SOA-C02 Practice Exam 2 — 20 Questions

Question 1

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS Systems Manager

Question 2

An application running on EC2 instances occasionally throws 'Connection refused' errors when connecting to an RDS database. The SysOps administrator needs to determine if the issue is due to database connection limits or network security groups. Which metrics and logs should the administrator examine?

Accepted Answer

Examine the RDS CloudWatch metric DatabaseConnections and analyze VPC Flow Logs for the EC2 instance's network interface.. 'Connection refused' errors typically stem from either the database exhausting its maximum connections or network-level security groups blocking traffic. The RDS CloudWatch metric `DatabaseConnections` directly shows the current number of active connections against the instance's `max_connections` limit, while VPC Flow Logs capture whether packets are being accepted or rejected by security groups or network ACLs, pinpointing network blockages.

Answer

Check CloudWatch RDS CPUUtilization and CloudTrail logs for RDS API calls.

Answer

Review RDS error logs in CloudWatch Logs and check the EC2 instance's system log.

Answer

Look at the EC2 instance's CloudWatch NetworkIn and NetworkOut metrics and RDS FreeableMemory metric.

Question 3

A company wants to establish a dedicated, low-latency, private connection between its on-premises data center and an AWS VPC. The company does not want to use the public internet. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, low-latency network connection from an on-premises data center to AWS, bypassing the public internet entirely. It uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a VPC, ensuring consistent network performance and reduced latency.

Answer

AWS Virtual Private Gateway

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 4

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Windows Server. Which steps are required to collect memory metrics?

Accepted Answer

Install and configure the Amazon CloudWatch agent on the instance.. Amazon CloudWatch does not collect memory metrics from EC2 instances by default; it only captures hypervisor-level metrics such as CPU, network, and disk I/O. To monitor in-guest memory utilization on a Windows Server instance, you must install and configure the Amazon CloudWatch agent, which sends custom metrics (e.g., Memory % Committed Bytes In Use) to CloudWatch. The agent uses the Windows Performance Monitor (PerfMon) counters to gather this data.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and use Run Command.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Use the AWS Management Console to enable memory monitoring.

Question 5

A company uses CloudWatch Logs to collect application logs from EC2 instances. The logs are critical for troubleshooting. The operations team notices that some log entries are missing during peak hours. The CloudWatch Logs agent is configured with a batch size of 1 MB and a batch timeout of 10 seconds. Which TWO actions should the administrator take to reduce the chance of missing log events?

Accepted Answer

Increase the batch size to 5 MB.. Increasing the batch size from 1 MB to 5 MB allows the CloudWatch Logs agent to buffer more log data before sending a request. During peak hours, log volume spikes can cause the agent to drop events if the batch fills up faster than it can be transmitted. A larger batch size reduces the frequency of API calls and helps ensure that all log entries are successfully delivered.

Answer

Use PutLogEvents directly from the application.

Answer

Reduce the retry count for failed requests.

Answer

Increase the batch timeout to 30 seconds.

Question 6

A SysOps administrator is creating an AWS CloudFormation template to deploy a web application. The template will create an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The administrator wants to ensure that the Auto Scaling group is created only after the ALB and the RDS database are fully created and available. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources.. To ensure the Auto Scaling group is created only after both the ALB and RDS database are fully available, the administrator should add a DependsOn attribute to the Auto Scaling group that lists both the ALB and RDS resources (Option B). This ensures CloudFormation creates the group after those resources. Additionally, a CreationPolicy on the RDS database resource (Option D) can be used to wait for a signal (e.g., from a cfn-signal script) indicating that the database is fully operational and accepting connections, ensuring it is 'fully available' before the Auto Scaling group creation proceeds. Option A is incorrect because it only lists the ALB, ignoring RDS. Option C is irrelevant for creation order. Option E addresses instance signaling, not resource creation.

Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists only the ALB resource.

Answer

Add an UpdatePolicy to the Auto Scaling group resource to wait for a signal.

Answer

Add a CreationPolicy to the Auto Scaling group resource to wait for a signal from the instances.

Question 7

A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 privately without needing a NAT Gateway or internet gateway. Option A is incorrect because a NAT Gateway requires an internet gateway and does not provide private access. Option C is incorrect because S3 Transfer Acceleration is for faster transfers over the internet, not private connectivity. Option D is incorrect because although a VPC Interface Endpoint can also provide private access to S3, the Gateway Endpoint is the recommended solution for S3 due to lower cost and simpler configuration.

Answer

Set up a NAT Gateway in a public subnet and route traffic through it.

Answer

Use S3 Transfer Acceleration.

Answer

Create a VPC Interface Endpoint for S3.

Question 8

A SysOps Administrator manages a VPC with public and private subnets. The private subnets need to access the internet for software updates. The Administrator creates a NAT Gateway in a public subnet and updates the private subnet route table to point 0.0.0.0/0 to the NAT Gateway. However, instances in the private subnet still cannot reach the internet. What is the MOST likely reason?

Accepted Answer

The NAT Gateway does not have an Elastic IP address assigned.. A NAT Gateway must have an Elastic IP (EIP) address assigned to it in order to function as an internet gateway for private subnets. Without an EIP, the NAT Gateway cannot communicate with the internet. Option A is unlikely because security groups allow outbound traffic by default. Option B is incorrect because the internet gateway attaches to the VPC, not to the NAT Gateway. Option D is incorrect because NAT Gateways do not have security groups; they use network ACLs at the subnet level, but the issue here is the missing EIP.

Answer

The security group on the private instances blocks outbound HTTPS traffic.

Answer

The internet gateway is not attached to the NAT Gateway.

Answer

The NAT Gateway's security group is blocking inbound traffic from the private subnet.

Question 9

A SysOps administrator needs to reduce data transfer costs for a web application hosted on EC2 instances in a VPC. The application serves content to users over the internet. Which TWO actions will help reduce data transfer costs? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for Amazon S3 to keep S3 traffic within AWS.. The correct answers are B and C. Using a VPC Gateway Endpoint for Amazon S3 allows instances to access S3 over the AWS network without traversing the internet, reducing data transfer costs. Amazon CloudFront caches content at edge locations worldwide, so users receive content from edge locations instead of the EC2 origin, reducing data transfer from EC2 to the internet. Option A is incorrect because migrating to private subnets and using AWS Direct Connect does not serve users over the internet; Direct Connect is a dedicated network connection that does not reduce data transfer costs for internet users. Option D is incorrect because an Application Load Balancer distributes traffic but does not inherently reduce data transfer costs; it may even add cost. Option E is incorrect because a larger NAT Gateway increases cost and does not reduce data transfer costs for outbound traffic.

Answer

Move all instances to private subnets and use AWS Direct Connect for user access.

Answer

Use an Application Load Balancer to distribute traffic.

Answer

Use a larger NAT Gateway to improve throughput.

Question 10

A company runs a batch processing job every night that takes 2 hours on a single m5.xlarge EC2 instance. The job is fault-tolerant and can be interrupted. The SysOps administrator wants to reduce costs. Which solution is MOST cost-effective?

Accepted Answer

Use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available.. The most cost-effective solution is to use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available (Option B). The job is fault-tolerant and can be interrupted, making it ideal for Spot Instances which offer significant cost savings (up to 90% compared to On-Demand). The Spot Fleet with an On-Demand fallback ensures the job completes even if Spot capacity is unavailable. Option A (On-Demand with CloudWatch alarm) does not reduce costs since On-Demand is more expensive. Option C (Dedicated Host) is costly and unnecessary for a batch job. Option D (Reserved Instance) requires a 1- or 3-year commitment and is not cost-effective for a 2-hour daily job.

Answer

Use an On-Demand instance and set up a CloudWatch alarm to stop it when the job completes.

Answer

Use a Dedicated Host to run the job.

Answer

Purchase a Reserved Instance for the m5.xlarge instance.

Question 11

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 12

A company runs a production web application on a single Amazon EC2 instance. The application experiences a predictable and steady workload 24/7. The SysOps administrator wants to minimize compute costs for this instance while ensuring it remains available during the expected workload. Which EC2 purchasing option should the administrator use?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the most cost-effective option for a predictable, steady-state workload running 24/7. By committing to a 1- or 3-year term, you receive a significant discount (up to 72%) compared to On-Demand pricing, while still ensuring the instance remains available for the expected workload. This matches the requirement to minimize compute costs without sacrificing availability.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 13

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 14

A company wants to receive alerts when its AWS costs exceed a certain threshold. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets and receive alerts when actual or forecasted costs exceed a defined threshold. It directly supports cost-based alerting with actions such as sending an SNS notification or applying an IAM policy to restrict resources when the budget limit is breached.

Answer

Amazon CloudWatch

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 15

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

Accepted Answer

Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.. A KMS key policy can use the 'aws:SourceVpc' condition key to restrict usage of the key to requests originating from a specific VPC. Option A is incorrect because S3 bucket policies cannot directly restrict KMS key usage; they can only control access to S3 objects. Option C is incorrect because IAM policies can include conditions based on source VPC for certain services, but for KMS actions, the condition must be in the key policy itself, not an IAM policy. Option D is incorrect because network ACLs operate at the subnet level and control network traffic, not API calls to KMS; they cannot restrict access to the KMS service.

Answer

Add a condition in the S3 bucket policy to allow only requests from the VPC.

Answer

Use an IAM policy with a condition that requires the request to come from the VPC.

Answer

Configure a network ACL that blocks all traffic to KMS except from the VPC.

Question 16

A company is using Amazon S3 to store historical data. The data is accessed frequently for the first 30 days, then accessed infrequently for the next 90 days, and after 120 days it is rarely accessed but must be retained for 7 years for compliance. Which S3 lifecycle policy provides the LOWEST cost while meeting these requirements?

Accepted Answer

Standard for 30 days, then transition to Standard-IA for 90 days, then to Glacier Deep Archive.. It aligns the storage class transitions precisely with the access patterns: Standard for frequent access (first 30 days), Standard-IA for infrequent access (next 90 days), and Glacier Deep Archive for long-term retention (after 120 days). This minimizes cost by avoiding paying for premium storage when data is rarely accessed, while still meeting the 7-year compliance requirement at the lowest possible storage cost.

Answer

Standard for 30 days, then transition to One Zone-IA for 90 days, then to Glacier Deep Archive.

Answer

Standard for 120 days, then transition to Glacier Deep Archive.

Answer

Standard for 30 days, then transition to Glacier for the remaining life.

Question 17

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

Accepted Answer

AWS Config with a custom rule and AWS Lambda. AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Answer

AWS CloudTrail and Amazon CloudWatch Events

Answer

AWS Service Catalog and AWS Organizations

Answer

Amazon Inspector and AWS Systems Manager

Question 18

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

Accepted Answer

Perform a rolling update based on health.. A rolling update based on health (Option D) is the correct method to minimize downtime when updating an instance type in Elastic Beanstalk. This approach updates instances in batches, replacing them with the new instance type only after the previous batch passes health checks, ensuring application availability throughout the process. Elastic Beanstalk's rolling update with health-based batching terminates and launches instances incrementally, avoiding full environment disruption.

Answer

Terminate all instances and let the Auto Scaling group launch new ones.

Answer

Perform an immutable update.

Answer

Clone the environment with the new configuration and swap URLs.

Question 19

A SysOps administrator is investigating a cost increase in a production AWS account. They notice that an EC2 instance with a Reservation has been running continuously for months. The instance type is m5.large in us-east-1. The administrator sees that the instance is using a Standard Reserved Instance (RI) that was purchased 6 months ago for a 1-year term. However, the current utilization shows that the instance is only used for 4 hours per day. What should the administrator do to optimize costs without affecting availability?

Accepted Answer

Modify the existing RI to a smaller instance size (e.g., m5.large to m5.xlarge? no, smaller: e.g., t3.medium) and use Auto Scaling with a schedule to start/stop the instance during business hours.. By modifying the existing Standard RI to a smaller instance size (e.g., within the same family or by converting to a Convertible RI to allow family changes), the administrator can better match the actual low utilization pattern. Additionally, using Auto Scaling with a scheduled scaling policy to start and stop the instance during business hours ensures availability during needed times and reduces waste. Option A is incorrect because stopping the instance does not stop the RI charges; Reserved Instance benefits are applied only to running instances, so the RI would be wasted during off-hours. Option B is incorrect because selling the RI on the Reserved Instance Marketplace typically incurs a loss of the upfront payment and does not directly address the over-provisioning issue. Option D is incorrect because converting to a larger instance family would increase compute capacity per hour, leading to higher costs and even more waste given the low utilization.

Answer

Stop the instance during off-hours using Instance Scheduler, but keep the RI as-is.

Answer

Sell the current RI on the Reserved Instance Marketplace and purchase a new Convertible RI for a smaller instance type.

Answer

Convert the RI to a Convertible RI and exchange it for a larger instance family to get more compute per hour.

Question 20

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. The first thing to check when private instances cannot reach an external service is the route table for the private subnet. The private subnet must have a route 0.0.0.0/0 pointing to the NAT Gateway to route internet-bound traffic through it. Option B is incorrect because the NAT Gateway must have an Elastic IP to be reachable from the internet, but the issue described is outbound access from private instances; the NAT Gateway's Elastic IP is necessary but not the first check. Option C is incorrect because security groups for NAT Gateways are not used; NAT Gateways do not have security groups; instead, network ACLs on the subnets control traffic. Option D is incorrect because the internet gateway must be attached to the VPC for the NAT Gateway to work, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.