SOA-C02 Practice Test 19 — 15 Questions

Question 1

A company is designing a highly available architecture for a web application. The application uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. Which TWO steps should the company take to ensure the architecture is resilient to an Availability Zone failure? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones.. Launching EC2 instances in at least two Availability Zones (AZs) ensures that if one AZ fails, the Auto Scaling group can continue to serve traffic from instances in the remaining AZ(s). This is a fundamental design pattern for high availability within a single AWS Region, as it distributes the application across physically separate data centers.

Answer

Set the Auto Scaling group's desired capacity to a high number.

Answer

Create a CloudWatch alarm that triggers if the ALB has elevated 5xx errors.

Answer

Use a single EC2 instance type for all instances.

Question 2

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and send an alert when it exceeds 90% for 5 consecutive minutes. Which combination of AWS services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch metric (CPUUtilization), a CloudWatch alarm, and an Amazon SNS topic.. The correct approach is to use a CloudWatch metric for CPUUtilization, which is automatically published by EC2 instances. A CloudWatch alarm can be configured to evaluate this metric over a period of 5 consecutive minutes with a threshold of 90%, and when the alarm state is triggered, it publishes to an SNS topic to send notifications. This is the native, efficient, and recommended method for monitoring and alerting on EC2 CPU utilization.

Answer

Amazon CloudWatch Logs, a metric filter to extract CPU utilization from logs, and an alarm on that metric.

Answer

A CloudWatch dashboard and an AWS Lambda function that checks the dashboard periodically.

Answer

Amazon EventBridge (CloudWatch Events) and a Lambda function that calls the EC2 DescribeInstances API.

Question 3

A SysOps administrator manages a CloudFormation stack that deploys a web application. The stack includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to update the stack to change the EC2 instance type. The administrator wants to ensure that the update does not accidentally replace the RDS database. Which CloudFormation feature should the administrator use to protect the RDS resource from being replaced during the stack update?

Accepted Answer

Use a stack policy that denies updates to the RDS resource.. A stack policy is an AWS CloudFormation feature that explicitly denies update or replacement actions on specified resources. By applying a stack policy that denies updates to the RDS resource, the administrator prevents any stack update operation (including changing the EC2 instance type) from modifying or replacing the database, even if the template changes would otherwise affect it. This is the correct approach because it provides a guardrail specifically against accidental replacement during updates.

Answer

Use a DeletionPolicy of Retain on the RDS resource.

Answer

Use the Resource Signal and CreationPolicy attributes.

Answer

Use a Change Set to review changes before executing.

Question 4

A SysOps team needs to monitor application logs in Amazon CloudWatch Logs for specific error codes and automatically invoke an AWS Lambda function for remediation within 5 minutes of an error occurring. Which solution involves the least operational overhead?

Accepted Answer

Create a CloudWatch metric filter on the log group, create a CloudWatch alarm on the metric, and configure the alarm to post to an SNS topic that triggers the Lambda function.. It uses CloudWatch metric filters and alarms to detect error codes in logs and trigger remediation via SNS and Lambda, all within a fully managed AWS pipeline. This approach requires no custom code or infrastructure to maintain, and the alarm can be configured to evaluate logs within a 1-minute period, easily meeting the 5-minute requirement with minimal operational overhead.

Answer

Create a CloudWatch Logs subscription filter to stream logs directly to an AWS Lambda function.

Answer

Use a third-party log aggregation tool that sends webhook notifications to an API Gateway endpoint to invoke the Lambda function.

Answer

Write a custom script that runs on an EC2 instance to poll CloudWatch Logs every minute and invoke the Lambda function.

Question 5

A company runs a production Amazon DynamoDB table with provisioned capacity of 1000 write capacity units (WCU). The table experiences unpredictable spikes up to 2000 WCU, causing throttling. The SysOps administrator wants to minimize cost while handling the spikes. Which solution should be used?

Accepted Answer

Switch to on-demand capacity mode.. Switching to on-demand capacity mode eliminates throttling during unpredictable spikes by automatically scaling write capacity up to the required 2000 WCU without any manual intervention or pre-provisioning. This minimizes cost because you pay only for the actual reads and writes consumed, avoiding the fixed cost of over-provisioning for peak capacity that may be rarely used.

Answer

Increase provisioned WCU to 2000 to cover the peak.

Answer

Enable DynamoDB Auto Scaling with minimum 1000, maximum 2000 WCU.

Answer

Use a DynamoDB Accelerator (DAX) cache.

Question 6

A company hosts a critical web application on Amazon EC2 instances in a single AWS Region (us-east-1). The SysOps administrator needs to implement a Disaster Recovery (DR) solution using a different AWS Region (us-west-2). The DR plan requires a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The application uses an Amazon Aurora MySQL DB cluster and static assets stored in an Amazon S3 bucket. Which combination of actions should the administrator take to meet these requirements?

Accepted Answer

Create an Aurora cross-Region read replica in us-west-2. Configure S3 Cross-Region Replication from the source bucket to a destination bucket in us-west-2. During DR, promote the read replica to a primary cluster and update DNS.. Aurora cross-Region read replicas provide asynchronous replication with an RPO typically under 1 second, easily meeting the 15-minute RPO requirement. Promoting the read replica to a primary cluster in us-west-2 can be completed within minutes, satisfying the 1-hour RTO. S3 Cross-Region Replication (CRR) automatically replicates static assets to the destination bucket in us-west-2 with near-real-time latency, ensuring the S3 data is also current within the RPO window.

Answer

Take a manual snapshot of the Aurora DB cluster every 15 minutes and copy it to us-west-2. Use S3 batch operations to copy assets to us-west-2 daily.

Answer

Enable Aurora Multi-AZ in us-east-1 and configure S3 transfer acceleration to us-west-2.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to a DB instance in us-west-2. Use S3 versioning to keep previous object versions.

Question 7

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS with a specific customer managed key. Which bucket policy condition should be used to enforce this?

Accepted Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms", "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}. It uses both conditions: 's3:x-amz-server-side-encryption' set to 'aws:kms' ensures that objects are encrypted with SSE-KMS, and 's3:x-amz-server-side-encryption-aws-kms-key-id' set to the specific key ARN ensures that only the designated customer managed key is used. Option A enforces KMS encryption but does not restrict which KMS key, allowing any managed key. Option C enforces a specific key ARN but does not require the encryption header to be present, which could allow objects without encryption if the key ID header is omitted (though in practice, the key ID is only valid with SSE-KMS, the condition alone is not sufficient to guarantee encryption). Option D uses a 'Null' condition incorrectly and would not properly enforce encryption.

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}

Answer

"Condition": {"Null": {"s3:x-amz-server-side-encryption": "false"}}

Question 8

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet has an EC2 instance that needs to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT Gateway is deployed in a private subnet.. A NAT Gateway must be deployed in a public subnet with a route to an Internet Gateway. If the NAT Gateway is in a private subnet, it cannot access the internet, and thus the instances in the private subnet cannot reach the internet via it. Option A is incorrect because network ACLs by default allow all outbound traffic; even if they block HTTP, the instance might still reach other services, but the core issue is the NAT Gateway placement. Option B is incorrect because security groups by default allow all outbound traffic; unless explicitly modified, outbound is not blocked. Option D is incorrect because while a NAT Gateway does require an Elastic IP to communicate with the internet, the more fundamental and likely cause is that the NAT Gateway is in a private subnet, which renders it non-functional regardless of Elastic IP.

Answer

The network ACL for the private subnet blocks outbound HTTP traffic.

Answer

The security group of the EC2 instance blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address.

Question 9

Refer to the exhibit. The alarm has been in INSUFFICIENT_DATA state for several hours. What is the most likely cause?

Accepted Answer

The EC2 instance is stopped or terminated.. The INSUFFICIENT_DATA state for several hours indicates that CloudWatch has not received any metric data points for the specified period. If the EC2 instance is stopped or terminated, the CloudWatch agent stops sending metrics, and the default CPU utilization metric (which is published by AWS, not the agent) also ceases because the instance is no longer running. This causes the alarm to remain in INSUFFICIENT_DATA indefinitely until the instance is started again or the metric resumes.

Answer

The alarm evaluation period is too long.

Answer

The instance has no CloudWatch agent installed.

Answer

The instance is running but the CPU utilization is below the threshold.

Question 10

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes. The SysOps administrator needs to identify the root cause. Which set of CloudWatch metrics should be analyzed first?

Accepted Answer

ALB TargetResponseTime and EC2 CPUUtilization. Intermittent latency spikes in a web application behind an Application Load Balancer (ALB) are most directly investigated by correlating ALB TargetResponseTime (which measures the time taken for the target to respond to the ALB) with EC2 CPUUtilization (which indicates whether the instance is under compute pressure). A spike in TargetResponseTime alongside high CPUUtilization suggests the EC2 instance is struggling to process requests, pointing to a compute bottleneck as the root cause.

Answer

EC2 CPUUtilization and NetworkIn

Answer

EC2 StatusCheckFailed and ALB UnhealthyHostCount

Answer

ALB RequestCount and HealthyHostCount

Question 11

A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.

Answer

Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.

Answer

Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.

Answer

Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.

Question 12

Refer to the exhibit. The command returns no datapoints for CPUUtilization for the specified instance. What is the most likely reason?

Accepted Answer

The instance was stopped or did not emit metrics during the specified time range.. The most likely reason for no datapoints is that the instance was stopped or did not emit metrics during the specified time range. CloudWatch only retains and returns metric data when the instance is running and the CloudWatch agent or EC2 hypervisor is actively publishing CPUUtilization. If the instance was in a stopped state, no metrics are generated, resulting in an empty response from the GetMetricStatistics API call.

Answer

The metric name is incorrect.

Answer

The instance does not have detailed monitoring enabled.

Answer

The period of 300 seconds is too short.

Question 13

A company wants to provide temporary credentials to an application running on an on-premises server so it can access AWS resources. The credentials must be rotated automatically. Which IAM feature should be used?

Accepted Answer

Use IAM Roles Anywhere with a certificate authority to issue temporary credentials.. IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to assume IAM roles and obtain temporary credentials using X.509 certificates. The credentials are automatically rotated by the service. Option A is wrong because an EC2 instance profile can only be used for EC2 instances, not on-premises servers. Option B is wrong: SAML 2.0 federation is typically used for federating user identities (e.g., SSO), not for application or machine identities. Option C is wrong because IAM users with programmatic access have long-term access keys that do not rotate automatically.

Answer

Use an EC2 instance profile and attach it to the on-premises server.

Answer

Configure a SAML 2.0 identity provider and federate the application.

Answer

Create an IAM user with programmatic access and share the access key.

Question 14

An organization is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS DB instance. The update requires changing the DB instance class. However, the administrator wants to minimize downtime. What should the administrator do?

Accepted Answer

Enable Multi-AZ on the DB instance (if not already enabled) before performing the stack update.. Enabling Multi-AZ allows the RDS instance to have a standby in a different Availability Zone. When updating the DB instance class, CloudFormation can modify the standby first, then fail over to it, minimizing downtime. Options A, C, and D are incorrect: A (DeletionPolicy) controls resource retention on stack deletion, not updates; C (ApplyImmediately) may cause a brief outage; D (read replica promotion) is for scaling reads, not for minimizing downtime during instance class changes.

Answer

Use CloudFormation's 'DeletionPolicy' attribute to retain the database during updates.

Answer

Update the stack directly with 'ApplyImmediately' set to true.

Answer

Create a read replica, promote it, and then delete the original DB instance.

Question 15

A SysOps administrator needs to monitor AWS CloudTrail logs for any calls to the 'CreateUser' API in AWS Identity and Access Management (IAM). When such an API call is detected, the administrator wants to receive a notification within a few minutes and also log the event to a central log group in Amazon CloudWatch Logs. The solution should use minimal custom code. Which combination of services should be used?

Accepted Answer

Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.. Amazon EventBridge can directly consume CloudTrail events in near-real time via the 'aws.cloudtrail' event source, allowing you to create a rule that matches the 'CreateUser' API call. This rule can then target both an Amazon SNS topic for immediate notification and a CloudWatch Logs log group for centralized logging, all without custom code.

Answer

Configure AWS CloudTrail to deliver logs to Amazon CloudWatch Logs, create a metric filter for the 'CreateUser' API call, and set up a CloudWatch alarm that sends an Amazon SNS notification.

Answer

Write an AWS Lambda function that is triggered by Amazon S3 events when a new CloudTrail log is delivered to S3. The Lambda parses the log file for 'CreateUser' and if found, sends an SNS notification.

Answer

Enable AWS Config and create a custom rule that evaluates CloudTrail trail configurations for events.