SOA-C02 Practice Test 16 — 15 Questions

Question 1

A SysOps administrator needs to monitor memory utilization on an Amazon EC2 instance. Memory metrics are not available by default in Amazon CloudWatch for EC2 instances. Which action should the administrator take to collect memory utilization metrics?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the CloudWatch agent on the EC2 instance. The CloudWatch agent is the correct solution because it can collect custom metrics, including memory utilization, from EC2 instances. Unlike the default hypervisor-level metrics (CPU, network, disk), memory metrics require an in-guest agent to read the operating system's memory counters and publish them to CloudWatch.

Answer

Enable detailed monitoring on the EC2 instance

Answer

Use an AWS Lambda function to query the EC2 instance for memory metrics

Answer

Use Amazon Inspector to collect memory metrics

Question 2

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. Which configuration step is required?

Accepted Answer

Configure the target group to use HTTPS protocol and install SSL/TLS certificates on the instances.. Configuring the target group to use the HTTPS protocol ensures that the ALB encrypts traffic to the instances using SSL/TLS. The instances must have valid certificates installed to terminate the HTTPS connection. Option A is incorrect because the ALB listener handles encryption between clients and the ALB, not between the ALB and instances. Option C is incorrect because placing instances in a private subnet and using a NAT gateway affects outbound internet access, not encryption between the ALB and instances. Option D is incorrect because a security group rule can allow only HTTPS traffic, but it does not enforce encryption; the traffic protocol must also be HTTPS.

Answer

Configure the ALB listener to use HTTPS with a security policy.

Answer

Place the instances in a private subnet and use a NAT gateway for outbound traffic.

Answer

Create a security group rule that allows only HTTPS traffic from the ALB to the instances.

Question 3

A company manages multiple AWS accounts under AWS Organizations. The SysOps administrator needs to deploy a baseline set of AWS Config rules and an Amazon SNS topic to each account in the organization. The deployment must be centrally managed from the management account and automatically applied to any new member account added in the future. Which solution should the administrator use?

Accepted Answer

Create an AWS CloudFormation StackSet with the template containing the AWS Config rules and SNS topic. Configure the StackSet to deploy to the organization and enable automatic deployment to new accounts.. AWS CloudFormation StackSets can be deployed to an entire AWS Organizations organization or organizational units (OUs), and they support automatic deployment to new accounts added to the organization. By creating a StackSet with a template that defines the AWS Config rules and SNS topic, and enabling automatic deployment, the administrator ensures that every current and future member account receives the baseline configuration without manual intervention.

Answer

Use AWS Service Catalog to create a product that bundles the AWS Config rules and SNS topic. Grant each account access to launch the product.

Answer

Configure AWS Config conformance packs in the management account and use AWS Resource Access Manager to share them with member accounts.

Answer

Create an AWS Organizations Service Control Policy (SCP) that enforces the creation of AWS Config rules and SNS topics in every account.

Question 4

An organization is using AWS CodeDeploy with a blue/green deployment configuration for an EC2/On-Premises compute platform. During a deployment, the new instances pass all health checks, but the old instances are not terminated after the deployment completes. What is the most likely cause?

Accepted Answer

The deployment configuration specifies 'Reroute traffic to new instances and keep old instances running' with no termination.. In AWS CodeDeploy blue/green deployments for the EC2/On-Premises compute platform, the deployment configuration determines the lifecycle of the original (old) instances. Option C is correct because the deployment configuration explicitly specifies 'Reroute traffic to new instances and keep old instances running' with no termination, which instructs CodeDeploy to leave the old instances running after traffic is rerouted. This behavior is controlled by the deployment group's configuration, not by Auto Scaling or health check failures.

Answer

The Auto Scaling group has a cooldown period that prevents termination.

Answer

The new instances failed the initial health check.

Answer

The deployment was rolled back automatically.

Question 5

A company runs a critical web application on Amazon EC2 instances that are part of an Auto Scaling group. The application receives unpredictable traffic spikes. The SysOps administrator needs to ensure that when a scale-out event occurs, new instances are ready to serve traffic quickly to minimize latency spikes. Currently, the instance launch and configuration process (including software installs and cache warming) takes about 5 minutes. The administrator wants to reduce the time it takes for new instances to start serving traffic. Which combination of Auto Scaling features should be used?

Accepted Answer

Implement an Auto Scaling warm pool with a minimum number of pre-initialized instances in a 'Stopped' state. Configure the scaling policy to move instances from the warm pool to the Auto Scaling group when needed.. An Auto Scaling warm pool maintains a pool of pre-initialized instances in a 'Stopped' state that are fully configured (software installed, cache warmed) and ready to serve traffic. When a scale-out event occurs, instances from the warm pool are moved to the Auto Scaling group and transitioned to 'Running' state, bypassing the 5-minute launch and configuration delay, thereby minimizing latency spikes.

Answer

Use a launch template that includes a pre-warmed Amazon Machine Image (AMI) with all software pre-installed, and configure the Auto Scaling group to use a larger instance type to reduce initialization time.

Answer

Use scheduled scaling to predictively launch instances before the traffic spikes based on historical patterns.

Answer

Configure lifecycle hooks to add a wait time during instance launch so that the instance is fully configured before it is placed behind the load balancer.

Question 6

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment strategy is set to CodeDeployDefault.HalfAtATime. The lifecycle hooks for the Auto Scaling group include a test hook that runs during instance launch. During a recent deployment, the deployment failed because the new instances failed the test hook and were not marked as healthy. The SysOps administrator needs to ensure that failed instances are automatically terminated and replaced with new ones from the Auto Scaling group. Which configuration change should the administrator make?

Accepted Answer

Modify the Auto Scaling group's health check type to ELB. Setting the Auto Scaling group's health check type to ELB (Elastic Load Balancer) ensures that the Auto Scaling group uses the ELB's health check status to determine instance health. When the test lifecycle hook fails, the new instances are not marked as healthy by the ELB, causing the Auto Scaling group to automatically terminate and replace them. This aligns with the requirement to automatically replace failed instances, as the default EC2 health check only considers instance status (e.g., running vs. stopped) and does not reflect application-level health.

Answer

Modify the CodeDeploy deployment configuration to use an increased minimum healthy instance count

Answer

Modify the Auto Scaling group's health check grace period to a lower value

Answer

Modify the CodeDeploy deployment to ignore the lifecycle hook failure

Question 7

A company is using AWS Lambda functions to process incoming messages from Amazon SQS. The Lambda function sometimes fails due to a transient error, and the message is not processed. The team wants to automatically retry failed messages and send them to a dead-letter queue (DLQ) after three failed attempts. Which configuration meets these requirements?

Accepted Answer

Configure the SQS queue with a redrive policy that allows three maximum receives before sending to a DLQ.. When SQS is configured as an event source for Lambda, retries are controlled by the SQS queue's redrive policy. The redrive policy with maxReceiveCount determines how many times a message can be received before it is moved to the DLQ. Setting maxReceiveCount to 3 means after three receive attempts (i.e., three failed processing attempts), the message is sent to the DLQ. Option C is incorrect because Lambda's dead-letter configuration is used for asynchronous invocations, not for SQS event source mappings. For SQS-triggered functions, the DLQ must be configured on the SQS queue itself using a redrive policy, not on the Lambda function.

Answer

Set the Lambda function's reserved concurrency to 1 and enable 'maximumRetryAttempts' to 2.

Answer

Create an SQS queue with a visibility timeout that allows three retries before sending to a DLQ.

Answer

Configure the SQS queue as an event source for Lambda with a DLQ specified in the Lambda function's dead-letter configuration.

Question 8

A company runs a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application has predictable traffic patterns with high traffic during business hours and low traffic at night. The SysOps administrator wants to reduce compute costs while ensuring the application remains responsive during peak hours. The administrator has already implemented Auto Scaling based on CPU utilization. Which additional action should the administrator take to optimize costs?

Accepted Answer

Purchase Reserved Instances for the baseline capacity and use Spot Instances for the additional capacity during peak hours. It combines Reserved Instances for predictable baseline capacity (lower cost per hour) with Spot Instances for elastic peak demand, leveraging Auto Scaling to handle variable traffic. This hybrid approach reduces compute costs compared to using On-Demand instances for all capacity, while maintaining responsiveness during peak hours.

Answer

Use On-Demand instances only

Answer

Increase the minimum number of instances in the Auto Scaling group

Answer

Use Dedicated Hosts to reduce licensing costs

Question 9

A company stores video files in Amazon S3. The files are accessed frequently for the first week, then weekly for the next month, and then rarely after that. The files must be retained for 5 years and any access must be served within minutes. The SysOps administrator needs to minimize storage costs while meeting these requirements. Which lifecycle policy configuration is the most cost-effective?

Accepted Answer

Transition to S3 Standard-IA after 7 days, then to S3 Glacier Instant Retrieval after 30 days.. It transitions to S3 Standard-IA after 7 days (matching the frequent first-week access), then to S3 Glacier Instant Retrieval after 30 days (matching the weekly access for the next month). Glacier Instant Retrieval provides millisecond retrieval for rarely accessed data, meeting the 'within minutes' requirement while minimizing costs compared to Standard-IA or Intelligent-Tiering.

Answer

Transition to S3 Standard-IA after 7 days, then to S3 Glacier Flexible Retrieval after 30 days.

Answer

Transition to S3 One Zone-IA after 7 days, then to S3 Glacier Deep Archive after 30 days.

Answer

Transition to S3 Intelligent-Tiering after 7 days.

Question 10

Refer to the exhibit. A SysOps Administrator runs the above command and sees that an EC2 instance is unhealthy. The health check is configured to check the HTTP endpoint '/health' on port 80. The instance's security group allows inbound HTTP traffic from the ALB's security group. What is the MOST likely cause?

Accepted Answer

The application on the instance is not configured to respond to the '/health' path.. The health check path is '/health', but the application on the instance might not have that endpoint configured, causing the health check to fail. Option A is incorrect because the instance is associated with the target group; otherwise it would not appear in the health check results. Option C is incorrect because the target group is configured to use port 80, as stated in the scenario. Option D is incorrect because the security group on the instance does allow inbound HTTP traffic from the ALB's security group, as stated in the scenario.

Answer

The instance is not associated with the target group.

Answer

The target group is configured to use port 8080 instead of port 80.

Answer

The security group on the instance does not allow inbound traffic from the ALB.

Question 11

A SysOps administrator is troubleshooting an issue where an Application Load Balancer (ALB) is returning 503 errors to clients. The target group has healthy EC2 instances. Which THREE possible causes should the administrator investigate? (Choose three.)

Accepted Answer

The load balancer is not attached to a subnet.. If the load balancer is not attached to a subnet, it cannot route traffic to targets and may return 503 errors. Option B is correct because the load balancer's security group must allow inbound traffic from clients; if it blocks HTTP/HTTPS traffic, the ALB cannot forward requests and returns 503 errors. Option C is correct because an ALB has a capacity limit; once reached, it cannot handle new requests and returns 503 errors. Option D is incorrect because the stem explicitly states the target group has healthy EC2 instances, meaning registered targets exist. Option E is incorrect because the health check is functioning correctly since targets are healthy; a misconfigured health check would cause targets to be unhealthy, contradicting the given information.

Answer

The target group has no registered targets.

Answer

The target group health check is misconfigured.

Question 12

A SysOps administrator is configuring an Application Load Balancer to route traffic to multiple target groups based on the URL path. The ALB is not routing traffic correctly. Which listener rule configuration should be used to route requests with path /api/* to target group A and all other requests to target group B?

Accepted Answer

Create a rule with path pattern /api/* and forward to target group A with priority 10, and a default rule with path pattern /* and forward to target group B with priority 20.. The ALB listener rules are evaluated in order; the first rule with a path pattern /api/* will match, and then a default rule (catch-all) is needed for all other paths. Option A is incorrect because order is not automatically prioritized by pattern. Option B is incorrect because a single rule cannot have two conditions with different paths to different target groups. Option D is incorrect because while both rules with path patterns are valid, the priority must be explicitly set; the ALB does not automatically prioritize based on pattern length.

Answer

Create a rule with a host header condition matching 'api.example.com' and forward to target group A, and a default rule forward to target group B.

Answer

Create one rule with a condition that matches /api/* and forward to target group A, and another condition in the same rule for /* to forward to target group B.

Answer

Create two rules with path patterns /api/* and /*, and set priority based on the pattern length.

Question 13

A SysOps Administrator is configuring a VPC with a public subnet and a private subnet. The public subnet has an Internet Gateway. An EC2 instance in the private subnet needs to access an S3 bucket. What is the MOST secure way to provide this access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 in the private subnet's route table.. A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 privately without traversing the internet, using AWS's internal network. This is the most secure method as it avoids exposing the private subnet to the public internet or requiring a NAT Gateway, and it leverages AWS PrivateLink for direct, low-latency connectivity.

Answer

Attach an Internet Gateway to the private subnet.

Answer

Use a VPC peering connection to an S3 bucket.

Answer

Create a NAT Gateway in the public subnet and route traffic through it.

Question 14

A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?

Accepted Answer

The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.. Network ACLs are stateless, so the subnet's NACL must explicitly allow inbound traffic from the ALB's subnet CIDR. If it does not, health check traffic from the ALB will be blocked. Option B is incorrect because the instance's security group allows inbound traffic from the ALB security group, and security groups are stateful, so return traffic is allowed automatically. Option C is incorrect because the ALB security group does not need an outbound rule; security groups are stateful, and the ALB initiates connections to the instances. Option D is incorrect because the ALB can communicate within the VPC regardless of whether it is in a public subnet; an internet gateway is only needed for internet traffic, not for internal ALB-to-instance traffic.

Answer

The instance security group does not allow outbound traffic to the ALB.

Answer

The ALB security group does not allow outbound traffic to the instances.

Answer

The ALB is in a public subnet without an internet gateway.

Question 15

A SysOps administrator is creating an Auto Scaling group using a launch template. The administrator wants to ensure that instances are automatically registered with an Application Load Balancer (ALB) target group. Which TWO steps are required? (Choose TWO.)

Accepted Answer

Configure the instance security group to allow traffic from the ALB.. To automatically register instances with an ALB target group, you must configure the instance security group to allow traffic from the ALB (Option A) and specify the target group ARN in the Auto Scaling group configuration (Option B). Option C is incorrect because health checks are configured on the target group, not on the Auto Scaling group. Option D is incorrect because you attach the target group to the Auto Scaling group, not a security group. Option E is incorrect because the target group ARN is specified in the Auto Scaling group, not in the launch template.

Answer

Configure health checks on the Auto Scaling group to use ELB.

Answer

Create a security group for the ALB and attach it to the Auto Scaling group.

Answer

Include the target group ARN in the launch template.