SOA-C02 Practice Exam 2 — 20 Questions

Question 1

A company uses AWS CloudTrail to record all API activity. The SysOps administrator needs to be alerted in real time when an IAM user creates a new access key. Which combination of AWS services should be used to create this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CloudTrail + Amazon EventBridge + Amazon SNS. Amazon EventBridge can directly consume CloudTrail events in real time and trigger an SNS notification when an IAM user creates a new access key. EventBridge provides a serverless event bus that matches specific API calls (e.g., CreateAccessKey) using event patterns, enabling immediate alerting without additional polling or log processing.

Answer

CloudTrail + Amazon S3 + Amazon SNS

Answer

CloudTrail + Amazon CloudWatch Logs + Amazon SNS

Answer

CloudTrail + AWS Config + Amazon SNS

Question 2

A company has two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The SysOps administrator needs to establish connectivity between these VPCs so that resources in VPC-A can reach resources in VPC-B using private IP addresses. The solution must be highly available and not involve a third-party appliance. Which solution should the administrator implement?

Accepted Answer

Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.. VPC Peering provides direct, private IP connectivity between two VPCs using the AWS global network, with no bandwidth bottleneck or single point of failure. By creating a peering connection and adding routes to the other VPC's CIDR in each VPC's route table, resources can communicate privately and the solution is highly available as the peering connection itself is redundant within AWS's infrastructure. No third-party appliance is required, and the setup is fully managed by AWS.

Answer

Create an AWS Transit Gateway and attach both VPCs to it. Configure route tables to allow communication.

Answer

Attach an internet gateway to each VPC and use Amazon Route 53 to resolve private DNS names over the internet.

Answer

Set up a site-to-site VPN connection between the two VPCs using AWS Virtual Private Gateway.

Question 3

A company runs a critical application on Amazon EC2 instances across multiple Availability Zones. The application stores state data on a shared Amazon EFS file system. The SysOps administrator needs to ensure that the file system remains available if an entire Availability Zone fails. The file system must also provide low-latency access from all instances. Which configuration meets these requirements?

Accepted Answer

Create an EFS file system with the Standard storage class in the same Region, and mount it from all instances using the regional mount target.. The EFS Standard storage class stores data redundantly across multiple Availability Zones (AZs) within a Region, ensuring high availability and durability even if an entire AZ fails. By mounting the file system using the regional mount target (which resolves to the EFS file system's regional DNS name), instances in any AZ can access the file system with low latency, as EFS automatically routes traffic to the most appropriate mount target in the same AZ. This configuration meets both the availability and low-latency requirements without additional replication or failover complexity.

Answer

Create an EFS file system with the One Zone storage class and mount it from all instances.

Answer

Create an EFS file system with the Standard storage class, enable replication to another Region, and use DNS failover.

Answer

Create an EFS file system with the Standard storage class, and enable Multi-AZ deployment.

Question 4

A company runs a batch processing application on Amazon EC2 instances every night. The job takes exactly 1 hour to complete and is time-sensitive. The SysOps administrator wants to minimize compute costs while ensuring the job can be interrupted and resumed if needed. Which EC2 purchasing option is most cost-effective?

Accepted Answer

Spot Instances. Spot Instances are the most cost-effective option because the batch job is fault-tolerant (can be interrupted and resumed) and runs for exactly 1 hour nightly. Spot Instances offer up to 90% discount compared to On-Demand, and with the ability to handle interruptions via checkpointing, they meet the requirement for cost minimization while supporting resumption.

Answer

On-Demand Instances

Answer

Reserved Instances (Standard 1-year)

Answer

Dedicated Hosts

Question 5

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS Systems Manager

Question 6

A SysOps administrator needs to monitor the health of an Amazon RDS for MySQL DB instance. The administrator wants to receive an alert when the database connection count exceeds a threshold of 500 for more than 5 minutes. Which AWS service should be used to create this alert?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it can monitor RDS metrics such as DatabaseConnections and trigger an alarm when the value exceeds a threshold of 500 for a specified duration (e.g., 5 consecutive evaluation periods). CloudWatch alarms evaluate metric data against a defined threshold and can then publish to an SNS topic to send notifications.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS CloudTrail

Answer

AWS Config

Question 7

A SysOps administrator needs to deploy the same AWS CloudFormation template across multiple AWS accounts and Regions in a single operation. The administrator wants to manage the deployment from a single management account. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy the same template across multiple accounts and Regions from a single management account. StackSets uses a self-managed or service-managed permission model to create, update, and delete stacks across target accounts in a single operation, making it the correct choice for this multi-account, multi-Region deployment requirement.

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS Service Catalog

Question 8

A SysOps administrator needs to monitor application logs in Amazon CloudWatch Logs for the occurrence of the string 'ERROR'. The administrator wants to create a custom metric that counts the number of 'ERROR' occurrences per 5-minute window and trigger an Amazon CloudWatch alarm when the count exceeds 10. Which action should the administrator take to create the custom metric?

Accepted Answer

Create a metric filter on the CloudWatch Logs log group that matches the term 'ERROR'.. Metric filters in CloudWatch Logs allow you to define a pattern (e.g., 'ERROR') that is evaluated against incoming log events. The filter counts occurrences and publishes a custom metric to CloudWatch, which can then be used to set an alarm with a period of 5 minutes and a threshold of 10.

Answer

Create a CloudWatch Events rule that triggers on 'ERROR' and publishes a metric.

Answer

Create a CloudWatch dashboard that displays the log group and set an alarm on the dashboard.

Answer

Enable AWS CloudTrail on the log group and select the 'ERROR' pattern.

Question 9

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The error message indicates that an IAM role creation failed because the role already exists. The administrator wants to ensure the stack creation can proceed without manual intervention. What should the administrator do?

Accepted Answer

Modify the template to use a unique name for the IAM role.. The error indicates a naming conflict: the IAM role name in the template already exists in the account. By modifying the template to use a unique name (e.g., appending a random string or using `AWS::NoValue` with `Fn::Sub`), CloudFormation can create the role without conflicting with the existing resource. This approach avoids manual intervention and allows the stack creation to proceed automatically.

Answer

Use the 'Retain' deletion policy on the IAM role resource.

Answer

Manually delete the existing IAM role and retry the stack creation.

Answer

Use a stack policy to prevent the creation of the IAM role.

Question 10

A SysOps administrator needs to ensure that an EC2 instance automatically recovers from an underlying hardware failure. Which configuration should be used?

Accepted Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure the recovery action.. A CloudWatch alarm on the StatusCheckFailed metric can be configured with an EC2 recovery action. When the alarm triggers (e.g., due to an underlying hardware failure), the recovery action automatically stops and starts the instance on healthy hardware, preserving the instance ID, private IP, Elastic IP, and EBS attachments. This is the native AWS mechanism for automatic instance recovery from hardware failures.

Answer

Use AWS Lambda to periodically check instance health and reboot if necessary.

Answer

Enable termination protection on the instance.

Answer

Place the instance in an Auto Scaling group with a minimum size of 1.

Question 11

A SysOps administrator needs to automatically deploy a new version of an application to a fleet of Amazon EC2 instances every time changes are pushed to the main branch of a code repository hosted on AWS CodeCommit. Which combination of AWS services should be used?

Accepted Answer

AWS CodePipeline, AWS CodeBuild, and AWS CodeDeploy.. AWS CodePipeline orchestrates the continuous delivery workflow by detecting changes in the CodeCommit repository, then automatically triggering AWS CodeBuild to compile and package the application, and finally deploying the new version to EC2 instances using AWS CodeDeploy. This combination provides a fully managed, end-to-end CI/CD pipeline that meets the requirement of deploying on every push to the main branch.

Answer

AWS CloudFormation and AWS CodeDeploy.

Answer

Amazon EventBridge and AWS Systems Manager.

Answer

AWS CloudTrail and AWS Lambda.

Question 12

A company requires that all Amazon EC2 instances launched in its AWS account must have termination protection enabled. The SysOps administrator needs to automatically remediate any instance launched without termination protection. The solution should use AWS managed services without custom scripts. Which AWS service should be used?

Accepted Answer

Configure AWS Config with a managed rule 'ec2-termination-protection-check' and set an auto-remediation action using an AWS Systems Manager Automation document that enables termination protection on the instance.. AWS Config's managed rule 'ec2-termination-protection-check' can detect instances without termination protection, and you can attach an auto-remediation action using an AWS Systems Manager Automation document (e.g., AWS-EnableTerminationProtection) to automatically enable termination protection on noncompliant instances. This solution uses only AWS managed services and requires no custom scripts, meeting the company's requirements.

Answer

Use Amazon EC2 Auto Scaling to automatically apply termination protection to all launched instances.

Answer

Enable AWS Trusted Advisor to send notifications when instances lack termination protection, and have administrators manually fix them.

Answer

Create an IAM policy that denies the RunInstances action unless termination protection is enabled.

Question 13

A company wants to enforce that all IAM users in an AWS account must use multi-factor authentication (MFA) to access the AWS Management Console. Which IAM policy effect should be used to deny access if MFA is not present?

Accepted Answer

Deny with a condition that aws:MultiFactorAuthPresent is false. The IAM policy must explicitly deny access when MFA is not present. By using a Deny effect with the condition aws:MultiFactorAuthPresent set to false, any request that does not include MFA authentication is blocked. This is the standard approach to enforce MFA usage, as IAM policies default to an implicit deny, but an explicit Deny overrides any Allow that might otherwise grant access.

Answer

Allow with a condition that aws:MultiFactorAuthPresent is false

Answer

Allow with a condition that aws:MultiFactorAuthPresent is true

Answer

Deny with a condition that aws:MultiFactorAuthPresent is true

Question 14

A company uses Amazon CloudFront to deliver content to a global audience. The origin is an Application Load Balancer in us-east-1. The SysOps administrator wants to reduce costs by minimizing the number of requests that reach the origin server. Which action should the administrator take?

Accepted Answer

Enable CloudFront Origin Shield.. CloudFront Origin Shield acts as an additional caching layer in front of the origin, reducing the load on the origin by consolidating requests from multiple edge locations. This minimizes the number of requests that reach the Application Load Balancer, directly lowering origin request costs and improving cache hit ratio.

Answer

Configure multiple origins for failover.

Answer

Enable CloudFront Web Application Firewall (WAF) integration.

Answer

Increase the cache TTL for CloudFront distributions.

Question 15

A company runs a critical application on a fleet of EC2 instances that process real-time financial transactions. The application requires consistent low latency. The SysOps administrator notices that the application's latency increases periodically due to noisy neighbors. The administrator wants to optimize performance predictability. Which instance type should the administrator choose?

Accepted Answer

Dedicated Instances. Dedicated Instances run on hardware dedicated to a single customer, eliminating the noisy-neighbor problem because no other AWS accounts share the underlying physical host. This provides the performance predictability required for consistent low-latency financial transaction processing.

Answer

Burstable Performance Instances (T3)

Answer

Spot Instances

Answer

Reserved Instances

Question 16

A company runs a batch processing application on Amazon EC2 instances. The application runs for 3 hours every night and can tolerate interruptions. The SysOps administrator needs to minimize compute costs. Which purchasing option should the administrator use?

Accepted Answer

Spot Instances. Spot Instances are ideal for this workload because the application is fault-tolerant (can tolerate interruptions) and runs on a fixed schedule (3 hours nightly). Spot Instances offer significant cost savings (up to 90% compared to On-Demand) by using spare EC2 capacity, and the batch processing can be designed to resume from checkpoints if interrupted.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances

Question 17

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an alert if it exceeds 80% for 10 consecutive minutes. The instance is in a VPC with no Internet access. What is the MOST efficient way to meet these requirements?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and an evaluation period of 2.. A CloudWatch alarm with a period of 5 minutes and an evaluation period of 2 means the alarm evaluates two consecutive 5-minute data points, totaling 10 minutes. Since the EC2 instance is in a VPC with no Internet access, CloudWatch metrics are still reported via the CloudWatch service endpoint within the VPC (or via VPC endpoints), so no additional agent or script is needed. This is the most efficient approach as it uses native CloudWatch functionality without requiring any custom scripts or additional software.

Answer

Use AWS Systems Manager to run a script on the instance that checks CPU and sends an SNS notification.

Answer

Enable detailed monitoring on the EC2 instance and create a CloudWatch alarm on the CPUUtilization metric.

Answer

Install the CloudWatch agent on the EC2 instance to collect CPU metrics and create a CloudWatch alarm.

Question 18

A company needs a dedicated private network connection from its on-premises data center to AWS that provides consistent network performance and high bandwidth. The connection must bypass the public internet. Which AWS service should the SysOps administrator use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet entirely. This ensures consistent network performance, low latency, and high bandwidth, which are critical for workloads requiring predictable throughput and a private link.

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Question 19

A company's security policy requires that all new Amazon S3 buckets must have server-side encryption with AWS Key Management Service (SSE-KMS) enabled by default. A SysOps administrator wants to enforce this requirement for all current and future S3 buckets in the account. Which AWS service or feature should be used to automatically apply this configuration?

Accepted Answer

Use AWS Config with the 's3-bucket-server-side-encryption-enabled' managed rule and configure automatic remediation to apply SSE-KMS when a non-compliant bucket is detected.. AWS Config with the 's3-bucket-server-side-encryption-enabled' managed rule can evaluate S3 buckets for compliance with server-side encryption requirements. When a non-compliant bucket is detected, automatic remediation can be configured to apply SSE-KMS using an AWS Systems Manager Automation document, ensuring all current and future buckets meet the security policy without manual intervention.

Answer

Enable S3 default encryption at the account level in the S3 console.

Answer

Create an AWS CloudTrail trail that captures S3 API calls and triggers a Lambda function to enable encryption on any bucket that is created without it.

Answer

Use an AWS Organizations Service Control Policy (SCP) to deny the s3:PutBucketPublicAccessBlock action, forcing users to enable encryption.

Question 20

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The data center has multiple VLANs that need to connect to separate VPCs in AWS. The company wants to maintain isolation between the VPCs while maximizing bandwidth utilization. Which solution should the SysOps administrator recommend?

Accepted Answer

Configure a single Direct Connect connection with multiple private virtual interfaces, each tagged with a different VLAN ID and associated with a different VPC.. A single Direct Connect connection can support multiple private virtual interfaces (VIFs), each tagged with a unique 802.1Q VLAN ID. This allows the on-premises data center to connect to separate VPCs while maintaining traffic isolation via VLAN tagging, and it maximizes bandwidth utilization by sharing the single connection's capacity across all VIFs.

Answer

Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway, then configure route tables to isolate traffic.

Answer

Provision multiple Direct Connect connections, one for each VPC, and use a different VLAN on each connection.

Answer

Establish a single Direct Connect connection and use IPsec VPN tunnels over it to connect to each VPC.