SOA-C02 Practice Test 15 — 15 Questions

Question 1

Drag and drop the steps to migrate an on-premises application to AWS using AWS Application Migration Service (MGN) into the correct order.

Accepted Answer

Install the agent, then configure replication, then sync, then test, then cut over.. The correct sequence for migrating an on-premises application to AWS using AWS Application Migration Service is: first install the AWS Replication Agent on the source server, then configure the replication settings including launch settings and target VPC, then start the initial sync to replicate the entire server volume, then perform a test launch to validate the replicated environment, and finally initiate the cutover to redirect production traffic to the new AWS instance. Each step builds on the previous one to ensure a successful migration with minimal downtime.

Answer

Install the agent, then sync, then configure replication, then test, then cut over.

Answer

Configure replication, then install the agent, then sync, then test, then cut over.

Answer

Install the agent, then configure replication, then test, then sync, then cut over.

Question 2

An organization uses AWS Service Catalog to manage approved IT services. A SysOps administrator needs to update a CloudFormation template used by a product. The administrator wants to ensure that existing provisioned products are updated with the new template version. What step must the administrator take after updating the product?

Accepted Answer

Create a new product version and update the provisioned products to use the new version.. To update existing provisioned products, you must create a new product version and update the provisioned product to that version. Simply updating the template directly or modifying the portfolio does not automatically propagate changes to provisioned products.

Answer

Update the portfolio that contains the product.

Answer

Update the product's CloudFormation template directly in the Service Catalog console.

Answer

Terminate the existing provisioned products and reprovision them.

Question 3

Refer to the exhibit. A security group is attached to an Application Load Balancer (ALB) that serves HTTPS traffic on port 443. Users can access the application via HTTPS. However, the ALB's health checks to targets on port 80 are failing. What is the reason?

Accepted Answer

The security group for the target instances does not allow HTTP traffic from the ALB's security group.. The ALB's security group allows inbound HTTPS from anywhere (0.0.0.0/0) on port 443, and inbound HTTP from the VPC CIDR (10.0.0.0/16) on port 80. Health checks originate from the ALB's private IP addresses, which are within the VPC CIDR. Therefore, the ALB's security group is correctly configured. The health checks fail because the target instances' security group does not allow inbound HTTP traffic from the ALB's security group. When the target's security group lacks a rule permitting traffic from the ALB's security group, the health check requests are blocked. Option A is incorrect because the ALB's security group does allow HTTPS from the internet. Option C is incorrect because the ALB's security group allows HTTP from the VPC CIDR, which includes the target's IP range. Option D is incorrect because health checks are configured on port 80 (HTTP), not HTTPS.

Answer

The ALB's security group does not allow HTTPS traffic from the internet.

Answer

The ALB's security group does not allow HTTP traffic from the target's IP range.

Answer

The health check is configured to use HTTPS, but the target only supports HTTP.

Question 4

A SysOps administrator needs to ensure that all traffic to an Amazon S3 bucket is encrypted in transit. Which configuration should be used?

Accepted Answer

Add a bucket policy that denies requests where aws:SecureTransport is false.. A bucket policy with a condition that denies requests when aws:SecureTransport is false (i.e., HTTP) enforces HTTPS for all access to the S3 bucket. Option A is incorrect because CloudFront with HTTPS only encrypts traffic between the viewer and CloudFront, not necessarily between CloudFront and S3 unless configured, and it does not enforce HTTPS for direct S3 access. Option B is incorrect because a VPC endpoint for S3 uses private IPs but does not enforce encryption in transit; it can still use HTTP. Option C is incorrect because default encryption on an S3 bucket only encrypts data at rest, not in transit.

Answer

Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.

Answer

Create a VPC endpoint for S3 and route all traffic through it.

Answer

Enable default encryption on the S3 bucket.

Question 5

The security team requires that no S3 bucket in the account ever has public read or write ACLs enabled. They want non-compliant buckets automatically remediated within 5 minutes of detection without any manual intervention. What is the correct implementation?

Accepted Answer

Create an AWS Config rule for s3-bucket-public-read-prohibited; configure auto-remediation using the AWS-DisableS3BucketPublicReadWrite SSM Automation document. AWS Config can evaluate S3 bucket ACLs against the `s3-bucket-public-read-prohibited` managed rule and automatically trigger an AWS Systems Manager (SSM) Automation document (`AWS-DisableS3BucketPublicReadWrite`) as a remediation action. This ensures non-compliant buckets are fixed within minutes without manual intervention, meeting the 5-minute requirement.

Answer

Create an EventBridge rule that matches S3 PutBucketAcl API calls and triggers a Lambda function to re-apply a private ACL

Answer

Enable S3 Block Public Access at the account level to prevent public ACLs from being set in the first place

Answer

Schedule a daily Lambda function that lists all buckets, checks ACLs, and removes public grants if found

Question 6

A company uses AWS CodeCommit to store its source code and AWS CodeBuild to compile and test the code. The SysOps administrator is setting up a new build project that needs to access a private Amazon S3 bucket to download build dependencies. The build project runs in a VPC. The administrator has attached an IAM role to the build project with permissions to access the S3 bucket. However, the build fails with an access denied error when trying to download the dependencies. The S3 bucket is in the same region and account. What should the administrator do to resolve the issue?

Accepted Answer

Create a VPC endpoint for Amazon S3 and associate it with the VPC where CodeBuild runs.. When CodeBuild runs in a VPC, it cannot access S3 endpoints over the internet by default. An S3 VPC endpoint allows CodeBuild to access S3 privately without needing an internet gateway or NAT. The IAM role already has the necessary permissions; the issue is network connectivity.

Answer

Attach an internet gateway to the VPC to provide internet access.

Answer

Configure the security group for CodeBuild to allow outbound traffic to the S3 bucket.

Answer

Update the IAM role to include 's3:ListBucket' permission.

Question 7

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a deployment stage that uses AWS CloudFormation to deploy infrastructure. The company wants to add a manual approval step before the CloudFormation deployment. How should this be configured?

Accepted Answer

Add a manual approval action in the pipeline before the CloudFormation deployment stage.. AWS CodePipeline has a built-in approval action that pauses the pipeline at a specified stage until a manual approval is granted. This allows a human to review and approve before the CloudFormation deployment proceeds. Option A is wrong because a CloudFormation change set action creates a change set for review but does not pause the pipeline; the pipeline continues unless manually stopped separately. Option B is wrong because Amazon SNS alone sends notifications but does not pause the pipeline; you would need an approval action to block execution. Option D is wrong because an AWS Lambda function cannot block the pipeline; it can notify but the pipeline will continue unless an approval action is used.

Answer

Add a CloudFormation change set action before the deployment.

Answer

Configure an Amazon SNS topic to send a notification and require a confirmation.

Answer

Use an AWS Lambda function to send an email and wait for a response.

Question 8

A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?

Accepted Answer

Review and modify the IAM group policy to include ec2:TerminateInstances action. The administrator should review the group policy to ensure it includes ec2:TerminateInstances. The issue is likely a missing action in the policy, not a service control policy (SCP) or session policy issue, and simply adding the user to a new group won't fix the underlying policy gap.

Answer

Attach a managed policy that includes ec2:TerminateInstances directly to the user

Answer

Add the user to a different IAM group that has the required permissions

Answer

Check the user's permissions boundary for any restrictions

Question 9

A company hosts a static website on Amazon S3. Users access the website from around the world. The SysOps administrator needs to deliver content with low latency and support HTTPS with a custom domain. Which AWS service should be used?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for global users. It natively supports HTTPS with custom domains via SSL/TLS certificates from AWS Certificate Manager (ACM) and integrates with S3 as an origin. This combination of low-latency delivery and HTTPS termination makes CloudFront the correct choice for this scenario.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 latency-based routing

Answer

S3 Transfer Acceleration

Question 10

A SysOps administrator needs to restrict access to an S3 bucket so that only users from the corporate network IP range (203.0.113.0/24) can read objects. Which TWO elements are required to implement this? (Choose two.)

Accepted Answer

The S3 endpoint URL (s3.amazonaws.com) accessible from the corporate network. To restrict access to an S3 bucket based on IP range, two elements are required: an S3 bucket policy with a condition using aws:SourceIp to allow s3:GetObject only from the corporate IP range (203.0.113.0/24), and the S3 endpoint (s3.amazonaws.com) must be reachable from the corporate network (typically over the internet). Option A is incorrect because an IAM policy by itself does not restrict bucket-level access; a bucket policy is needed. Option B is not required as CloudFront is not necessary for IP-based restrictions. Option E is incorrect because a VPC endpoint is used for private connectivity within a VPC, not for restricting access from an external IP range.

Answer

An IAM policy that allows s3:GetObject from the corporate IP

Answer

Amazon CloudFront distribution with an origin access identity

Answer

A VPC gateway endpoint for S3

Question 11

A company is designing a backup strategy for its on-premises file servers to AWS. Which TWO services can be used to back up data to AWS? (Choose TWO.)

Accepted Answer

AWS Backup. AWS Backup is correct because it provides a fully managed, policy-based backup service that can centrally automate and manage backups for on-premises file servers via the AWS Backup Gateway (formerly Storage Gateway Virtual Tape Library). It integrates with AWS Storage Gateway to back up on-premises data to S3 and Glacier, supporting file-level recovery without needing custom scripts.

Answer

AWS Snowball

Answer

Amazon EFS

Answer

S3 Transfer Acceleration

Question 12

A company runs a web application on Amazon EC2 instances in an Auto Scaling group that spans two Availability Zones. The application uses an Application Load Balancer (ALB) that is deployed across the same Availability Zones. The SysOps administrator wants to ensure the application remains available if an entire Availability Zone fails. Which configuration is essential for this high availability?

Accepted Answer

Configure the Auto Scaling group with at least one instance in each Availability Zone.. For high availability across an Availability Zone (AZ) failure, the Auto Scaling group must have at least one healthy instance in each AZ. This ensures that if one AZ becomes unavailable, the ALB can route traffic to instances in the remaining AZ. Without this minimum distribution, a single AZ failure could leave the application with zero healthy targets if all instances were in the failed AZ.

Answer

Enable cross-zone load balancing on the Application Load Balancer.

Answer

Use an Amazon Route 53 health check to route traffic away from a failed AZ.

Answer

Attach an Elastic IP address to each instance in the Auto Scaling group to ensure IP persistence.

Question 13

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The SysOps administrator checks the deployment logs and finds that the application installation script exits with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The AppSpec file contains a lifecycle hook that fails.. A non-zero exit code from an AppSpec lifecycle hook (e.g., ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService) during the deployment process causes the overall deployment to fail. The error message indicates that individual instances failed deployment, and the installation script exiting with a non-zero exit code is a direct sign of a lifecycle hook failure. Option A is incorrect because insufficient instances in the Auto Scaling group would trigger a different error related to minimum capacity, not a script exit code. Option B is incorrect because the security group blocking outbound traffic would prevent the CodeDeploy agent from communicating with the service, resulting in a connection error, not a script exit code issue. Option D is incorrect because an outdated CodeDeploy agent would typically produce agent-specific errors or version mismatch warnings, not a non-zero exit code from the installation script.

Answer

The Auto Scaling group does not have enough instances to meet the minimum capacity.

Answer

The security group for the instances blocks outbound traffic to CodeDeploy endpoints.

Answer

The CodeDeploy agent is outdated on the instances.

Question 14

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect to an on-premises network with a CIDR of 10.0.0.0/8. What is the issue?

Accepted Answer

The CIDR blocks overlap, causing routing conflicts.. Overlapping CIDR blocks prevent VPC peering or VPN connections because routes conflict. Option A is not the issue. Option B is not the primary issue. Option D is not directly a problem.

Answer

The on-premises CIDR is private and cannot be used with AWS.

Answer

AWS does not support /8 CIDR blocks.

Answer

The VPC CIDR is too large.

Question 15

A SysOps administrator needs to monitor the disk space usage on an EC2 instance running Windows Server. Which actions are required to collect this metric? (Select TWO.)

Accepted Answer

Create an IAM role with permissions to publish custom metrics and attach it to the instance.. The CloudWatch agent requires permissions to publish custom metrics to CloudWatch. An IAM role with the appropriate policy (e.g., CloudWatchAgentServerPolicy) must be attached to the EC2 instance to allow the agent to send disk space metrics. Option E is correct because the CloudWatch agent must be installed and configured with a JSON configuration file that includes the "disk" section to collect disk space utilization metrics, which are not available by default from EC2.

Answer

Install the CloudWatch Logs agent to monitor disk usage logs.

Answer

Enable EC2 status checks to monitor disk health.

Answer

Use Windows Performance Monitor to track disk space and send to CloudWatch.