SOA-C02 Practice Test 16 — 15 Questions

Question 1

A SysOps administrator is troubleshooting an issue where an IAM user cannot assume a role in another AWS account. The trust policy of the role allows the user's account to assume the role, and the user has a permissions policy that allows sts:AssumeRole. However, the user still gets an access denied error. What is the MOST likely cause?

Accepted Answer

The user's permissions policy does not include sts:AssumeRole for the specific role ARN. Option C is correct because even if the trust policy allows the account, the role's permissions policy must grant the user the necessary actions. In this case, the role's permissions policy might not include the required permissions for the services the user is trying to use after assuming the role. However, the question is about the error being access denied at the AssumeRole call itself. That would be due to the trust policy or the user's permissions. Option A is incorrect because MFA is not mentioned. Option B is incorrect because the role's trust policy allows the account. Option D is incorrect because external ID is optional.

Answer

The trust policy specifies the user's ARN instead of the account ARN

Answer

The role requires MFA, but the user does not have MFA configured

Answer

The role's permissions policy does not include an external ID

Question 2

A company uses AWS Config to track resource changes. The security team wants to receive notifications whenever an IAM policy is changed. Which AWS service should be used with AWS Config to send notifications?

Accepted Answer

Amazon Simple Notification Service (SNS). Option D is correct because AWS Config can send configuration change notifications to Amazon SNS, which can then trigger emails or other notifications. Option A is incorrect because CloudWatch Logs is for log data, not notifications. Option B is incorrect because CloudTrail is for API activity, not configuration changes. Option C is incorrect because SQS is a queue, not a notification service.

Answer

Amazon CloudWatch Logs

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS CloudTrail

Question 3

A company has an S3 bucket that stores sensitive data. The security team requires that all access to the bucket be encrypted in transit. Which TWO actions should be taken to enforce this requirement? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm for any HTTP access. Options A and C are correct. A bucket policy that denies requests without HTTPS ensures all access uses TLS. AWS CloudTrail can be used to monitor and detect HTTP requests, though it does not enforce. Option B is incorrect because enabling default encryption does not enforce in-transit encryption. Option D is incorrect because S3 Transfer Acceleration does not enforce HTTPS; it uses TLS but does not prevent HTTP. Option E is incorrect because S3 endpoints support HTTPS, but the bucket policy is needed to enforce.

Answer

Enable default encryption (SSE-S3) on the bucket

Answer

Enable S3 Transfer Acceleration

Answer

Use S3 VPC endpoints

Question 4

A company wants to audit all AWS account activity for compliance. Which THREE AWS services should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. Options A, B, and E are correct. AWS CloudTrail records API activity, Amazon CloudWatch Logs can store logs, and AWS Config tracks resource configuration changes. Option C is incorrect because AWS Trusted Advisor is for recommendations, not auditing. Option D is incorrect because Amazon GuardDuty is for threat detection.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 5

Refer to the exhibit. An IAM user has this policy attached. The user tries to start an EC2 instance that has no tags. What will happen?

Accepted Answer

The user will be denied because the instance does not have the required tag. Option A is correct because the policy allows actions only on instances with the tag Environment=Production. Since the instance has no tags, the condition is not met, and the action is not allowed. The user will be denied. Option B is incorrect because the condition uses StringEquals, which requires the tag to exist and match. Option C is incorrect because without the tag, the condition fails, resulting in implicit deny. Option D is incorrect because the policy does not allow all instances; it has a condition.

Answer

The user will be allowed because the condition only applies if the tag exists

Answer

The user will be allowed because the resource ARN includes a wildcard

Answer

The user will be allowed because the policy does not explicitly deny the action

Question 6

A company uses Amazon RDS for MySQL and needs to be alerted when the database's CPU utilization exceeds 80% for 10 minutes. The administrator creates a CloudWatch alarm based on the 'CPUUtilization' metric. However, the alarm does not trigger even though the metric shows values above 80%. What is the most likely cause?

Accepted Answer

The alarm is configured to use the 'Maximum' statistic, but the metric chart shows 'Average'.. Option B is correct because the CloudWatch alarm is configured to use the 'Maximum' statistic, while the metric chart displays the 'Average' statistic. If the CPU utilization spikes above 80% but the average over the evaluation period remains below 80%, the alarm using 'Maximum' will not trigger. The alarm evaluates the metric based on its configured statistic, not the chart's default view.

Answer

The alarm's period is set to 5 minutes, so it checks only every 5 minutes.

Answer

The RDS instance is in a VPC that does not have internet access.

Answer

The administrator has not enabled Enhanced Monitoring on the RDS instance.

Question 7

A company wants to provide low-latency access to a web application for users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. Which AWS service should be used to route users to the nearest region?

Accepted Answer

Amazon Route 53 with latency-based routing. Option D is correct because Amazon Route 53 with latency-based routing directs traffic to the region with the lowest latency for the user. Option A is wrong because Global Accelerator improves performance but does not route based on latency to nearest region; it uses Anycast. Option B is wrong because CloudFront is a CDN for content delivery, not for routing to regional endpoints. Option C is wrong because ALB is region-specific and cannot route across regions.

Answer

Application Load Balancer with cross-region load balancing

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 8

A company has an application running on EC2 instances behind an Application Load Balancer. They want to receive an email notification when the average latency exceeds 2 seconds. Which combination of steps should the SysOps administrator take? (Select TWO.)

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Option D is correct because Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when a metric threshold is breached. By creating an SNS topic and subscribing an email endpoint to it, the SysOps administrator can receive email alerts when the alarm state changes, such as when the average latency exceeds 2 seconds.

Answer

Enable AWS CloudTrail to capture API calls and monitor latency.

Answer

Use CloudWatch Logs to stream logs to Amazon ES for latency analysis.

Answer

Create a CloudWatch alarm on the EC2 instance's CPUUtilization metric.

Question 9

A company is using Amazon Route 53 as its DNS service. The company has a web application running on an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that if the ALB fails, traffic is automatically redirected to a static error page hosted on an Amazon S3 bucket. Which Route 53 routing policy should be used to achieve this?

Accepted Answer

Failover routing policy. Option B is correct because a failover routing policy allows you to configure active-passive failover with primary and secondary records. Option A is wrong because weighted routing distributes traffic based on weights. Option C is wrong because latency routing routes to the region with the lowest latency. Option D is wrong because geolocation routing routes based on the user's geographic location.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 10

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Windows Server. Which steps are required to collect memory metrics?

Accepted Answer

Install and configure the Amazon CloudWatch agent on the instance.. Amazon CloudWatch does not collect memory metrics from EC2 instances by default; it only captures hypervisor-level metrics such as CPU, network, and disk I/O. To monitor in-guest memory utilization on a Windows Server instance, you must install and configure the Amazon CloudWatch agent, which sends custom metrics (e.g., Memory % Committed Bytes In Use) to CloudWatch. The agent uses the Windows Performance Monitor (PerfMon) counters to gather this data.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and use Run Command.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Use the AWS Management Console to enable memory monitoring.

Question 11

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. Which of the following route table configurations is required for the private subnet to enable internet access through the NAT gateway?

Accepted Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the private subnet route table. Option C is correct because the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway. Option A is wrong because a route to the internet gateway would bypass the NAT gateway. Option B is wrong because the NAT gateway is in the public subnet. Option D is wrong because the private subnet does not need a direct route to the internet gateway.

Answer

Add a route to 0.0.0.0/0 pointing to the internet gateway in the private subnet route table

Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the public subnet route table

Answer

Add a route to the NAT gateway's private IP in the private subnet route table

Question 12

A company is using Amazon CloudFront to distribute content globally. The company wants to restrict access to content so that only users from specific countries can access it. Which CloudFront feature should be used?

Accepted Answer

Geo restriction. Option A is correct because CloudFront geo restriction allows you to whitelist or blacklist countries. Option B is wrong because signed URLs provide access per request. Option C is wrong because origin access identity restricts access to the origin, not users. Option D is wrong because WAF can be used for more granular access control but geo restriction is the native feature for country-based blocking.

Answer

AWS WAF

Answer

Signed URLs

Answer

Origin Access Identity (OAI)

Question 13

A SysOps administrator examines the output of the describe-alarms command for the 'HighCPU' alarm. The alarm is in ALARM state. What action will be taken automatically?

Accepted Answer

Recover the EC2 instance using EC2 instance recovery.. The 'HighCPU' alarm is in ALARM state, and the question specifies that the alarm is configured with an EC2 instance recovery action. EC2 instance recovery automatically restarts the instance on a new healthy host when a status check failure (such as impaired hardware or network connectivity) is detected, preserving the instance ID, private IP addresses, and Elastic IP addresses. This is a built-in CloudWatch alarm action that triggers recovery, not a reboot or scaling action.

Answer

Launch a new EC2 instance in an Auto Scaling group.

Answer

Reboot the EC2 instance.

Answer

Send a notification to an SNS topic.

Question 14

A sysadmin receives an alert that a Network Load Balancer (NLB) is not passing traffic to targets. The target group health checks are passing. What is the MOST likely cause?

Accepted Answer

The instances are in a private subnet without a route to the NLB's subnet.. When health checks are passing but traffic is not reaching targets, the issue is typically network connectivity. In this scenario, the instances are in a private subnet without a route to the NLB's subnet, meaning the NLB's IP addresses are unreachable from the targets. Since NLB preserves the source IP of clients, targets must have a route back to the NLB's subnet (or the client) to return traffic; without this, the three-way TCP handshake fails even though health checks (which originate from the NLB's subnet) succeed.

Answer

Cross-zone load balancing is disabled.

Answer

The listener is not configured for the correct protocol.

Answer

The target group health check interval is too long.

Question 15

A company has a VPC with multiple subnets. An EC2 instance in a public subnet needs to communicate with an RDS database in a private subnet. The RDS security group allows inbound traffic from the EC2 instance's security group. However, the EC2 instance cannot connect. What is the most likely cause?

Accepted Answer

The VPC does not have DNS resolution enabled, so the RDS endpoint cannot be resolved.. Option C is correct because if the RDS is in a private subnet, it may not have a route to the internet or to the public subnet, but the issue is likely that the VPC does not have DNS resolution enabled, causing name resolution failure. Option A is wrong because the security group is already configured. Option B is wrong because the instance has a public IP. Option D is wrong because NACLs are stateless but default allows all.

Answer

The network ACL for the private subnet blocks inbound traffic from the public subnet.

Answer

The security group of the RDS database does not allow outbound traffic.

Answer

The EC2 instance does not have a public IP address.