SOA-C02 Practice Test 20 — 15 Questions

Question 1

A SysOps administrator is designing a backup strategy for an Amazon EFS file system. The file system stores critical data that must be recoverable within 15 minutes of a failure. Which solution meets these requirements?

Accepted Answer

Use AWS Backup to create automated backups of the EFS file system and restore to a new file system if needed.. Option A is correct because EFS-to-EFS replication using AWS Backup allows point-in-time recovery and meets the 15-minute RTO. Option B is wrong because lifecycle policies do not create backups. Option C is wrong because Lambda functions must be custom-built. Option D is wrong because EBS snapshots cannot be used for EFS directly.

Answer

Configure EFS lifecycle management to move files to Infrequent Access storage class.

Answer

Take periodic EBS snapshots of the EC2 instance that mounts the EFS volume.

Answer

Create a Lambda function that copies files to an S3 bucket every hour.

Question 2

A company uses Amazon S3 to store backup data. The SysOps administrator needs to ensure that the data is encrypted at rest and that access is limited to only authorized users. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or AWS KMS.. Options A and D are correct. Option A: Enabling S3 default encryption ensures all objects are encrypted at rest. Option D: Using bucket policies with conditions like aws:SourceIp or aws:PrincipalArn restricts access. Option B is wrong because S3 Transfer Acceleration is for faster uploads, not encryption. Option C is wrong because blocking public access is a security best practice but does not guarantee authorized user access. Option E is wrong because versioning is for data protection, not encryption or access control.

Answer

Block all public access to the S3 bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable S3 Transfer Acceleration.

Question 3

A company is designing a backup strategy for its on-premises file servers to AWS. Which TWO services can be used to back up data to AWS? (Choose TWO.)

Accepted Answer

AWS Backup. Correct answers are A and D. AWS Storage Gateway File Gateway provides on-premises caching with backup to S3. AWS Backup can be used for on-premises workloads via the AWS Backup gateway. Option B is wrong because S3 Transfer Acceleration is for speeding up uploads, not a backup service. Option C is wrong because Amazon EFS is a network file system, not a backup target for on-premises. Option E is wrong because Snowball is for large data transfer, not ongoing backups.

Answer

AWS Snowball

Answer

Amazon EFS

Answer

S3 Transfer Acceleration

Question 4

An application running on Amazon ECS with Fargate launch type is experiencing intermittent failures. The tasks are spread across multiple Availability Zones. The SysOps administrator notices that failures occur only when an entire AZ becomes unavailable. What should the administrator do to improve the reliability of the application?

Accepted Answer

Increase the desired task count to ensure sufficient capacity across AZs.. Option A is correct because increasing the number of tasks ensures that even if one AZ fails, tasks in other AZs can handle the load. Option B is incorrect because using more subnets does not necessarily improve availability. Option C is incorrect because placement groups are not applicable to Fargate. Option D is incorrect because EFS is for shared storage, not compute reliability.

Answer

Use multiple subnets in the same AZ.

Answer

Use a cluster placement group.

Answer

Attach an Amazon EFS filesystem to all tasks.

Question 5

A company runs a critical application on EC2 instances in an Auto Scaling group with a minimum of 2 instances. The instances are in a single Availability Zone. The company wants to achieve 99.99% availability. Which change should they make?

Accepted Answer

Modify the Auto Scaling group to launch instances in multiple Availability Zones and place an Application Load Balancer in front.. Option D is correct because using multiple Availability Zones with an Application Load Balancer distributes traffic and provides high availability. Option A is wrong because a single AZ cannot achieve 99.99% availability. Option B is wrong because increasing instance size does not improve availability. Option C is wrong because scaling based on memory does not provide AZ redundancy.

Answer

Increase the minimum size of the Auto Scaling group to 4 instances.

Answer

Use a larger EC2 instance type to handle more traffic.

Answer

Configure the Auto Scaling group to scale based on memory utilization.

Question 6

A company has a production AWS account with multiple VPCs connected via a transit gateway. The security team requires that all cross-VPC traffic be inspected by a centralized network firewall appliance. The firewall is deployed in a dedicated inspection VPC. The SysOps administrator must ensure that traffic from VPC A to VPC B is routed through the inspection VPC. Which configuration achieves this?

Accepted Answer

Configure the transit gateway route tables to propagate a blackhole route for VPC A and VPC B CIDRs to the inspection VPC attachment, then have the firewall forward traffic.. Option D is correct because a blackhole route to the inspection VPC forces traffic to go through it, and then the firewall forwards it. Option A is wrong because NAT gateways do not inspect traffic. Option B is wrong because VPC peering does not route through a central inspection point. Option C is wrong because Security Groups are stateful and not designed for centralized inspection.

Answer

Create a VPC peering connection between VPC A and VPC B, and use route tables to send traffic through the inspection VPC.

Answer

Use security groups in the inspection VPC to filter traffic between VPC A and VPC B.

Answer

Attach a NAT gateway in the inspection VPC and configure route tables in VPC A and B to point to the NAT gateway.

Question 7

A company is designing a highly available web application using an Application Load Balancer (ALB) with EC2 instances in an Auto Scaling group across two Availability Zones. Which configuration ensures that the application remains available if one Availability Zone fails?

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones. Correct answer is B. Distributing instances across multiple Availability Zones ensures that a failure in one zone does not affect the other. Option A is wrong because placing all instances in a single AZ creates a single point of failure. Option C is wrong because using a single instance is not highly available. Option D is wrong because disabling health checks would prevent the ALB from routing traffic away from unhealthy instances.

Answer

Use a single large EC2 instance instead of multiple instances

Answer

Disable health checks on the ALB to avoid false positives

Answer

Launch all EC2 instances in a single Availability Zone

Question 8

A company wants to back up its on-premises file servers to AWS for disaster recovery. The data changes frequently, and the company needs to minimize data loss. Which THREE steps should the company take? (Select THREE.)

Accepted Answer

Use AWS Backup to create backup plans for the Storage Gateway.. Options A, C, and E are correct. AWS Storage Gateway with cached volumes stores data in AWS and caches frequently accessed data locally. Option B is wrong because S3 Transfer Acceleration is for upload speed, not backup. Option D is wrong because S3 Replication is for copying between buckets, not for initial backup.

Answer

Use S3 Transfer Acceleration for uploads.

Answer

Set up S3 Cross-Region Replication from the backup bucket.

Question 9

A team of developers is deploying a new microservice that uses Amazon DynamoDB as its data store. The SysOps administrator must ensure that the application can handle a sudden spike in read traffic without throttling. Which DynamoDB feature can be used to automatically handle increases in read capacity?

Accepted Answer

DynamoDB Auto Scaling. Option A is correct because DynamoDB auto scaling can adjust provisioned read capacity based on traffic. Option B is wrong because DynamoDB Accelerator (DAX) is a caching layer, not capacity scaling. Option C is wrong because global tables are for multi-region replication. Option D is wrong because TTL is for item expiration.

Answer

DynamoDB Global Tables

Answer

DynamoDB Time to Live (TTL)

Answer

DynamoDB Accelerator (DAX)

Question 10

A company uses Amazon Route 53 for DNS. They want to ensure that if the primary web server fails, traffic is automatically routed to a secondary server in another region. Which routing policy should be used?

Accepted Answer

Failover routing policy. Correct answer is C. Failover routing policy allows you to configure active-passive failover. Option A is wrong because simple routing does not support health checks. Option B is wrong because weighted routing distributes traffic based on weights, not failover. Option D is wrong because latency routing routes based on latency, not failover.

Answer

Simple routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 11

A company runs a critical web application on EC2 instances behind an Application Load Balancer across three Availability Zones. The application stores session data in an RDS MySQL database. To improve reliability, the company wants to ensure that a single Availability Zone failure does not impact the application's availability. Which combination of actions should the SysOps administrator take?

Accepted Answer

Deploy RDS in Multi-AZ configuration with automatic failover, and enable cross-zone load balancing on the ALB.. Option C is correct because deploying RDS Multi-AZ with automatic failover ensures that database operations continue during an AZ outage. Enabling cross-zone load balancing ensures the ALB can route traffic to healthy instances in other AZs. Option A is wrong because ELB health checks alone do not handle AZ failures. Option B is wrong because increasing instance size does not provide AZ redundancy. Option D is wrong because increasing the Auto Scaling group's desired capacity does not distribute across AZs if not configured.

Answer

Configure the ALB to use only healthy instances and enable detailed CloudWatch metrics.

Answer

Increase the EC2 instance size to handle more traffic in a single AZ.

Answer

Increase the Auto Scaling group's desired capacity to a larger number.

Question 12

A company has an Auto Scaling group that launches EC2 instances in private subnets. The instances need to download software patches from the internet. Which component must be added to the VPC to allow outbound internet traffic while keeping the instances private?

Accepted Answer

A NAT gateway in a public subnet. Option A is correct because a NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. Option B is wrong because internet gateway alone does not allow private instances to reach the internet. Option C is wrong because VPC peering does not provide internet access. Option D is wrong because an egress-only internet gateway is for IPv6 traffic.

Answer

An internet gateway attached to the VPC

Answer

A VPC peering connection to a VPC with internet access

Answer

An egress-only internet gateway

Question 13

A SysOps administrator is implementing a disaster recovery strategy for an S3 bucket containing critical data. The bucket must be available within 15 minutes if the primary region fails. Data must be replicated with RPO of less than 5 minutes. Which S3 replication configuration should be used?

Accepted Answer

Enable S3 Versioning and S3 Cross-Region Replication (CRR) with replication time control (RTC). Correct answer is D. S3 Same-Region Replication (SRR) is for same-region, not DR. Cross-Region Replication (CRR) replicates to another region with RPO typically minutes. However, to achieve RPO <5 minutes and availability within 15 minutes, CRR is the correct choice. Option A is wrong because SRR does not protect against region failure. Option B is wrong because it uses SRR, which is same-region. Option C is wrong because versioning alone does not replicate to another region.

Answer

Enable S3 Versioning and S3 Same-Region Replication (SRR)

Answer

Enable S3 Versioning and configure S3 Event Notifications to trigger a Lambda function that copies objects to another region

Answer

Enable S3 Versioning and transfer data to another region using AWS DataSync

Question 14

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The Auto Scaling group uses a dynamic scaling policy based on average CPU utilization. During a traffic spike, new instances are launched but take 5 minutes to become healthy. Users experience errors during this time. Which solution would reduce the time to serve traffic from new instances?

Accepted Answer

Use a launch template with a pre-provisioned AMI.. Option C is correct because a launch template with a pre-warmed AMI avoids the initialization steps during scale-out. Option A is incorrect because increasing the cooldown period delays scaling, making the problem worse. Option B is incorrect because instance type does not affect startup time significantly. Option D is incorrect because lifecycle hooks add delay, not reduce it.

Answer

Add a lifecycle hook to delay instance termination.

Answer

Increase the cooldown period for the scaling policy.

Answer

Use a larger instance type.

Question 15

A company uses AWS Backup to back up its Amazon EFS file system daily. The backup retention policy is set to 30 days. Recently, a user accidentally deleted a critical directory. The company wants to restore the directory as it existed 2 days ago. What is the MOST cost-effective and quickest way to achieve this?

Accepted Answer

Restore the backup from 2 days ago to a new EFS file system, then copy the directory to the original file system.. Option B is correct because AWS Backup creates recovery points that can be restored to a new EFS file system, and then the specific directory can be copied. Option A is wrong because EFS does not have a native trash feature. Option C is wrong because enabling EFS replication is not a backup replacement and does not provide point-in-time recovery. Option D is wrong because restoring to an on-premises server is unnecessary and slower.

Answer

Use the EFS console to recover the directory from the .Trash folder.

Answer

Enable EFS replication to another region and then fail back.

Answer

Use AWS Backup to restore the entire file system to an on-premises server, then copy the directory back.