SOA-C02 Practice Test 16 — 15 Questions

Question 1

A SysOps administrator uses AWS Systems Manager Run Command to install software on a fleet of EC2 instances. The command fails on some instances with the error 'Instance ID not found'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SSM Agent is not installed or configured on the instances, or the instances lack the required IAM role.. The error 'Instance ID not found' indicates that Systems Manager Run Command cannot communicate with the SSM Agent on the target instances. This typically occurs when the SSM Agent is not installed, is not running, or the instance does not have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) for Systems Manager to manage it. Without a valid agent and IAM role, the instance is not registered with Systems Manager, so Run Command cannot find its Instance ID.

Answer

The user data script has overridden the SSM Agent.

Answer

The instances are not tagged with the correct key-value pair.

Answer

The instances are in a stopped state.

Question 2

A company uses AWS CloudTrail to log API activity. A SysOps administrator discovers that some management events are not being logged. The administrator checks the CloudTrail configuration and confirms that management events are enabled and logging is working for most events. What is the most likely cause of the missing events?

Accepted Answer

The trail is configured to log events only for a single region, and the missing events occurred in a different region. CloudTrail trails can be configured to log events for a single region or all regions. If the trail is set to log only one region, management events occurring in any other region will not be captured. Since the administrator confirmed management events are enabled and logging works for most events, the most likely cause is that the missing events originated from a region not covered by the trail.

Answer

The trail excludes specific management events based on read/write filtering

Answer

The trail is logging only data events for S3

Answer

The missing events are from unsupported services

Question 3

A SysOps administrator is automating the creation of an Amazon ECS cluster with Fargate launch type using AWS CloudFormation. The template must define the task definition, service, and cluster. Which THREE resources are required to be in the template? (Choose THREE.)

Accepted Answer

AWS::ECS::TaskDefinition. For an Amazon ECS cluster using the Fargate launch type, the AWS CloudFormation template must define the cluster itself (AWS::ECS::Cluster), the task definition (AWS::ECS::TaskDefinition) that specifies the container image, CPU, memory, and networking configuration, and the service (AWS::ECS::Service) that maintains the desired count of tasks and optionally integrates with a load balancer. These three resources are the minimum required to create and run a Fargate-based ECS workload.

Answer

AWS::EC2::VPC

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Question 4

A company wants to allow its employees to access internal applications using a custom domain name (app.example.com) that resolves to an internal ALB. Which AWS service should be used?

Accepted Answer

Amazon Route 53. Amazon Route 53 is the correct choice because it is a DNS service that can resolve a custom domain name (app.example.com) to an internal Application Load Balancer's DNS name. By creating a private hosted zone associated with the company's VPC, Route 53 can provide internal DNS resolution without exposing the ALB to the internet, which meets the requirement for internal application access.

Answer

AWS Global Accelerator

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 5

A company uses AWS Config to track resource changes. The security team wants to receive notifications whenever an IAM policy is changed. Which AWS service should be used with AWS Config to send notifications?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is the correct service to pair with AWS Config to send notifications when an IAM policy changes. AWS Config can publish configuration change events to an SNS topic, which then delivers notifications via email, SMS, or other protocols to the security team. This integration allows real-time alerting on resource changes without additional polling or custom logic.

Answer

Amazon CloudWatch Logs

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS CloudTrail

Question 6

Refer to the exhibit. An EC2 instance is running the CloudWatch Logs agent and uses the IAM policy shown. The agent is configured to send logs to the log group 'MyAppLogGroup'. However, logs are not appearing. What is the MOST likely cause?

Accepted Answer

The policy is missing permission to create the log group if it does not exist.. The CloudWatch Logs agent cannot automatically create a log group; it requires explicit permission via the `logs:CreateLogGroup` action in the IAM policy. Without this permission, if the log group 'MyAppLogGroup' does not already exist, the agent will fail to send logs, even though the `logs:PutLogEvents` action is allowed. The policy shown only grants `logs:PutLogEvents` and `logs:DescribeLogStreams`, missing the necessary `logs:CreateLogGroup` and `logs:CreateLogStream` actions for initial setup.

Answer

The log group name in the policy does not match the agent configuration.

Answer

The policy does not allow the 'logs:PutLogEvents' action.

Answer

The Resource ARN incorrectly specifies a wildcard after the log group name.

Question 7

A company wants to centrally collect and analyze logs from all AWS accounts in an organization. The logs include CloudTrail, VPC Flow Logs, and AWS Config logs. Which solution is the most scalable and cost-effective?

Accepted Answer

Configure each account to deliver logs to a centralized S3 bucket and use Amazon Athena to query them.. It uses a centralized S3 bucket to aggregate logs from all accounts, which is highly scalable and cost-effective due to S3's low storage costs and lifecycle policies. Amazon Athena then allows serverless, pay-per-query analysis of the logs without needing to provision or manage any infrastructure, making it ideal for ad-hoc and cross-account log analysis.

Answer

Stream all logs to a central CloudWatch Logs account using cross-account subscriptions.

Answer

Use CloudWatch Logs Insights to query logs from each account individually.

Answer

Use Amazon Kinesis Data Firehose to deliver logs to an Amazon Elasticsearch Service cluster.

Question 8

An organization has a VPC peering connection between VPC A and VPC B. Instances in VPC A can reach instances in VPC B, but not vice versa. What is the most likely cause?

Accepted Answer

The route table in VPC B does not have a route to VPC A's CIDR.. For a VPC peering connection to allow bidirectional traffic, both VPCs must have routes in their route tables pointing to the other VPC's CIDR block. Since instances in VPC A can reach VPC B but not vice versa, the most likely cause is that VPC B's route table lacks a route to VPC A's CIDR. Without this route, VPC B's subnet does not know how to forward return traffic to VPC A, even though the peering connection itself is active.

Answer

DNS resolution is not enabled for the VPC peering connection.

Answer

Security groups in VPC B block inbound traffic from VPC A.

Answer

The VPC peering connection is in a 'pending-acceptance' state.

Question 9

A company's security policy requires that all IAM users must change their passwords every 90 days. The SysOps administrator needs to enforce this requirement. Which IAM setting should the administrator configure?

Accepted Answer

IAM password policy. The IAM password policy is the correct setting because it allows the SysOps administrator to define password rotation requirements, such as a mandatory password change every 90 days. This policy is applied at the account level and enforces the security requirement for all IAM users, ensuring compliance without needing to modify individual user permissions.

Answer

IAM user permissions boundary

Answer

IAM role trust policy

Answer

IAM group policy

Question 10

A SysOps administrator is setting up monitoring for an RDS MySQL database. The administrator needs to be notified when the database connection count exceeds 100. Which steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.. Amazon CloudWatch alarms can send notifications to an Amazon SNS topic when the alarm state changes. This allows the SysOps administrator to receive alerts (e.g., via email, SMS, or HTTP) when the database connection count exceeds the threshold. Option B is correct because the 'DatabaseConnections' metric is a standard CloudWatch metric for RDS MySQL that tracks the number of current connections to the database instance. Creating an alarm on this metric with a threshold of 100 will trigger when the connection count exceeds that value.

Answer

Enable Enhanced Monitoring for RDS.

Answer

Enable CloudTrail to log RDS API calls.

Answer

Create an Amazon EventBridge rule that triggers on RDS events.

Question 11

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires very low latency and high availability. The SysOps administrator notices that the application experiences increased latency during traffic spikes even though the Auto Scaling group is scaling out. Which solution would MOST effectively reduce latency?

Accepted Answer

Change the launch configuration to use a larger instance type with more CPU and memory.. Using a larger instance type with more CPU and memory directly addresses the root cause of increased latency during traffic spikes: the existing instances are resource-constrained under load. By provisioning instances with higher compute capacity, each instance can handle more requests per second, reducing queueing delays and per-request processing time. This is a more immediate and effective solution than scaling out alone, which adds instances but does not improve the performance of each individual instance.

Answer

Pre-warm the load balancer by contacting AWS Support.

Answer

Increase the Auto Scaling cooldown period.

Answer

Deploy the instances in multiple Availability Zones.

Question 12

A company wants to back up its on-premises file servers to AWS for disaster recovery. The data changes frequently, and the company needs to minimize data loss. Which THREE steps should the company take? (Select THREE.)

Accepted Answer

Use AWS Backup to create backup plans for the Storage Gateway.. AWS Backup can create backup plans for Storage Gateway volumes and file shares, providing automated, policy-based backups to Amazon S3. This ensures consistent, scheduled backups of the on-premises data cached in the file gateway, minimizing data loss by capturing frequent changes according to the backup plan's schedule.

Answer

Use S3 Transfer Acceleration for uploads.

Answer

Set up S3 Cross-Region Replication from the backup bucket.

Question 13

A company needs to monitor for unauthorized changes to critical IAM policies. The SysOps administrator must receive notifications within minutes of any change. Which combination of AWS services should the administrator use?

Accepted Answer

Use AWS CloudTrail to log IAM changes, and create a CloudWatch Events rule that triggers an SNS notification when specific API calls are made.. AWS CloudTrail logs all IAM API calls (e.g., PutRolePolicy, AttachRolePolicy) as events. A CloudWatch Events rule (now called Amazon EventBridge rule) can be configured to match these specific API calls and trigger an SNS topic, delivering near-instant notifications within minutes. This combination provides real-time, event-driven monitoring without polling or delays.

Answer

Use AWS Config rules to detect changes and send notifications via SNS.

Answer

Use CloudWatch Logs to monitor IAM activity and create a metric filter to trigger an alarm.

Answer

Use a Lambda function that periodically checks IAM policies and sends an SNS message if changes are detected.

Question 14

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running low on memory, and the administrator needs to change the instance type from t2.micro to t3.small. What is the correct way to perform this change with minimal downtime?

Accepted Answer

Modify the instance type in the Elastic Beanstalk environment's configuration.. Modifying the instance type in the Elastic Beanstalk environment's configuration triggers a rolling update or immutable update, which replaces instances with the new type while keeping the environment running. This approach minimizes downtime because Elastic Beanstalk manages the instance replacement process automatically, ensuring that traffic continues to be served during the transition.

Answer

Terminate the environment and create a new one with the desired instance type.

Answer

Create a new environment and perform a swap URL.

Answer

Manually modify the Auto Scaling group's launch configuration.

Question 15

A SysOps administrator notices that an Amazon RDS instance's CPU utilization is consistently above 90% during peak hours. The administrator needs to investigate which queries are consuming the most CPU. Which action should the administrator take?

Accepted Answer

Enable Performance Insights for the RDS instance and review the top SQL queries.. Performance Insights is the correct tool because it provides a database-specific performance schema that visualizes database load and identifies the top SQL queries consuming resources. By enabling Performance Insights on the RDS instance, the administrator can directly view which queries are responsible for the high CPU utilization during peak hours, allowing targeted optimization.

Answer

Use CloudWatch Logs Insights to query the database error log for slow queries.

Answer

Enable detailed CloudWatch metrics for the RDS instance and analyze the CPUUtilization metric.

Answer

Enable RDS Enhanced Monitoring and review the 'cpuCreditUsage' metric.