SOA-C02 Practice Test 17 — 15 Questions

Question 1

A company has a VPC with a public subnet and a private subnet. The private subnet contains an EC2 instance that must access the internet for software updates. Which TWO actions are required to enable this? (Choose TWO.)

Accepted Answer

Deploy a NAT Gateway in a public subnet.. Option A is correct because a NAT Gateway must be in a public subnet. Option C is correct because the private subnet's route table must have a default route to the NAT Gateway. Option B is wrong because the NAT Gateway does not need an Internet Gateway; the public subnet does. Option D is wrong because the EC2 instance does not need a public IP. Option E is wrong because an Internet Gateway is for public subnets, not private.

Answer

Add an Internet Gateway to the private subnet's route table.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach an Internet Gateway to the NAT Gateway.

Question 2

A SysOps Administrator is troubleshooting an issue where an Application Load Balancer (ALB) returns 502 Bad Gateway errors. Which THREE are possible causes? (Choose THREE.)

Accepted Answer

The target instance is taking too long to respond (e.g., more than the idle timeout).. Option A is correct because if the target group has no healthy instances, the ALB may return 502. Option B is correct because if the target's security group blocks traffic from the ALB, it can cause 502. Option C is correct because if the target's response times out, the ALB returns 502. Option D is wrong because an incorrect path would cause 404, not 502. Option E is wrong because HTTP methods are not the cause of 502 errors.

Answer

The target instance is configured to respond to a different URL path.

Answer

The ALB is configured with a different HTTP method than the target expects.

Question 3

Which TWO AWS services can be used to improve the security of a VPC? (Choose TWO.)

Accepted Answer

Security Groups. Option A is correct because Network ACLs provide stateless filtering. Option D is correct because Security Groups provide stateful filtering. Option B is wrong because Route Tables control traffic routing, not security. Option C is wrong because Internet Gateway provides internet access. Option E is wrong because VPC Peering connects VPCs but does not add security.

Answer

Internet Gateway

Answer

Route Tables

Answer

VPC Peering

Question 4

A SysOps administrator needs to route traffic to multiple AWS regions for a global application with low latency. Which AWS service should be used?

Accepted Answer

Amazon Route 53 with latency routing policy. Option B (Amazon Route 53 with latency routing policy) is correct because latency-based routing directs traffic to the region with the lowest latency for the user. Option A (AWS Global Accelerator) also improves latency but is more for TCP/UDP traffic. Option C (CloudFront) is for content delivery, not dynamic routing. Option D (ALB) is a regional service.

Answer

Amazon CloudFront

Answer

Application Load Balancer

Answer

AWS Global Accelerator

Question 5

Which THREE AWS services can be used to improve security and performance for a web application that uses an Application Load Balancer? (Select three.)

Accepted Answer

AWS Shield Advanced. Option A (AWS WAF) is correct for security, protecting against web exploits. Option B (Amazon CloudFront) is correct for performance via caching and DDoS protection. Option D (AWS Shield Advanced) is correct for enhanced DDoS protection. Option C (AWS Direct Connect) is for dedicated connectivity, not directly related. Option E (Amazon Route 53) is DNS, not directly for security/performance of the ALB.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 6

A company runs a production application on EC2 instances in an Auto Scaling group. The application stores data on an EBS volume. The SysOps administrator wants to ensure that the data is durable and available even if an EC2 instance fails. Which approach should the administrator take?

Accepted Answer

Migrate the data to Amazon EFS and mount it to all instances.. Option C is correct because storing data on EFS provides a shared file system that persists independently of EC2 instances, and EFS is designed for high availability and durability. Option A is wrong because EBS volumes are tied to a single AZ and instance. Option B is wrong because instance store is ephemeral. Option D is wrong because S3 is object storage, not a file system.

Answer

Use an instance store volume and replicate data across instances.

Answer

Use an EBS volume with snapshots taken every hour.

Answer

Move the data to an S3 bucket and access it via S3 API.

Question 7

A SysOps administrator is setting up a backup plan for an RDS MySQL database. The database is 500 GB in size and is used for a critical application. The company requires a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour. Which solution meets these requirements?

Accepted Answer

Deploy the RDS instance in a Multi-AZ configuration with automatic failover.. Option A is correct because Multi-AZ with automatic failover provides a low RTO (typically under 1 minute) and synchronous replication ensures RPO of seconds. Option B is wrong because manual snapshots have higher RPO and RTO. Option C is wrong because cross-region read replicas are asynchronous and may have higher RPO. Option D is wrong because S3 backups would have high RTO.

Answer

Use AWS Backup to copy snapshots to a different AWS Region.

Answer

Take manual snapshots every 5 minutes and store them in Amazon S3.

Answer

Configure a cross-region read replica and promote it during failover.

Question 8

A company wants to allow its employees to access internal applications using a custom domain name (app.example.com) that resolves to an internal ALB. Which AWS service should be used?

Accepted Answer

Amazon Route 53. Option A is correct because Route 53 is the DNS service to route traffic to internal resources. Option B is wrong because CloudFront is for content delivery, not DNS resolution. Option C is wrong because Global Accelerator improves performance but is not primarily for internal DNS. Option D is wrong because ALB does not provide DNS resolution.

Answer

AWS Global Accelerator

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 9

A SysOps administrator notices that traffic to an Amazon EC2 instance is being blocked even though the security group allows all inbound traffic. The subnet's network ACL allows all inbound and outbound traffic. What could be the issue?

Accepted Answer

The instance's operating system firewall is blocking the traffic.. Option C is correct because the operating system's firewall can block traffic at the instance level. Option A is wrong because NACLs are permissive. Option B is wrong because route tables do not block traffic. Option D is wrong because VPC Flow Logs only log traffic, they do not block it.

Answer

The network ACL is not associated with the subnet correctly.

Answer

VPC Flow Logs are misconfigured.

Answer

The route table does not have a default route to an internet gateway.

Question 10

A company is using Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. How should this be configured?

Accepted Answer

Configure Origin Access Control (OAC) with the S3 bucket policy.. Option D is correct because Origin Access Control (OAC) ensures only CloudFront can access the bucket. Option A is wrong because bucket policies can be used but OAC is the modern recommended approach. Option B is wrong because CloudFront key pairs are for signed URLs/cookies, not origin access. Option C is wrong because IAM roles are used for EC2, not for CloudFront access to S3.

Answer

Use CloudFront signed URLs or cookies.

Answer

Attach an IAM role to CloudFront that grants S3 read access.

Answer

Create a bucket policy that allows access only from the CloudFront distribution's IP addresses.

Question 11

A SysOps administrator needs to design a VPC with public and private subnets for a web application. Which TWO components are required to allow instances in the private subnet to access the internet?

Accepted Answer

NAT gateway in a public subnet. Options B and D are correct. A NAT gateway (or NAT instance) in a public subnet and a route table entry pointing to it allow private instances to access the internet. Option A is wrong because internet gateway is for public subnets. Option C is wrong because VPC endpoints are for accessing AWS services privately. Option E is wrong because VPN is for hybrid connectivity.

Answer

VPC endpoint for S3

Answer

Internet gateway attached to the VPC

Answer

Virtual private gateway

Question 12

A company is designing a disaster recovery plan for its critical applications. The plan must minimize data loss and recovery time. Which TWO measures should the SysOps administrator implement?

Accepted Answer

Perform regular backups to Amazon S3.. Options A and C are correct. Regular backups to S3 provide data durability, and multi-region replication ensures availability in another region. Option B is wrong because a single region does not protect against region failure. Option D is wrong because manual failover is slow. Option E is wrong because RTO is about time, not backup frequency.

Answer

Set a recovery time objective (RTO) of 24 hours.

Answer

Use manual procedures to restore from backups.

Answer

Run all workloads in a single AWS region.

Question 13

A company is running a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across two Availability Zones. The company needs to ensure that if an entire Availability Zone fails, the application remains available. Which configuration meets this requirement?

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones.. Spreading instances across multiple Availability Zones ensures that if one AZ fails, the other AZ continues to serve traffic. Option B is correct because it explicitly uses multiple AZs. Option A is wrong because using a single AZ does not provide AZ-level fault tolerance. Option C is wrong because Amazon CloudFront is a CDN, not a solution for AZ failure. Option D is wrong because increasing instance size does not provide AZ redundancy.

Answer

Use larger EC2 instance types to handle the load during a failure.

Answer

Use Amazon CloudFront to distribute traffic across multiple regions.

Answer

Launch all instances in the same Availability Zone to reduce latency.

Question 14

A company has an S3 bucket that stores critical data. The bucket has versioning enabled. A SysOps administrator accidentally deletes a version of an object. What is the quickest way to recover the deleted version?

Accepted Answer

Copy the deleted version from the bucket's version history.. Option B is correct because S3 versioning allows you to restore a previous version by copying it back to the bucket. Option A is wrong because the object is not permanently deleted; it can be undeleted via versioning. Option C is wrong as long as versioning is on. Option D is wrong because MFA Delete does not help with recovery.

Answer

Use the S3 bucket's 'Undelete' feature.

Answer

Enable MFA Delete and then restore the object.

Answer

Contact AWS Support to restore the object.

Question 15

A SysOps administrator is troubleshooting a high error rate on an Application Load Balancer (ALB). The ALB is configured with two target groups: one for EC2 instances and one for Lambda functions. The administrator notices that the EC2 target group is unhealthy. Which THREE steps should the administrator take to resolve the issue?

Accepted Answer

Verify that the EC2 instances' security groups allow traffic from the ALB.. Options A, B, and D are correct. Checking security groups ensures traffic from ALB is allowed, health check configuration ensures correct path and interval, and instance logs help identify application errors. Option C is wrong because DNS issues are not related to health checks. Option E is wrong because scaling does not fix health check failures.

Answer

Review the ALB's DNS resolution for the target instances.

Answer

Increase the size of the Auto Scaling group to distribute load.