SOA-C02 Practice Test 17 — 15 Questions

Question 1

A SysOps administrator needs to detect when an IAM user attempts to modify an Amazon S3 bucket policy in the production AWS account. The administrator wants to receive an email notification within 5 minutes of such an event. The solution must use AWS managed services with no custom code. Which combination of services should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events (Amazon EventBridge), and Amazon SNS. AWS CloudTrail captures the S3 bucket policy modification as a management event, which can be sent to Amazon EventBridge (formerly CloudWatch Events) as a real-time event. EventBridge can then trigger an SNS topic to send an email notification within minutes, all using fully managed services with no custom code required.

Answer

AWS CloudTrail, Amazon CloudWatch Logs metric filter, and Amazon SNS

Answer

Amazon S3 event notifications and Amazon SNS

Answer

AWS CloudTrail, AWS Lambda, and Amazon SNS

Question 2

A SysOps administrator is deploying a new version of an application using AWS CodeDeploy with an in-place deployment configuration. The deployment group consists of EC2 instances behind an Application Load Balancer. The administrator wants to ensure that traffic is gradually shifted to the new version. Which CodeDeploy feature should be used?

Accepted Answer

Configure the load balancer deregistration delay and re-registration in the deployment group.. Configuring the load balancer deregistration delay and re-registration in the deployment group allows CodeDeploy to control how instances are gradually removed from and added back to the ALB target group. This enables a controlled traffic shift during an in-place deployment by waiting for in-flight requests to complete (via deregistration delay) before rerouting traffic to the new version, and then re-registering instances after the new application is healthy.

Answer

Use a canary deployment instead of in-place.

Answer

Define a BeforeInstall hook to deregister instances.

Answer

Use a linear deployment configuration.

Question 3

A SysOps administrator is troubleshooting an application that runs on AWS Lambda. The application occasionally fails with timeout errors. The administrator needs to identify the exact lines of code that are causing the delays. Which AWS service or feature should be used to gather this information?

Accepted Answer

Use AWS X-Ray to trace the Lambda function and view segment details.. AWS X-Ray provides end-to-end tracing for Lambda functions, capturing segment details and subsegments that pinpoint the exact lines of code causing delays. By analyzing the trace timeline and annotations, the administrator can identify which specific function calls or operations exceed the timeout threshold, unlike CloudWatch Logs which only show aggregate duration or error strings without code-level granularity.

Answer

Enable detailed CloudWatch Logs and search for 'timeout' strings.

Answer

Set a CloudWatch Metric Filter for 'Duration' and create an alarm.

Answer

Enable AWS CloudTrail data events for the Lambda function.

Question 4

Refer to the exhibit. A SysOps administrator runs the 'list-metrics' command for CPUUtilization. Based on the output, what can the administrator conclude?

Accepted Answer

There are two EC2 instances that have reported CPUUtilization metrics at some point.. The 'list-metrics' output shows two distinct dimensions (i-12345678 and i-87654321) for the CPUUtilization metric, indicating that two EC2 instances have reported this metric at some point. Option B is correct because the presence of two unique instance IDs in the metric data confirms that CPUUtilization has been recorded for both instances, regardless of whether they are currently active or have alarms configured.

Answer

The CPUUtilization metric is only available for EC2 instances.

Answer

Both instances are actively publishing CPUUtilization metrics.

Answer

An alarm has been set on both instances for CPUUtilization.

Question 5

A company is running a stateful web application on EC2 instances in an Auto Scaling group. The application requires low latency and high throughput. Currently, the application is experiencing performance degradation during peak hours. Which scaling strategy should the SysOps administrator implement to improve performance and optimize cost?

Accepted Answer

Predictive scaling policy. Predictive scaling is the correct choice because it uses machine learning to analyze historical traffic patterns and proactively adjust capacity before demand spikes, which is ideal for a stateful web application experiencing predictable peak-hour performance degradation. This approach ensures low latency and high throughput by pre-warming instances, while optimizing cost by avoiding over-provisioning during off-peak periods.

Answer

Step scaling policy based on memory utilization

Answer

Scheduled scaling with fixed times

Answer

Simple scaling policy based on CPU utilization

Question 6

A company has an S3 bucket that stores sensitive data. A SysOps administrator needs to detect when objects in the bucket are publicly accessible. Which AWS service should the administrator use to continuously monitor and report on public access?

Accepted Answer

AWS Config. AWS Config provides a managed rule called 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited' that continuously evaluates S3 bucket policies and ACLs against the desired configuration. When a bucket becomes publicly accessible, AWS Config flags it as noncompliant and can trigger automated remediation or notifications. This makes it the correct service for ongoing monitoring and reporting of public access to sensitive data.

Answer

S3 server access logs

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 7

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a database. Which TWO components are required to allow an EC2 instance in the public subnet to connect to the database?

Accepted Answer

A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR.. A security group rule on the database allowing inbound traffic from the EC2 instance's security group (Option E) is required because security groups act as a virtual firewall at the instance level, and by default they deny all inbound traffic. A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR (Option B) is also required because network ACLs are stateless and control traffic at the subnet boundary; without an inbound allow rule, traffic from the public subnet would be dropped by the private subnet's ACL.

Answer

A NAT Gateway in the public subnet.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Endpoint for the database service.

Question 8

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an RDS DB instance with automated backups enabled. The SysOps administrator needs to ensure that the database can be recovered to any point within the last 35 days with minimal data loss. What should the administrator do?

Accepted Answer

Set the backup retention period to 35 days.. Automated backups in RDS allow point-in-time recovery (PITR) to any second within the backup retention period. By setting the retention period to 35 days, the administrator enables recovery to any point within that window, minimizing data loss to the last committed transaction before the restore time.

Answer

Create a manual snapshot daily and retain 35 snapshots.

Answer

Enable Multi-AZ on the RDS instance.

Answer

Configure AWS Backup with a 35-day backup plan.

Question 9

A SysOps administrator receives an alarm that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group behind an Application Load Balancer. The administrator needs to ensure that the instance is automatically replaced and that the root cause is investigated. What is the MOST efficient combination of actions to achieve this?

Accepted Answer

Configure an Auto Scaling lifecycle hook to terminate the unhealthy instance and send the instance system log to an S3 bucket for analysis.. It combines automatic instance replacement via the Auto Scaling group's health check (which marks the instance unhealthy and terminates it) with a lifecycle hook that captures the instance's system log before termination and sends it to S3 for root cause analysis. This is the most efficient approach as it requires no manual intervention and preserves diagnostic data.

Answer

Create a CloudWatch alarm that triggers an SNS notification to the administrator to manually replace the instance.

Answer

Reboot the instance from the AWS Management Console and then review CloudTrail logs.

Answer

Manually stop and start the instance to recover it, then check the system logs.

Question 10

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences variable traffic patterns. What is the MOST cost-effective way to ensure the application scales based on demand?

Accepted Answer

Use EC2 Auto Scaling with a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy based on average CPU utilization automatically adjusts the number of EC2 instances to maintain a target metric (e.g., 50% CPU), scaling out during high demand and scaling in during low demand. This is the most cost-effective approach for variable traffic patterns as it eliminates over-provisioning and manual intervention, directly aligning capacity with real-time demand.

Answer

Provision a fixed number of EC2 instances that can handle peak load at all times.

Answer

Use EC2 Auto Scaling with a scheduled scaling policy that adds instances during business hours.

Answer

Use EC2 Auto Scaling with a manual scaling plan that requires an administrator to adjust the desired capacity.

Question 11

A company is designing a highly available web application using an Application Load Balancer (ALB) with EC2 instances in an Auto Scaling group across two Availability Zones. Which configuration ensures that the application remains available if one Availability Zone fails?

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones. Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ continues to serve traffic. The ALB distributes incoming requests across healthy targets in all enabled AZs, and Auto Scaling replaces failed instances in the remaining AZs automatically, maintaining application availability.

Answer

Use a single large EC2 instance instead of multiple instances

Answer

Disable health checks on the ALB to avoid false positives

Answer

Launch all EC2 instances in a single Availability Zone

Question 12

A company runs a critical database on an EC2 instance with an EBS volume. The administrator wants to create a disaster recovery plan that can recover the database in a different AWS Region within 4 hours. The database size is 1 TB. What is the MOST efficient approach to meet the RTO?

Accepted Answer

Copy the AMI and underlying EBS snapshots to the DR region.. Copying the AMI and its underlying EBS snapshots to the DR region creates a fully independent, bootable image that can be launched as an EC2 instance in the target region. This approach directly supports the 4-hour RTO by allowing the administrator to pre-stage the AMI copy or initiate the copy on-demand, and then launch the instance from the copied AMI without needing to recreate the volume from individual snapshots or reconfigure instance metadata.

Answer

Share the AMI with the target region.

Answer

Use EBS snapshots directly in the DR region.

Answer

Configure AWS Backup to copy backups to the DR region.

Question 13

Which THREE configurations are required to enable an EC2 instance in a private subnet to access the internet for software updates while preventing inbound internet traffic?

Accepted Answer

Attach an Internet Gateway to the VPC.. An Internet Gateway (IGW) is required for any VPC to enable internet connectivity. Without an IGW, traffic cannot leave or enter the VPC from the internet. For a private subnet EC2 instance to reach the internet for software updates, the VPC must have an IGW attached, and the NAT Gateway (placed in a public subnet) uses the IGW to forward outbound traffic while blocking inbound connections.

Answer

Assign an Elastic IP address to the EC2 instance.

Answer

Deploy a bastion host in the private subnet.

Question 14

A SysOps administrator is troubleshooting an issue where an EC2 instance is not sending logs to CloudWatch Logs. The instance has the CloudWatch agent installed, but no logs appear in the log group. The IAM role assigned to the instance has the following policy: {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"], "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:*"}]}. What is the most likely cause?

Accepted Answer

The log group name in the agent configuration does not match the policy resource.. The IAM policy grants permissions only for the log group named 'MyAppLogs' (with a wildcard for streams). If the CloudWatch agent configuration specifies a different log group name, the agent's API calls to CreateLogGroup, CreateLogStream, or PutLogEvents will fail with an AccessDenied error because the resource ARN in the policy does not match the actual log group being targeted. This is the most common cause when the agent is installed and running but no logs appear.

Answer

The CloudWatch agent is not running on the instance.

Answer

The IAM role does not have permission to describe log groups.

Answer

The instance does not have outbound internet access to reach CloudWatch Logs.

Question 15

A SysOps administrator uses AWS CodeDeploy to deploy a new version of an application to an Auto Scaling group. The deployment uses the 'CodeDeployDefault.OneAtATime' deployment configuration. During the deployment, the first instance succeeds, but subsequent instances fail because the new application version has a bug that causes the application health check to fail. The administrator wants to immediately roll back the change and restore the previous working version on all instances. Which action should the administrator take?

Accepted Answer

Initiate a rollback from the CodeDeploy console to redeploy the previous working revision.. CodeDeploy supports automatic and manual rollbacks to a previous working revision. When a deployment fails, the administrator can initiate a rollback from the CodeDeploy console, which redeploys the last successful revision to all instances in the deployment group, including those that were already updated. This ensures the previous working version is restored across the entire Auto Scaling group.

Answer

Stop the deployment immediately; the instances that have already been updated will revert automatically.

Answer

Edit the deployment group settings to pause deployments after a failure, then manually fix the instances.

Answer

Redeploy the same failing revision but with a different deployment configuration.