SOA-C02 Practice Test 18 — 15 Questions

Question 1

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. Which combination of services should the SysOps administrator use to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification. CloudWatch Events (now Amazon EventBridge) can match CloudTrail events (like CreateAccessKey) and trigger an SNS notification. Option A is wrong because CloudWatch Logs Insights is a query tool for analyzing logs, not a real-time alerting mechanism; although metric filters and alarms can be set up, CloudWatch Events provides a more direct solution. Option B is wrong because AWS Config rules evaluate resource configurations and compliance, not real-time API calls. Option D is wrong because S3 event notifications trigger on object-level events in S3 buckets, not on specific API calls within CloudTrail logs.

Answer

CloudWatch Logs Insights query on CloudTrail logs with an alarm

Answer

An AWS Config rule that checks for new access keys and sends an SNS notification

Answer

S3 event notifications to an SNS topic

Question 2

A company runs a critical production database on Amazon RDS for MySQL with Multi-AZ deployment. The SysOps administrator needs to be automatically notified when a failover event occurs, and also capture the exact time and reason for the failover for compliance purposes. Which AWS service or feature should be used to capture the failover event details with the least operational overhead?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the 'RDS DB Instance Event' for 'failover' and sends the event to an Amazon SNS topic for notification and logging.. Amazon CloudWatch Events (now part of Amazon EventBridge) can match RDS DB Instance events, including 'failover', and route them to an SNS topic for notification and to CloudWatch Logs for logging. This approach requires no custom scripting or polling, providing the least operational overhead while capturing the exact time and reason for the failover directly from the RDS event stream.

Answer

Enable detailed monitoring on the RDS instance and stream the logs to Amazon CloudWatch Logs where a metric filter can detect failover patterns.

Answer

Configure AWS CloudTrail to log all RDS API calls and analyze the logs for the 'Failover' event type.

Answer

Use AWS Config to create a config rule that evaluates whether the 'DBInstanceStatus' changes to 'failover' and then trigger a remediation action.

Question 3

Which TWO actions should a SysOps administrator take to ensure high availability of a web application running on EC2 instances? (Choose two.)

Accepted Answer

Configure an Auto Scaling group with a health check to replace unhealthy instances.. An Auto Scaling group with a health check can automatically detect and replace unhealthy EC2 instances, ensuring that the web application remains available even if an instance fails. The health check can be configured to use Elastic Load Balancing (ELB) health checks or EC2 status checks to determine instance health, and the Auto Scaling group will launch a new instance to replace any that fails the health check.

Answer

Enable termination protection on all EC2 instances.

Answer

Launch all EC2 instances in a single Availability Zone.

Answer

Use a larger instance type for all EC2 instances.

Question 4

A company uses IAM roles to grant EC2 instances access to S3 buckets. After a recent security audit, the SysOps administrator must ensure that only instances with a specific tag (Environment=Production) can assume the role. How can this be achieved?

Accepted Answer

Add a condition in the role's trust policy that checks for the instance's tag using the aws:ResourceTag condition key.. IAM role trust policies can use the aws:ResourceTag condition key to restrict which EC2 instances (based on their tags) can assume the role. Option A is wrong because tags are not automatically included in the session; the trust policy must explicitly check tags. Option B is wrong because SCPs apply to accounts, not instances. Option C is wrong because instance profiles cannot be modified to check tags.

Answer

Create a new IAM role for each instance and attach the tag.

Answer

Use a service control policy (SCP) to deny the ec2:AssumeRole action for instances without the required tag.

Answer

Modify the instance profile to include the tag requirement.

Question 5

An administrator runs the above command to list EC2 instances. The company wants to optimize costs. Which instance should the administrator consider terminating first?

Accepted Answer

i-0mnop3456 (t3.medium, stopped in us-east-1c). The instance i-0mnop3456 is stopped but still incurs costs for EBS volumes and possibly Elastic IPs. Terminating it will eliminate those costs. The running instances are in use and may be necessary. The t3.medium instances are smaller and may be needed.

Answer

i-0efgh5678 (t3.large, running in us-east-1b)

Answer

i-0abcd1234 (t3.medium, running in us-east-1a)

Answer

i-0ijkl9012 (t3.xlarge, running in us-east-1a)

Question 6

A SysOps administrator is updating an AWS CloudFormation stack that contains an Amazon RDS DB instance. The administrator wants to prevent accidental replacement of the database during the update. Which CloudFormation feature should be used?

Accepted Answer

Stack policies. Stack policies are the correct feature because they allow you to define explicit deny statements that prevent CloudFormation from updating or replacing specific resources, such as an RDS DB instance, during a stack update. By setting a stack policy that denies replacement actions on the database resource, the administrator ensures that even if the template changes would normally trigger a replacement, the update will fail rather than accidentally recreate the database.

Answer

Change sets

Answer

Resource signals

Answer

Nested stacks

Question 7

Refer to the exhibit. A SysOps administrator has attached the bucket policy shown to an S3 bucket. Users from the IP range 192.0.2.0/24 report that they can access objects, but users from other IP ranges also report they can access objects. What is the most likely reason?

Accepted Answer

The bucket ACL allows public read access, overriding the bucket policy Deny.. The bucket policy shown only allows access from the 192.0.2.0/24 IP range. However, if the bucket also has a bucket ACL that grants public read access to everyone, users from other IP ranges can read objects via the ACL. Bucket policies and ACLs are evaluated independently; an Allow in the ACL can grant access even if the policy does not explicitly deny it. Since there is no explicit Deny in the bucket policy against other IPs, the ACL's public read grant allows access from all IP ranges, overriding the intent of the policy's Allow restriction.

Answer

The bucket is not configured to use the bucket policy.

Answer

The bucket policy is malformed and is not being applied.

Answer

The Condition element in the Allow statement is incorrectly formatted.

Question 8

A company wants to reduce costs for a production Amazon RDS for MySQL DB instance that is running 24/7 but only heavily used during business hours (9 AM to 5 PM). Which TWO actions would be MOST effective in optimizing costs without significantly impacting performance during peak hours?

Accepted Answer

Purchase Reserved Instances for the DB instance.. (Multi-AZ) increases cost and is not needed for cost optimization. Option B (reserved instances) provides a discount for consistent usage. Option C (Migrate to gp3 storage) can be more cost-effective than provisioned IOPS for many workloads, but it is not the most effective action because the instance is only heavily used during business hours. Option D (scheduled scaling) can reduce instance size during off-peak hours, saving cost. Option E (Auto Scaling) is not applicable to standard RDS without additional services like Aurora Auto Scaling. Correct answers: B and D.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Migrate from Provisioned IOPS (io1) storage to General Purpose (gp3) storage.

Answer

Enable Auto Scaling for the DB instance.

Question 9

A SysOps administrator needs to automatically restart an Amazon RDS DB instance when the 'DatabaseConnections' metric exceeds a threshold of 200 for 5 consecutive minutes. The administrator wants a solution that uses minimal custom code and leverages AWS managed services. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch alarm with an AWS Systems Manager Automation action.. AWS Systems Manager Automation provides a built-in 'AWSSupport-StartRDSInstance' or 'AWSSystemsManager-RestartRDSInstance' runbook that can be triggered directly by a CloudWatch alarm action, requiring no custom code. This leverages a managed service to restart the RDS instance automatically when the 'DatabaseConnections' metric exceeds 200 for 5 consecutive minutes, meeting the minimal custom code requirement.

Answer

Amazon CloudWatch alarm with an Auto Scaling policy.

Answer

Amazon CloudWatch alarm with an Amazon Simple Notification Service (SNS) topic that triggers an AWS Lambda function to restart the instance.

Answer

Amazon RDS event subscription that triggers an AWS Lambda function.

Question 10

Drag and drop the steps to set up an AWS Site-to-Site VPN connection into the correct order.

Accepted Answer

Create and attach virtual private gateway, then define customer gateway, then create VPN connection, then configure on-premises router, then verify tunnel. First create and attach the virtual private gateway, then define the customer gateway, then create the VPN connection, configure the on-premises router, and verify the tunnel.

Answer

Define customer gateway, then create and attach virtual private gateway, then create VPN connection, then configure on-premises router, then verify tunnel

Answer

Create and attach virtual private gateway, then create VPN connection, then define customer gateway, then configure on-premises router, then verify tunnel

Answer

Create and attach virtual private gateway, then define customer gateway, then configure on-premises router, then create VPN connection, then verify tunnel

Question 11

Instances in a private subnet need outbound internet access for software updates. The route table sends 0.0.0.0/0 to a NAT gateway, but updates fail. Which condition should you check first?

Accepted Answer

Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.. A NAT gateway must reside in a public subnet with a route table entry directing 0.0.0.0/0 to an internet gateway (IGW). Without this, the NAT gateway cannot translate private IPs to the IGW's public IP, so outbound traffic from private instances fails. This is the most common root cause for failed internet access through a NAT gateway.

Answer

Attach an internet gateway directly to the private subnet instances.

Answer

Replace all security groups with network ACLs.

Answer

Enable VPC peering to another account.

Question 12

An EC2 instance in the subnet associated with the network ACL above cannot receive HTTP traffic (port 80) from the internet. The instance has a security group allowing HTTP inbound. What is the cause?

Accepted Answer

The NACL has a deny all rule (rule 400) that blocks all inbound traffic, overriding the allow rules. Network ACLs are stateless and rules are evaluated in order by rule number. Rule 400 denies all inbound traffic, and since it has a higher rule number than rules 100 and 300, it is evaluated later and overrides the allows. Rule 400 denies all inbound traffic, so HTTP (port 80) is denied. Option A is wrong because rule 300 allows port 80 inbound from 0.0.0.0/0, so HTTP is allowed by that rule, but rule 400 denies all. Option B is wrong because the outbound rule allows all traffic. Option D is wrong because the security group allows HTTP inbound but the NACL blocks it.

Answer

The NACL allows HTTP inbound on rule 300, but the outbound rule does not allow the return traffic

Answer

The NACL inbound rule for HTTP is using the wrong protocol (6 instead of 17)

Answer

The security group does not allow HTTP inbound

Question 13

A company runs a mix of Amazon EC2 instances and AWS Fargate tasks that are used for both production and development workloads. The usage is steady and predictable. The SysOps administrator wants to maximize cost savings across both compute services without having to manage specific instances or sizes. Which purchasing option should the administrator recommend?

Accepted Answer

Purchase Compute Savings Plans for a 1-year or 3-year term with a commitment that covers the expected compute spend.. Compute Savings Plans offer the most flexibility, automatically applying to EC2 instances (regardless of instance family, size, or region) and Fargate tasks. Since the company has a mix of both services and wants to maximize savings without managing specific instances or sizes, a 1-year or 3-term Compute Savings Plan with a commitment matching expected spend provides up to 66% savings while covering all compute usage. This aligns with the steady and predictable workload described.

Answer

Purchase EC2 Instance Savings Plans for the most commonly used instance family and region.

Answer

Purchase Standard Reserved Instances for the EC2 instances and convert Fargate tasks to use Spot Instances.

Answer

Use On-Demand instances for both EC2 and Fargate because the administrator does not want to make a commitment.

Question 14

A SysOps administrator is configuring a VPC with a public subnet and a private subnet. The private subnet needs to access the internet to download patches. The administrator creates a NAT Gateway in the public subnet and updates the private subnet route table. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table for the public subnet does not have a route to an Internet Gateway.. The most likely cause is that the route table associated with the public subnet does not have a route to an Internet Gateway. A NAT Gateway must be placed in a public subnet, and that subnet's route table must have a default route (0.0.0.0/0) pointing to an Internet Gateway for the NAT Gateway to connect to the internet. Without this route, the NAT Gateway cannot send traffic to the internet. Options A, C, and D are incorrect: (A) While network ACLs can impact traffic, the scenario suggests the issue is routing, not ACLs; (C) NAT Gateways do require an Elastic IP, but if the administrator created the NAT Gateway, they likely attached one; (D) Security groups do not apply to NAT Gateways, as they are managed AWS services.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address attached.

Answer

The security group associated with the NAT Gateway blocks outbound traffic.

Question 15

Refer to the exhibit. An IAM user has this policy attached. What is the effect when the user attempts to get an object from my-bucket from an IP address in the range 198.51.100.0/24?

Accepted Answer

Denied because the Deny statement applies. The policy includes an Allow statement that grants s3:GetObject only from the IP range 192.0.2.0/24. It also includes a Deny statement that denies s3:GetObject from any IP address not in that range (using the NotIpAddress condition). The user's request comes from an IP in the 198.51.100.0/24 range, which is not included in the allowed range. Therefore, the Deny condition matches, and the Deny statement applies. In AWS IAM, an explicit Deny overrides any Allow, so the request is denied. Option D is correct. Option A is incorrect because the Deny does match. Option B is incorrect because there is an explicit Allow for a different IP range, but the Deny overrides it. Option C is incorrect because the Allow only applies to the specified range, and the Deny overrides it.

Answer

Allowed because the Deny condition does not match

Answer

Denied because there is no explicit Allow for that IP range

Answer

Allowed because there is an Allow statement