SOA-C02 Practice Test 17 — 15 Questions

Question 1

A SysOps administrator notices that an EC2 instance running a web server is receiving unexpected traffic from an IP address that is known to be malicious. The administrator wants to block this IP address at the instance level. Which solution should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install a third-party firewall on the instance.. A host-based firewall (such as a third-party firewall installed on the instance) can block traffic from a specific IP address at the instance level. Option A is incorrect because network ACLs operate at the subnet level, not the instance level. Option B is incorrect because AWS WAF is designed to filter web requests at the application layer and is typically associated with load balancers or CloudFront, not directly with an individual EC2 instance. Option D is incorrect because security groups do not support deny rules; they only allow traffic, so they cannot be used to block specific IPs.

Answer

Modify the network ACL to deny traffic from that IP.

Answer

Use AWS WAF to block the IP address.

Answer

Update the security group to deny traffic from that IP.

Question 2

A company is using Amazon Route 53 as its DNS service. The SysOps team needs to route traffic to multiple resources based on the geographic location of the users. Which TWO routing policies can achieve this? (Select TWO.)

Accepted Answer

Geoproximity routing. The question asks for two routing policies that route traffic based on geographic location. Geoproximity routing (Option A) and Geolocation routing (Option E) are the correct choices. Geoproximity routing considers both geographic location and optional bias, while Geolocation routing uses strict geographic boundaries. Latency-based routing (Option D) routes based on network latency, not geography, even if latency often correlates with distance. Simple routing (Option B) and Failover routing (Option C) do not use geographic information at all.

Answer

Simple routing

Answer

Failover routing

Answer

Latency-based routing

Question 3

A SysOps administrator is troubleshooting slow application performance. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Amazon CloudWatch metrics show that the average CPU utilization across the instances is below 20%, but the application is still slow. What is the MOST likely cause of the performance issue?

Accepted Answer

The application database is under-provisioned and is causing slow query responses.. The most likely cause is that the application database is under-provisioned, leading to slow query responses. Even though EC2 CPU utilization is low, the application performance is bottlenecked by database latency. This is a common scenario where the database tier is the constraint, not the compute tier.

Answer

The Auto Scaling group is scaling too aggressively, causing thrashing.

Answer

The Application Load Balancer has a sticky session configuration that is not distributing traffic evenly.

Answer

The EC2 instances are using burstable performance and have exhausted their CPU credits.

Question 4

A company's security policy requires that all Amazon S3 buckets must be encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?

Accepted Answer

AWS Config and AWS Lambda. AWS Config can evaluate S3 bucket configurations against a managed rule (s3-bucket-server-side-encryption-enabled) to detect non-compliant buckets. When a non-compliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule or a custom remediation action to automatically enable SSE-S3 encryption on the bucket. This combination uses managed services and minimizes custom code, meeting the security policy requirement.

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon Macie and AWS Step Functions

Question 5

Which TWO steps should a SysOps administrator take to ensure that an RDS for MySQL instance can withstand an Availability Zone failure? (Choose 2)

Accepted Answer

Enable Multi-AZ deployment.. To withstand an Availability Zone failure, the RDS instance must provide automatic failover to a standby in a different AZ. Only Multi-AZ deployment (Option A) achieves this by provisioning a synchronous standby replica and enabling automatic failover. Automated backups (Option C) are for point-in-time recovery, not high availability, so they do not help during an ongoing AZ failure.

Answer

Create a read replica in a different AZ.

Answer

Enable automated backups with a short retention period.

Answer

Enable deletion protection on the DB instance.

Answer

Enable provisioned IOPS for the DB instance.

Question 6

The finance team was surprised by a $12,000 spike in EC2 costs last month caused by a runaway Auto Scaling group. They want to receive an email alert within hours whenever any AWS service cost behaves unexpectedly, without manually setting fixed dollar thresholds for each service. Which AWS cost management feature provides this?

Accepted Answer

Enable Cost Anomaly Detection with an AWS services monitor and create an alert subscription to email the finance team when an anomaly is detected. Cost Anomaly Detection uses machine learning to model historical spending patterns for each AWS service and automatically detects unusual spikes without requiring manual thresholds. By creating an AWS services monitor and linking an alert subscription, the finance team receives email notifications within hours when any service deviates from its expected cost behavior, directly addressing the need for service-agnostic, threshold-free alerts.

Answer

Create an AWS Budget with a monthly EC2 cost threshold of $10,000 and an alert at 80 percent of the threshold

Answer

Enable AWS Cost Explorer and review the daily cost breakdown each morning to spot unexpected charges

Answer

Configure CloudWatch Billing alarms with a static threshold for each AWS service individually

Question 7

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The security team reports that the ALB is receiving a high number of requests with suspicious User-Agent strings. The SysOps team needs to block these requests at the load balancer level without changing the application code. Which action should be taken?

Accepted Answer

Add a listener rule on the ALB that checks the User-Agent header and returns a fixed response.. ALB listener rules can evaluate conditions like the User-Agent header and perform actions such as returning a fixed response, which effectively blocks requests. Option A is incorrect because security groups operate at the network layer and cannot inspect HTTP headers; they filter traffic based on IP addresses and ports. Option B is incorrect because target group health checks determine instance health and do not filter incoming requests based on headers. Option D is incorrect because while AWS WAF can inspect headers and block requests, it is a separate service that adds complexity and cost; the question asks for an action at the load balancer level, and ALB rules provide a simpler direct solution.

Answer

Modify the security group of the ALB to deny traffic from User-Agent strings.

Answer

Update the target group health check to filter out suspicious User-Agent strings.

Answer

Deploy AWS WAF and associate it with the ALB.

Question 8

A SysOps administrator is designing a highly available web application across multiple AWS regions. The application uses an Application Load Balancer in each region. Which TWO services can be used to route traffic to the closest regional load balancer based on latency?

Accepted Answer

AWS Global Accelerator. For routing traffic to the closest regional load balancer based on latency, two appropriate services are AWS Global Accelerator (option A) and Amazon Route 53 latency-based routing (option D). AWS Global Accelerator uses anycast IPs to direct users to the nearest edge location, then routes traffic over the AWS global network to the closest regional load balancer, providing latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS region with the lowest latency for the user. Geoproximity routing (option B) routes based on geographic location, not primarily latency. Weighted routing (option C) distributes traffic by weight, and CloudFront with origin groups (option E) is for failover and content delivery, not latency-based routing.

Answer

Amazon Route 53 geoproximity routing

Answer

Amazon Route 53 weighted routing

Answer

Amazon CloudFront with origin groups

Question 9

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect to an on-premises network using a site-to-site VPN. The on-premises network uses 10.0.0.0/16 as well. Which solution avoids routing conflicts?

Accepted Answer

Use a NAT instance to translate addresses for overlapping ranges.. A NAT instance can translate the overlapping IP addresses from the on-premises network (10.0.0.0/16) to a different IP range within the VPC, allowing communication without routing conflicts. The NAT instance performs destination NAT (DNAT) for inbound traffic and source NAT (SNAT) for outbound traffic, effectively hiding the overlap. This is a common workaround when both networks use the same CIDR block and cannot be renumbered.

Answer

Attach an Internet Gateway and use public IPs for communication.

Answer

Set up a second VPN connection to a different virtual private gateway.

Answer

Create a VPC peering connection between the VPC and on-premises network.

Question 10

A company uses Amazon S3 for static website hosting. The website serves thousands of users globally, and the company wants to reduce latency and lower data transfer costs. Which solution should the SysOps administrator implement?

Accepted Answer

Set up Amazon CloudFront as a content delivery network (CDN) in front of the S3 bucket.. Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations closer to users, reducing latency and lowering data transfer costs by minimizing direct requests to the S3 origin. By serving cached objects from edge locations, CloudFront also reduces the amount of data transferred from S3, which can significantly decrease S3 data transfer egress charges.

Answer

Use S3 Intelligent-Tiering storage class.

Answer

Enable cross-region replication and serve from multiple buckets.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 11

A containerized API runs on Amazon ECS with an Application Load Balancer. The team wants to deploy new container versions with zero downtime, automatically route traffic to the new version only after health checks pass, and automatically roll back if error rates spike within 10 minutes of the shift. Which deployment strategy and configuration implements all three requirements?

Accepted Answer

Use CodeDeploy with the ECS blue/green deployment type, configure a Canary or Linear traffic shifting strategy, and attach a CloudWatch alarm for error rate as a deployment alarm. CodeDeploy's ECS blue/green deployment type supports canary or linear traffic shifting, which automatically routes traffic to the new version only after health checks pass. By attaching a CloudWatch alarm for error rate as a deployment alarm, CodeDeploy can automatically trigger a rollback if error rates spike within the specified monitoring period (e.g., 10 minutes), meeting all three requirements: zero downtime, health-check-gated traffic shifting, and automatic rollback on error rate spikes.

Answer

Update the ECS service with a rolling update deployment configuration and set the minimum healthy percent to 100

Answer

Create a second ECS service with the new task definition and use Route 53 weighted routing to shift traffic at the DNS level

Answer

Enable ECS circuit breaker on the service to roll back failed deployments automatically

Question 12

A company runs a production web application on AWS using Auto Scaling groups (ASGs) behind an Application Load Balancer (ALB). The application state is stored in an Amazon RDS for MySQL Multi-AZ DB instance. The application experiences periodic traffic spikes, and the current ASG uses a simple scaling policy based on average CPU utilization. Recently, during a spike, the application became unresponsive for several minutes. The CloudWatch metrics show that the CPU utilization on the RDS instance peaked at 80%, and the DB Connections metric reached the maximum allowed. The read replica lag increased to over 10 seconds during the spike. The web servers are stateless and scale out quickly. The operations team needs to improve the reliability and performance of the application to handle future spikes. Which solution should the team implement?

Accepted Answer

Increase the DB instance size to a larger instance class and implement an Amazon ElastiCache cluster to cache frequent database queries.. Increasing the DB instance size provides more CPU and memory capacity to handle the load, and caching with ElastiCache reduces read load on the database by serving frequent queries from cache. This directly addresses high CPU and connection limits on RDS, and reduces read replica lag. Option A is wrong because increasing ASG size and adding more read replicas may increase database load further due to more connections and replication overhead. Option C is wrong because switching to DynamoDB and Lambda would require significant application changes and DynamoDB may not be suitable for complex queries. Option D is wrong because reducing MaxConnections on RDS would make the problem worse, and modifying application code to reduce queries is not a quick fix.

Answer

Increase the desired capacity of the ASG and add more read replicas to distribute the database load.

Answer

Migrate the database to Amazon DynamoDB with auto scaling and rewrite the application to use a serverless architecture with AWS Lambda.

Answer

Reduce the maximum connections parameter on the RDS instance to prevent connection exhaustion and modify the application code to reduce the number of database queries.

Question 13

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to ensure that the application stack can be recreated in another AWS Region in the event of a disaster. The stack includes an RDS MySQL database and an EC2 instance running a web server. The administrator wants to automate the backup of the RDS database and the EC2 instance configuration. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Backup to create backup plans that include the RDS instance and EC2 instance, and copy backups to the secondary region.. AWS Backup provides a centralized, automated backup service that can back up RDS databases (with automated backups) and EC2 instances (via AMIs). It supports cross-region copy, making it ideal for disaster recovery. Option A is wrong because storing database dump files and scripts in S3 is not a fully automated or integrated solution; it requires custom scripting and does not capture incremental changes efficiently. Option B is wrong because manual snapshots require manual intervention and are not automated. Option C is wrong because the CloudFormation template only captures infrastructure configuration, not the database data or EC2 instance state.

Answer

Use S3 to store database dump files and instance configuration scripts.

Answer

Create manual snapshots of the RDS database and EC2 instance every day and copy them to the secondary region.

Answer

Store the CloudFormation template in S3 and use it to recreate the stack in the secondary region.

Question 14

A company stores application log files in an Amazon S3 bucket. The logs are accessed frequently for the first 30 days, then rarely accessed but must be retrievable within 12 hours. After 1 year, the logs must be archived for compliance with a retention period of 5 years, during which retrievals are expected to be extremely rare (one or two per year) and retrieval time of 12 hours is acceptable. The SysOps administrator wants to minimize storage costs. Which S3 lifecycle policy configuration should be used?

Accepted Answer

After 30 days, transition to S3 Glacier Flexible Retrieval; after 365 days, transition to S3 Glacier Deep Archive; delete after 5 years.. It uses S3 Glacier Flexible Retrieval for the first year after the initial 30 days, which meets the 12-hour retrieval requirement at lower cost than S3 Standard-IA, then transitions to S3 Glacier Deep Archive for the remaining 4 years to minimize storage costs for extremely rare retrievals. The lifecycle policy transitions objects after 30 days to S3 Glacier Flexible Retrieval (retrieval time minutes to 12 hours), then after 365 days to S3 Glacier Deep Archive (retrieval time 12 hours), and deletes after 5 years, aligning with the access patterns and compliance retention.

Answer

After 30 days, transition to S3 Standard-IA; after 365 days, transition to S3 Glacier Deep Archive; delete after 5 years.

Answer

After 30 days, transition to S3 Glacier Flexible Retrieval; delete after 5 years.

Answer

After 30 days, transition to S3 Glacier Deep Archive; delete after 5 years.

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running in a VPC with public and private subnets. The SysOps administrator needs to update the environment to use a new platform version. Which TWO steps should be taken to ensure a smooth update with minimal downtime? (Select TWO.)

Accepted Answer

Perform a blue/green deployment by cloning the environment and swapping the CNAME.. Options C and D are correct. Option C: Performing a blue/green deployment by cloning the environment and swapping the CNAME minimizes downtime because the new environment is fully tested before traffic is switched to it. Option D: Enabling immutable updates in the environment configuration ensures that Elastic Beanstalk deploys the new platform version to a separate set of instances and then swaps traffic, reducing downtime and rollback risk. Option A is incorrect because updating security groups is not a required step for platform updates; security groups are typically managed separately. Option B is incorrect because taking an RDS snapshot is a backup best practice, but it does not by itself minimize downtime during a platform update. Option E is incorrect because connection draining is handled automatically by Elastic Beanstalk during the CNAME swap or immutable deployment; manual draining is unnecessary.

Answer

Update the security groups to allow traffic from the new environment.

Answer

Take a snapshot of the attached Amazon RDS database before starting the update.

Answer

Manually drain connections from the current environment before swapping.