SOA-C02 Practice Exam 1 — 20 Questions

Question 1

A SysOps administrator is setting up a backup plan for an RDS MySQL database. The database is 500 GB in size and is used for a critical application. The company requires a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the RDS instance in a Multi-AZ configuration with automatic failover.. Multi-AZ RDS with automatic failover meets the RPO of 5 minutes and RTO of 1 hour because it synchronously replicates data to a standby instance in a different Availability Zone. In the event of a failure, Amazon RDS automatically fails over to the standby, typically completing within 60–120 seconds, which satisfies the RTO. The synchronous replication ensures zero data loss (RPO of effectively 0), well within the 5-minute requirement.

Answer

Use AWS Backup to copy snapshots to a different AWS Region.

Answer

Take manual snapshots every 5 minutes and store them in Amazon S3.

Answer

Configure a cross-region read replica and promote it during failover.

Question 2

A company needs to retain API call logs for 7 years for compliance. Which AWS service should be used to store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across your AWS infrastructure and can be configured to store logs in an S3 bucket with lifecycle policies that retain data for 7 years. CloudTrail is specifically designed for auditing and compliance, capturing management and data plane API calls, and supports long-term retention via S3 object locking or lifecycle rules.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 3

A SysOps administrator needs to send a notification when an EC2 instance's CPU utilization exceeds 90% for 5 consecutive minutes. Which AWS service should be used to create the alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms are the correct service because they allow you to monitor a specific metric (e.g., EC2 CPUUtilization) and trigger an action when the metric crosses a defined threshold for a specified number of consecutive evaluation periods. In this case, you can create a CloudWatch alarm with a statistic of 'Average', a threshold of 90%, and set the 'Datapoints to Alarm' and 'Evaluation Periods' to 5 (with a period of 1 minute) to achieve the '5 consecutive minutes' requirement. The alarm can then send a notification via Amazon SNS.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon EventBridge

Question 4

A SysOps administrator notices that an EC2 instance's status check fails intermittently. The instance is part of an Auto Scaling group. What is the most efficient way to automatically recover the instance?

Accepted Answer

Create a CloudWatch alarm on StatusCheckFailed and configure an EC2 recovery action.. Creating a CloudWatch alarm on the StatusCheckFailed metric and configuring an EC2 recovery action (using the 'recover' alarm action) automatically restarts the instance on a new underlying host if a system status check fails. This is the most efficient recovery method for an instance in an Auto Scaling group, as it preserves the instance ID, private IP, and Elastic IP, while Auto Scaling handles only instance replacement if the instance is terminated.

Answer

Increase the Auto Scaling group's cooldown period.

Answer

Terminate the instance and wait for Auto Scaling to launch a new one.

Answer

Place the instance in a different Availability Zone.

Question 5

A SysOps administrator is managing a fleet of EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The administrator notices that the 'SurgeQueueLength' metric for the ALB is frequently high. What does this indicate, and what is the BEST remediation action?

Accepted Answer

The targets are not able to handle the request rate; increase the desired capacity or add scaling policies.. The SurgeQueueLength metric measures the number of requests that are queued by the Application Load Balancer (ALB) because no healthy target is available to process them. A frequently high value indicates that the targets (EC2 instances) are overwhelmed and cannot keep up with the incoming request rate. The best remediation is to increase the desired capacity of the Auto Scaling group or add scaling policies (e.g., based on SurgeQueueLength or RequestCountPerTarget) to automatically add more instances to handle the load.

Answer

The targets are unhealthy; decrease the desired capacity to reduce load.

Answer

The load balancer is accepting too many connections; increase the idle timeout.

Answer

The load balancer is overloaded; replace it with a Network Load Balancer.

Question 6

Which THREE measures help protect an S3 bucket from accidental data loss? (Choose 3)

Accepted Answer

Enable MFA Delete on the bucket.. Enabling MFA Delete on an S3 bucket requires multi-factor authentication for any delete operations, adding an extra layer of protection against accidental or unauthorized deletion of objects. This helps prevent data loss by ensuring that even if credentials are compromised, a delete action cannot be performed without the MFA token.

Answer

Create a lifecycle policy to transition objects to S3 Glacier.

Answer

Enable server-side encryption on the bucket.

Question 7

A company runs a critical production workload on a fleet of EC2 instances managed by an Auto Scaling group. The instances are behind an Application Load Balancer (ALB). Recently, the company experienced a regional outage that caused all instances to become unhealthy. The SysOps administrator must design a solution to automatically recover from such an outage with minimal downtime. The solution must be cost-effective and not require manual intervention. The administrator considers four options. Which option meets the requirements?

Accepted Answer

Create a warm standby environment in another AWS Region with a smaller Auto Scaling group. Use Route53 failover routing to switch traffic.. A regional outage takes down all Availability Zones in a Region, so only a cross-Region strategy can recover. A warm standby environment in another Region with a smaller Auto Scaling group, combined with Route 53 failover routing, provides automatic, low-downtime recovery without manual intervention. This is the AWS-recommended pattern for regional resilience and is more cost-effective than a fully active-active multi-Region deployment.

Answer

Configure the Auto Scaling group to launch instances across multiple Availability Zones and configure the ALB to route traffic to healthy targets.

Answer

Increase the desired capacity of the Auto Scaling group and use larger instance types to absorb the load during failover.

Answer

Use AWS Lambda to periodically check the health of instances and automatically relaunch failed instances in another region.

Question 8

A company runs a critical stateful web application on Amazon EC2 instances in a single AWS region. The application stores user session data in an Amazon ElastiCache for Redis cluster. The SysOps administrator must design a disaster recovery (DR) strategy that can survive a complete regional outage with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The application must be able to redirect users to the DR region with minimal manual effort. Which combination of actions meets these requirements?

Accepted Answer

Create a read replica of the ElastiCache Redis cluster in the DR region using the native cross-region replication feature. Use Route 53 with failover routing to point to the DR region ALB when the primary health check fails. Pre-configure EC2 instances in an Auto Scaling group in the DR region.. ElastiCache for Redis supports cross-region replication via a read replica in the DR region, which can keep session data synchronized with minimal lag, meeting the 15-minute RPO. Route 53 failover routing with health checks on the primary region's ALB automatically redirects traffic to the pre-configured DR region EC2 instances and ALB, achieving the 1-hour RTO with minimal manual effort. Pre-configuring the DR region with an Auto Scaling group ensures compute capacity is ready, while the read replica provides the required data availability.

Answer

Use Amazon Route 53 with weighted routing to distribute traffic between the two regions. Use a global DynamoDB table for session data, and launch EC2 instances in the DR region only when a failure is detected using AWS CloudFormation StackSets.

Answer

Use an Amazon CloudFront distribution with multiple origins (primary and DR). Enable session stickiness at the CloudFront level. Use EC2 instances in both regions behind separate ALBs. No special data replication is needed because sessions are stored in Redis.

Answer

Use EC2 instances with an Auto Scaling group in both regions. Schedule a Lambda function to take snapshots of the Redis cluster every 15 minutes and copy them to the DR region. Use Route 53 latency routing to direct users to the nearest region.

Question 9

A company runs a critical database workload on an Amazon RDS for MySQL DB instance with Multi-AZ deployment in the us-east-1 region. The SysOps administrator must design a disaster recovery strategy that can recover from a complete regional outage. The Recovery Time Objective (RTO) is 2 hours and the Recovery Point Objective (RPO) is 1 hour. Which solution meets these requirements at the lowest cost?

Accepted Answer

Create a cross-Region read replica in another Region and promote it to a standalone DB instance during a disaster.. A cross-Region read replica continuously replicates data from the primary RDS MySQL instance to another Region with minimal lag, typically achieving an RPO of seconds to minutes, well within the 1-hour requirement. Promoting the replica to a standalone instance during a disaster can be done in minutes, meeting the 2-hour RTO. This approach is the lowest cost among the viable options as it uses existing replication infrastructure without additional data transfer fees for snapshots or DMS replication instances.

Answer

Create manual snapshots of the DB instance every hour and copy them to another AWS Region.

Answer

Enable automated backups with a retention period of 35 days and restore to a different Region when needed.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to a DB instance in another Region.

Question 10

An organization wants to ensure that no Amazon S3 bucket in the entire AWS Organization can be made public. The security team requires a preventive control that cannot be overridden by individual account administrators. Which AWS service or feature should be used?

Accepted Answer

Create a Service Control Policy (SCP) in AWS Organizations that denies permissions to modify S3 bucket public access settings.. A Service Control Policy (SCP) in AWS Organizations is a preventive guard that applies to all accounts within the organization. It can explicitly deny actions like s3:PutBucketPublicAccessBlock, s3:PutBucketPolicy, and s3:PutObjectAcl, preventing any principal (including root users) from making S3 buckets public. Unlike detective or account-level controls, SCPs cannot be overridden by individual account administrators, meeting the requirement for a non-overridable preventive control.

Answer

Enable AWS Config rules in each account to detect public S3 buckets and automatically remediate them using AWS Lambda.

Answer

Use an IAM policy attached to all IAM users in each account that denies s3:PutBucketPolicy.

Answer

Apply Amazon S3 Block Public Access at the account level in each individual AWS account.

Question 11

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?

Accepted Answer

Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.. Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.

Answer

Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.

Answer

Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.

Answer

Create a resource-based policy on each EC2 instance that denies access from non-production accounts.

Question 12

A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?

Accepted Answer

Deploy a NAT Gateway in each public subnet. Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.

Answer

Deploy a NAT instance in each private subnet

Answer

Deploy a single NAT Gateway in one public subnet

Answer

Attach an Internet Gateway directly to the private subnets

Question 13

A production RDS MySQL database stores financial records. The team needs the ability to restore the database to any point within the last 7 days in case of accidental data deletion. Automated backups are currently disabled. What must be configured?

Accepted Answer

Enable automated backups and set the backup retention period to 7 days. To restore an RDS MySQL database to any point within the last 7 days, you must enable automated backups and set the backup retention period to 7 days. Automated backups enable point-in-time recovery (PITR), which allows restoration to any second within the retention window using binary logs. Without automated backups, RDS cannot perform PITR, even if manual snapshots exist.

Answer

Create a manual DB snapshot every night using the AWS CLI on a schedule

Answer

Enable Multi-AZ to maintain a synchronous standby replica in a second Availability Zone

Answer

Enable RDS read replicas and promote one if data deletion occurs

Question 14

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Accepted Answer

Misconfigured firewall or iptables. An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Answer

Network connectivity issues

Answer

Detached EBS root volume

Answer

Insufficient memory for applications

Question 15

A SysOps administrator needs to reduce data transfer costs for a web application hosted on EC2 instances in a VPC. The application serves content to users over the internet. Which TWO actions will help reduce data transfer costs? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for Amazon S3 to keep S3 traffic within AWS.. Option B is correct because a VPC Gateway Endpoint for Amazon S3 routes S3 traffic privately within the AWS network instead of through a NAT Gateway or internet gateway, eliminating NAT data processing charges and internet data transfer fees for that traffic. Option C is correct because Amazon CloudFront caches static content at edge locations closer to users, reducing the volume of data transferred out from the EC2 instances and lowering EC2 data transfer out charges. Option A is incorrect because Direct Connect is for private connectivity to AWS, not for serving public internet users, and private subnets do not reduce internet egress costs. Option D is incorrect because an Application Load Balancer distributes traffic but does not by itself reduce data transfer costs and adds LCU charges. Option E is incorrect because a larger NAT Gateway does not lower per-GB NAT data processing charges and may increase cost.

Answer

Move all instances to private subnets and use AWS Direct Connect for user access.

Answer

Use an Application Load Balancer to distribute traffic.

Answer

Use a larger NAT Gateway to improve throughput.

Question 16

A company stores large volumes of log data in Amazon S3. The logs are accessed frequently for the first 30 days, then occasionally for the next 60 days, and after 90 days they are rarely accessed but must be retained for 7 years for compliance. The SysOps administrator wants to minimize storage costs while ensuring data is available when needed. Which S3 lifecycle policy configuration should be applied?

Accepted Answer

Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.. It aligns the lifecycle transitions with the access patterns: frequent access for the first 30 days (S3 Standard), occasional access for the next 60 days (S3 Standard-IA), and rare access after 90 days (S3 Glacier Deep Archive, the lowest-cost storage class for long-term retention). The deletion after 7 years meets compliance requirements while minimizing costs by using progressively cheaper storage classes.

Answer

Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier after 60 days. Delete after 7 years.

Answer

Transition objects to S3 Glacier Deep Archive after 30 days, and delete after 7 years.

Answer

Transition objects to S3 One Zone-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.

Question 17

A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?

Accepted Answer

Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional. A CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.

Answer

Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it

Answer

Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement

Answer

Add a DeletionPolicy: Retain attribute to the RDS resource in the template

Question 18

A company has two Amazon VPCs (VPC-A and VPC-B) in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private IP connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

Accepted Answer

VPC Peering. VPC Peering is the correct solution because it allows direct private IP connectivity between two VPCs in the same AWS Region using the AWS global network backbone, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer charges. Since the VPCs have non-overlapping CIDR blocks, they can be peered without route conflicts, and traffic flows entirely within AWS without traversing the public internet or requiring a transit hub.

Answer

AWS Transit Gateway

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect

Question 19

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The admin has a template that creates an EC2 instance with a custom software stack. The software stack must be installed and configured using PowerShell scripts. The admin wants to minimize operational overhead by automating the creation of an AMI that includes the software stack, and the AMI should be rebuilt on a weekly basis to include the latest security patches. Which combination of AWS services should be used?

Accepted Answer

Use EC2 Image Builder to define a component with the PowerShell scripts, create a recipe, and schedule a pipeline to run weekly.. EC2 Image Builder is purpose-built for automating the creation, patching, and testing of custom AMIs. By defining a component that encapsulates the PowerShell scripts, creating a recipe that references that component, and scheduling a pipeline to run weekly, the administrator achieves fully automated, repeatable AMI builds with minimal operational overhead. This directly meets the requirement for weekly rebuilds with the latest security patches.

Answer

Use AWS Systems Manager Automation to run a PowerShell script on an existing EC2 instance, then manually create an AMI each week.

Answer

Use AWS CodePipeline with CodeBuild to run the PowerShell scripts and create an AMI using the AWS CLI, triggered by a weekly CloudWatch Events schedule.

Answer

Use Amazon EC2 Auto Scaling with a lifecycle hook to run the PowerShell script on instance launch, and schedule a weekly instance refresh.

Question 20

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

Accepted Answer

AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.. AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Answer

AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications.

Answer

Amazon Macie to discover sensitive data and then manually encrypt buckets.