SOA-C02 Practice Test 18 — 15 Questions

Question 1

A company uses a Multi-AZ RDS for MySQL instance for its production database. During a maintenance window, the primary instance fails and a failover occurs. However, the application experiences a 5-minute downtime. The application uses a DNS CNAME record pointing to the RDS endpoint. What is the MOST likely cause of the downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application was using a cached DNS resolution for the RDS endpoint.. During a Multi-AZ RDS failover, the RDS DNS CNAME record is updated to point to the new primary instance in a different Availability Zone. However, the application's DNS resolver may have cached the previous IP address (TTL-based). If the application does not flush its DNS cache or the TTL is long, it continues to connect to the old (failed) IP, causing connection timeouts until the cache expires. This is the most likely cause of the 5-minute downtime, as RDS failovers typically complete within 1-2 minutes.

Answer

The application was not configured to retry connections after a failover.

Answer

The RDS endpoint changed after failover and the application did not update.

Answer

The failover process took longer than expected due to a large transaction log.

Question 2

An IAM policy is attached to an EC2 instance role to allow sending logs to CloudWatch Logs. The application running on the instance fails to send logs to the log group 'MyAppLogGroup'. Which change is required to fix the issue?

Accepted Answer

Add a new statement allowing logs:PutLogEvents on 'arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogGroup:log-stream:*'.. The IAM policy attached to the EC2 instance role is missing the `logs:PutLogEvents` permission for the specific log stream within the log group. Even if the policy allows `logs:CreateLogStream` and `logs:DescribeLogGroups`, the application cannot send log events without `logs:PutLogEvents` on the log stream resource. Option C adds the required statement with the correct ARN pattern to resolve the failure.

Answer

Install the CloudWatch agent on the instance.

Answer

Attach the policy to the EC2 instance instead of the instance role.

Answer

Change the log group ARN in the policy to include the log stream name.

Question 3

A SysOps administrator notices that an RDS instance's storage is nearly full. The instance uses General Purpose SSD (gp2) storage. The administrator needs to increase storage with minimal downtime. Which action should be taken?

Accepted Answer

Modify the RDS instance to increase the allocated storage size. Modifying the RDS instance to increase the allocated storage size is the correct action because RDS for MySQL, MariaDB, PostgreSQL, Oracle, and SQL Server supports dynamic storage scaling with minimal downtime. When you modify the allocated storage for a gp2 volume, RDS performs the modification in the background, and the instance remains available during the process, though you may experience a brief performance impact. This directly addresses the near-full storage condition without requiring a full outage.

Answer

Enable storage auto-scaling

Answer

Delete old data to free up space

Answer

Convert the storage type to Provisioned IOPS

Question 4

A company's security policy requires that all IAM users must authenticate using multi-factor authentication (MFA) before accessing the Amazon S3 bucket containing confidential finance data. The SysOps administrator needs to create an IAM policy that denies access to the S3 bucket if the user has not authenticated using MFA. Which IAM condition key should the administrator include in the policy?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key evaluates to `true` when the requesting IAM user has authenticated using a valid MFA device. By including this key in a `Deny` statement with a condition that it is `false`, the policy effectively blocks any S3 access unless MFA was used. This directly enforces the security policy requirement.

Answer

aws:UserAgent

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Question 5

A company runs a stateful application on EC2 instances in an Auto Scaling group. The application maintains state in memory. The SysOps administrator wants to ensure that when an instance is terminated, the state is preserved and a new instance can resume operation. Which approach should the administrator use?

Accepted Answer

Use an Auto Scaling lifecycle hook to offload state before termination.. An Auto Scaling lifecycle hook can be configured to execute a custom action (e.g., offloading in-memory state to Amazon S3 or ElastiCache) before the instance is terminated. The lifecycle hook places the instance in a 'terminating:wait' state, allowing the administrator to run a script that preserves state, and then completes the termination via CompleteLifecycleAction. This ensures state is saved before the instance is fully terminated, enabling a new instance to resume operation.

Answer

Use a warm standby instance that takes over when the primary fails.

Answer

Configure the EC2 instance to run a script on shutdown to save state locally.

Answer

Enable connection draining on the ALB.

Question 6

A company has an EC2 instance that needs to access an S3 bucket. The instance is launched in a private subnet with no internet gateway. What is the most secure way to provide access to S3 without traversing the internet?

Accepted Answer

Create an S3 VPC gateway endpoint. An S3 VPC gateway endpoint allows EC2 instances in a private subnet to access S3 privately using AWS’s internal network, without requiring an internet gateway, NAT gateway, or public IP. Traffic stays within the AWS backbone, never traversing the internet, which provides the most secure and cost-effective solution for this scenario.

Answer

Use a NAT gateway in a public subnet

Answer

Set up an AWS Direct Connect connection

Answer

Attach an internet gateway to the VPC and a public IP to the instance

Question 7

A company processes orders using an Amazon SQS standard queue. The order processing application occasionally fails to process a message. The SysOps administrator wants to ensure that any message that fails to be successfully processed after three attempts is automatically moved to a separate queue for manual review. Which SQS feature should be configured?

Accepted Answer

Configure a Dead Letter Queue (DLQ) with a redrive policy. A Dead Letter Queue (DLQ) with a configured redrive policy is the correct SQS feature to automatically move messages that have failed processing after a specified number of attempts (in this case, three) to a separate queue for manual review. The redrive policy defines the source queue, the DLQ, and the maximum receive count (maxReceiveCount) threshold. When a message is received from the source queue more times than the maxReceiveCount, SQS automatically redirects it to the DLQ, isolating problematic messages without manual intervention.

Answer

Increase the visibility timeout of the queue

Answer

Convert the queue to a FIFO queue

Answer

Enable redrive allow policy on the queue

Question 8

A company has enabled AWS CloudTrail in all regions and is logging to an S3 bucket. The security team needs to be alerted within minutes if any IAM user creates a new access key. What is the MOST efficient way to achieve this?

Accepted Answer

Configure CloudTrail to send logs to CloudWatch Logs. Create a metric filter for the IAM event 'CreateAccessKey' and set a CloudWatch alarm that sends an SNS notification.. CloudTrail can be configured to deliver events to CloudWatch Logs, where a metric filter can be created to match the 'CreateAccessKey' event. A CloudWatch alarm based on that metric filter can then trigger an SNS notification within minutes, providing the most efficient and native AWS solution for real-time alerting without custom code or polling.

Answer

Enable S3 event notifications on the CloudTrail bucket to trigger a Lambda function that parses logs and sends an alert.

Answer

Use AWS Config rules to detect changes to IAM access keys and trigger an SNS notification.

Answer

Run a script on an EC2 instance that polls CloudTrail API for new events every minute and sends alerts.

Question 9

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer, Auto Scaling group, and RDS database. The SysOps administrator receives a notification that a stack update has failed. The administrator wants to investigate the failure and understand which resource caused the issue. The stack is in the UPDATE_ROLLBACK_IN_PROGRESS state. What should the administrator do to identify the failed resource?

Accepted Answer

View the stack events in the CloudFormation console to see which resource failed and the error message.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_IN_PROGRESS, the most direct way to identify the failed resource is to view the stack events in the CloudFormation console. Each event includes a status reason field that contains the specific error message and the logical resource ID of the resource that caused the failure, allowing the administrator to pinpoint the issue without additional investigation.

Answer

Review the stack's template in the CloudFormation console to check for syntax errors.

Answer

Check the CloudWatch Logs for the EC2 instances in the Auto Scaling group.

Answer

Manually re-run the update with the same parameters to see if the error recurs.

Question 10

A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are encrypted at rest using server-side encryption. Which combination of actions should be taken to enforce this policy?

Accepted Answer

Use an S3 bucket policy on each bucket that denies s3:PutObject if the x-amz-server-side-encryption header is not present.. An S3 bucket policy with a Deny statement for s3:PutObject that requires the x-amz-server-side-encryption header ensures that any PUT request without encryption headers is rejected. This enforces server-side encryption at the point of upload, preventing unencrypted objects from being stored in the bucket. Default encryption (Option A) only applies encryption to objects that are uploaded without encryption headers, but it does not prevent unencrypted uploads; a bucket policy denial is the only way to block them outright.

Answer

Enable default encryption on each S3 bucket and create a CloudWatch alarm to notify if unencrypted objects are uploaded.

Answer

Use an S3 bucket policy with a Deny statement for s3:PutObject without encryption applied to all buckets via a single policy.

Answer

Use AWS CloudTrail to monitor PutObject calls and trigger an AWS Lambda function to delete unencrypted objects.

Question 11

A company runs containerized applications on Amazon ECS using the Fargate launch type. The SysOps administrator needs to monitor CPU and memory utilization at the task level. Which AWS service provides pre-built dashboards and metrics for this purpose?

Accepted Answer

Amazon CloudWatch Container Insights. Amazon CloudWatch Container Insights provides pre-built dashboards and metrics specifically for monitoring containerized applications, including CPU and memory utilization at the task level for Amazon ECS with the Fargate launch type. It automatically collects, aggregates, and summarizes metrics and logs from containerized applications, offering out-of-the-box visualizations without requiring custom setup.

Answer

Amazon CloudWatch custom metrics

Answer

Amazon CloudWatch Logs

Answer

Amazon CloudWatch Synthetics

Question 12

A company runs a web application on EC2 instances in an Auto Scaling group. The application uses an Amazon RDS Multi-AZ DB instance. The SysOps administrator notices that during a recent failover test, the application became unresponsive for several minutes. The administrator wants to improve the application's resilience during failover. Which three actions should the administrator take? (Choose THREE.)

Accepted Answer

Configure the Application Load Balancer health checks to have a low threshold (e.g., 2 consecutive failures) and a short interval (e.g., 5 seconds).. Configuring the Application Load Balancer (ALB) health checks with a low threshold (e.g., 2 consecutive failures) and a short interval (e.g., 5 seconds) allows the ALB to quickly detect unhealthy EC2 instances and stop routing traffic to them. This reduces the time the application spends trying to serve requests through failing instances during an RDS failover, improving overall responsiveness.

Answer

Change the RDS DB instance to use asynchronous replication instead of synchronous replication.

Answer

Increase the EC2 instance size to handle more connections during failover.

Question 13

A company hosts a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. Which step should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Verify the target group health check settings.. Intermittent 503 errors from an Application Load Balancer typically indicate that the target instances are failing health checks or are unable to handle the request load. Verifying the target group health check settings (e.g., path, interval, threshold, and protocol) is the first troubleshooting step because if the health checks are misconfigured or the targets are unhealthy, the ALB will stop routing traffic to them, resulting in 503 responses.

Answer

Enable cross-zone load balancing.

Answer

Increase the idle timeout on the load balancer.

Answer

Add more subnets to the load balancer.

Question 14

A SysOps administrator needs to monitor the CPU utilization of an EC2 instance and receive an alert when it exceeds 80% for 10 consecutive minutes. Which AWS service should be used to set up this monitoring and alerting?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it provides the ability to monitor EC2 instance metrics, such as CPU utilization, and create CloudWatch Alarms that trigger when a metric crosses a defined threshold (e.g., 80%) for a specified number of consecutive evaluation periods (e.g., 10 minutes with a 1-minute period). This directly meets the requirement for monitoring and alerting on CPU utilization.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack update fails. What is the simplest way to achieve this?

Accepted Answer

Configure an SNS topic in the CloudFormation stack's notification options.. CloudFormation natively supports specifying an SNS topic in the stack's notification options, which automatically sends notifications on stack events such as failures, without requiring any additional services or custom code. This is the simplest and most direct method to notify the operations team when a stack update fails.

Answer

Enable CloudTrail and create a metric filter for 'UpdateStack' events, then set an alarm.

Answer

Write a script that periodically checks the CloudFormation console for stack status and sends an email.

Answer

Create an Amazon EventBridge rule that matches CloudFormation events and triggers a Lambda function to send an SNS notification.