SOA-C02 Practice Test 15 — 15 Questions

Question 1

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is unreachable. The instance passes status checks and is in a healthy state. Security groups and network ACLs are configured correctly. CloudWatch metrics show CPU utilization is 5%. The administrator can SSH into the instance but cannot connect to the web server on port 443. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The web server service is not running or crashed.. The instance passes both status checks and is healthy, and the administrator can SSH into it, confirming that the operating system and network stack are functional. Since the web server is unreachable on port 443 despite correct security group and network ACL configurations, and CPU utilization is low (5%), the most likely cause is that the web server service (e.g., Apache, Nginx) has stopped or crashed. This would prevent the instance from listening on port 443, even though the underlying infrastructure is sound.

Answer

The security group inbound rule for HTTPS is misconfigured.

Answer

The instance has an incorrect route table entry.

Answer

The instance has insufficient CPU credits.

Question 2

A company's security policy requires that all Amazon S3 buckets must have server-side encryption (SSE-S3 or SSE-KMS) enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and remediate it by enabling SSE-S3. Which AWS service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled) that can continuously evaluate S3 bucket configurations against the security policy. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-S3, enforcing compliance without manual intervention.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 3

A SysOps administrator needs to deploy a web application stack consisting of an Amazon EC2 instance, an Amazon RDS database, and an Application Load Balancer. The administrator wants to define the infrastructure as code and version control it. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define and provision AWS resources—such as EC2 instances, RDS databases, and Application Load Balancers—using declarative templates (JSON or YAML). These templates can be version-controlled in a repository like Git, enabling repeatable, auditable deployments. Elastic Beanstalk abstracts infrastructure management but does not give you the same level of granular control over individual resources as CloudFormation.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 4

A company stores critical data in an Amazon S3 bucket in the us-west-2 Region. The SysOps administrator needs to ensure that all objects are automatically replicated to another AWS Region for disaster recovery. The Recovery Point Objective (RPO) must be less than 15 minutes, and existing objects must also be replicated. Which S3 feature should the administrator use?

Accepted Answer

S3 Cross-Region Replication (CRR) with Replication Time Control (RTC). S3 Cross-Region Replication (CRR) with Replication Time Control (RTC) is the correct choice because it provides automatic, asynchronous replication of objects to a different AWS Region, meeting the RPO of less than 15 minutes by guaranteeing replication within 15 minutes for most objects (99.99% of objects are replicated within 15 minutes). Additionally, CRR can replicate existing objects when configured with the appropriate replication rule and batch operations, satisfying the requirement to replicate all objects.

Answer

S3 Same-Region Replication (SRR)

Answer

S3 Event Notifications with an AWS Lambda function to copy objects to another region

Answer

S3 Transfer Acceleration

Question 5

A SysOps administrator is designing a VPC for a web application that must be secure. Which THREE security measures should the administrator implement? (Choose THREE.)

Accepted Answer

Configure network ACLs to filter traffic at the subnet level.. Network ACLs (NACLs) are stateless firewalls that operate at the subnet level, providing an additional layer of security by filtering traffic entering and exiting each subnet. By default, NACLs allow all traffic, but you can configure custom rules to explicitly allow or deny traffic based on IP addresses, protocols, and port ranges, which is essential for securing a web application VPC.

Answer

Place all resources in public subnets to simplify access.

Answer

Use the default VPC for simplicity.

Question 6

A SysOps administrator is automating the creation of Amazon RDS DB instances using AWS CloudFormation. The template includes a DB instance with a Multi-AZ deployment. During a stack update, the administrator changes the DB instance class from db.t3.small to db.t3.medium. What is the expected behavior during the update?

Accepted Answer

RDS will modify the standby instance first, then fail over to it, and finally modify the original primary, resulting in minimal downtime.. When updating a Multi-AZ RDS DB instance class via CloudFormation, AWS performs a 'rolling upgrade' to minimize downtime. RDS first modifies the standby instance to the new class, then initiates a failover to make the standby the new primary, and finally modifies the original primary (now the standby) to the new class. This results in only a brief outage during the failover, typically lasting 60–120 seconds.

Answer

RDS will create a new DB instance with the new class and delete the old one.

Answer

RDS will modify both instances simultaneously, causing a brief outage.

Answer

The update will fail because CloudFormation cannot modify a Multi-AZ DB instance class.

Question 7

A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are encrypted at rest. The administrator wants to automatically remediate any bucket that is created without default encryption. Which AWS service should be used to achieve this with the least operational overhead?

Accepted Answer

AWS Config with a managed rule and auto-remediation via AWS Systems Manager Automation. AWS Config with the managed rule 's3-bucket-default-encryption-enabled' can detect S3 buckets that lack default encryption. By attaching an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') as an auto-remediation action, the administrator can automatically apply AES-256 or AWS-KMS encryption to noncompliant buckets without manual intervention, minimizing operational overhead.

Answer

AWS CloudTrail with Amazon CloudWatch Events and AWS Lambda

Answer

AWS Trusted Advisor with Amazon Simple Notification Service (SNS)

Answer

Amazon Inspector with AWS Systems Manager Patch Manager

Question 8

A company has a VPC with public and private subnets across two Availability Zones. An application running on EC2 instances in the private subnets needs to access the internet for updates. Which configuration should be used to provide internet access while minimizing administrative overhead?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update private route tables to point to it.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing inbound traffic from the internet. This is a fully managed AWS service, so it requires no patching or scaling management, minimizing administrative overhead. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's network interface.

Answer

Assign public IP addresses to the private instances and update route tables accordingly.

Answer

Set up AWS Direct Connect to an internet gateway.

Answer

Launch a NAT instance in the private subnet and configure routing.

Question 9

A company uses Amazon CloudWatch Logs to store application logs. The security team needs to be alerted when any log group contains a specific error pattern. The solution must minimize latency and operational overhead. What should a SysOps administrator do?

Accepted Answer

Create a Lambda function subscribed to the CloudWatch Logs log group, which checks for the error pattern and publishes to an SNS topic.. Subscribing a Lambda function directly to a CloudWatch Logs log group allows real-time, low-latency processing of log events as they arrive. The Lambda function can parse each log event for the specific error pattern and publish to an SNS topic to alert the security team, minimizing operational overhead by avoiding additional streaming or polling services.

Answer

Stream the logs to Amazon Kinesis Data Firehose, which then triggers a Lambda function to check for errors.

Answer

Create a CloudWatch metric filter on the log group and set an alarm that triggers an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 10

A SysOps administrator runs the above command for an EC2 instance. The instance is running but the system status check is impaired. What does this indicate?

Accepted Answer

There is a problem with the underlying physical host that requires stopping and starting the instance.. The system status check in AWS EC2 monitors the underlying physical host for issues such as loss of network connectivity, power loss, or hardware failure. When this check is impaired, it indicates a problem with the host that requires stopping and starting the instance to migrate it to a new healthy host. Option C is correct because stopping and starting the instance forces a migration to a different physical host, resolving the underlying hardware issue.

Answer

The instance is still running but the application is not responding.

Answer

The instance is unreachable due to a misconfigured security group.

Answer

The operating system on the instance has crashed.

Question 11

A SysOps administrator is troubleshooting a Lambda function that does not write logs to CloudWatch Logs. The IAM role attached to the function includes the policy shown. What is the most likely reason the logs are not being created?

Accepted Answer

The log group name in the Resource ARN does not match the actual log group created by the Lambda function.. The IAM policy shown in the question includes a Resource ARN that specifies a specific log group name (e.g., `/aws/lambda/MyFunction`). If the Lambda function is configured to write to a different log group (e.g., `/aws/lambda/MyOtherFunction` or a custom log group), the `logs:CreateLogGroup` and `logs:CreateLogStream` permissions will fail because the ARN does not match. This mismatch prevents the function from creating the log group or stream, so no logs are written to CloudWatch Logs.

Answer

The IAM role is not assigned to the Lambda function's execution role.

Answer

The Lambda function is in a VPC without a VPC endpoint for CloudWatch Logs.

Answer

The policy does not include the logs:PutLogEvents permission.

Question 12

A company uses AWS CodeDeploy to automate deployments to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The logs on a failed instance show that the 'BeforeInstall' lifecycle event script exited with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero exit code.. The error message indicates that the deployment failed because too many instances failed, and the logs on a failed instance show that the 'BeforeInstall' lifecycle event script exited with a non-zero exit code. In AWS CodeDeploy, each lifecycle event script must exit with a zero exit code to indicate success; any non-zero exit code is treated as a failure, causing the deployment to fail on that instance. Since the logs explicitly point to the BeforeInstall script's non-zero exit, the most likely cause is a bug in that script.

Answer

The instance does not have the required permissions to download the application revision.

Answer

The instance is not healthy according to the Elastic Load Balancer health checks.

Answer

The CodeDeploy agent is not running on the instance.

Question 13

A SysOps administrator notices that traffic to an Amazon EC2 instance is being blocked even though the security group allows all inbound traffic. The subnet's network ACL allows all inbound and outbound traffic. What could be the issue?

Accepted Answer

The instance's operating system firewall is blocking the traffic.. The security group and network ACL both allow all traffic, so the issue must be at the instance level. The operating system's built-in firewall (e.g., iptables for Linux, Windows Firewall for Windows) can block inbound traffic independently of AWS networking constructs. Since the OS firewall is not managed by AWS, it can override security group rules, causing traffic to be dropped even when AWS-side configurations are permissive.

Answer

The network ACL is not associated with the subnet correctly.

Answer

VPC Flow Logs are misconfigured.

Answer

The route table does not have a default route to an internet gateway.

Question 14

A company has deployed an Application Load Balancer (ALB) in a VPC. The ALB is configured with a target group pointing to EC2 instances in a private subnet. Clients receive HTTP 503 errors. What is the likely cause?

Accepted Answer

The target instances are unhealthy and the target group has zero healthy hosts.. HTTP 503 errors from an Application Load Balancer indicate that the target group has no healthy registered targets to forward traffic to. When all EC2 instances in the target group are unhealthy (e.g., failing health checks), the ALB cannot route requests, resulting in a 503 response. This is the most common cause of 503 errors in ALB deployments.

Answer

The ALB does not have an Elastic IP address.

Answer

The security group for the ALB does not allow inbound HTTP traffic.

Answer

The route table for the private subnet does not have a route to the ALB.

Question 15

A SysOps administrator is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The administrator wants to identify the specific queries consuming the most CPU. What is the MOST efficient way to achieve this?

Accepted Answer

Enable Performance Insights for the RDS instance and view the top SQL queries.. Performance Insights provides a built-in database load visualization and a dashboard that directly shows the top SQL queries consuming the most resources, including CPU. This is the most efficient method because it requires no additional configuration beyond enabling the feature and immediately surfaces the specific queries causing high CPU utilization.

Answer

Use CloudWatch metrics for RDS and create a dashboard for CPU utilization.

Answer

Enable Enhanced Monitoring for the RDS instance and view the CPU metrics.

Answer

Enable CloudWatch Logs for the RDS instance and filter for slow query logs.