDS and EBS snapshots to eu-west-1

Question 15

A SysOps Administrator needs to automate the deployment of a three-tier web application on AWS. The application consists of a web tier, application tier, and database tier. The administrator wants to use AWS CloudFormation to provision the infrastructure. Which TWO resources should be included in the CloudFormation template to ensure the application is highly available across multiple Availability Zones?

Accepted Answer

Auto Scaling group. Options A and E are correct. An Auto Scaling group maintains a desired number of instances across multiple Availability Zones, ensuring resilience and high availability. An Application Load Balancer (ALB) distributes incoming traffic across those instances, further supporting high availability and fault tolerance. Option B (NAT Gateway) is used for outbound internet access from private subnets, not for high availability of the application. Option C (S3 bucket) is a storage service and does not directly impact compute high availability. Option D (Route 53 hosted zone) provides DNS routing but is not a primary resource for ensuring high availability within the application tiers; Route 53 can be used for DNS-level failover, but the question asks for resources directly in the CloudFormation template to ensure high availability across AZs, and the ALB and Auto Scaling group are the core components.

Answer

NAT Gateway

Answer

Amazon S3 bucket

Answer

Amazon Route 53 hosted zone