SOA-C02 Practice Exam 3 — 20 Questions

Question 1

A SysOps team manages a fleet of EC2 instances used for batch processing. The workload runs daily, taking approximately 6 hours. The instances are launched via an Auto Scaling group using On-Demand instances from a custom AMI. The team has noticed that while the instances are running, the CPU utilization is moderate, but the memory usage is high. After the batch completes, the instances are terminated. The team wants to reduce costs without changing the architecture. Which solution would be MOST cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the Auto Scaling group to use a mixed instances policy with a percentage of Spot Instances and a fallback to On-Demand.. Spot Instances can provide significant discounts (up to 90%) for fault-tolerant batch workloads, and the team can use a mixed instances policy with On-Demand as a fallback. Option B (memory optimized instances) would likely increase cost. Option C (reserved instances) is not suitable for short-lived, sporadic workloads. Option D (savings plan) could help but still requires committing to a consistent amount, which may not align with the varying batch size. Option A offers the most flexibility and cost savings.

Answer

Use a Compute Savings Plan covering the entire compute usage across the account.

Answer

Change the instance type to a memory-optimized family to reduce the number of instances needed.

Answer

Purchase Reserved Instances for the expected daily usage to get a lower hourly rate.

Question 2

A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?

Accepted Answer

Private subnet route table with a route to the NAT Gateway. The correct answers are D and E. A NAT Gateway placed in a public subnet (E) provides outbound internet access for instances in private subnets. The private subnet's route table must have a route pointing to the NAT Gateway (D) for internet-bound traffic. VPC Peering (A) connects VPCs but does not provide internet access. An Internet Gateway (C) attached to the VPC enables internet access for public subnets, but private subnets should not have a direct route to it. Option B (private route to IGW) would make the subnet public, violating the requirement. Therefore, D and E together provide the desired outbound-only internet access.

Answer

VPC Peering connection

Answer

Private subnet route table with a route to the Internet Gateway

Answer

Internet Gateway attached to the VPC

Question 3

A SysOps administrator notices that an S3 bucket's storage costs have increased significantly. The bucket stores log files and is configured with S3 Standard storage class. Most logs are accessed only once after 30 days. Which action will reduce costs without affecting data retrieval?

Accepted Answer

Create a lifecycle policy to transition objects to S3 Glacier Instant Retrieval after 30 days.. Transitioning to S3 Glacier Instant Retrieval after 30 days reduces storage cost while maintaining millisecond access. Option A is wrong because S3 Standard-IA has retrieval fees that might increase cost for single access. Option B is wrong because S3 Glacier Deep Archive has long retrieval times (hours), making it unsuitable for logs that may need to be accessed occasionally. Option D is wrong because S3 One Zone-IA is less durable (does not replicate across AZs) and may not be appropriate for log data.

Answer

Create a lifecycle policy to transition objects to S3 Standard-IA after 30 days.

Answer

Create a lifecycle policy to transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Create a lifecycle policy to transition objects to S3 One Zone-IA after 30 days.

Question 4

A SysOps administrator is investigating a security breach. An IAM user 'Bob' is suspected of performing unauthorized actions. The administrator needs to determine the source IP addresses from which Bob's access keys were used in the last 30 days. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail event history.. AWS CloudTrail event history provides a record of all API calls made by IAM users, including the source IP address from which the request originated. By filtering the event history for the IAM user 'Bob' and the time range of the last 30 days, the administrator can identify the source IP addresses associated with each API call made using Bob's access keys. This directly meets the requirement to determine the source IP addresses of unauthorized actions.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Answer

AWS IAM credential report.

Question 5

A company wants to ensure that its Amazon RDS database can withstand the loss of an entire Availability Zone. Which feature should the SysOps administrator enable?

Accepted Answer

Enable Multi-AZ deployment.. Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, ensuring database availability without manual intervention. This is the only option that directly protects against an entire AZ loss by maintaining a hot standby in a separate AZ.

Answer

Enable automated backups with a retention period of 35 days.

Answer

Take manual snapshots and copy them to another Region.

Answer

Create a read replica in a different Availability Zone.

Question 6

A SysOps administrator needs to deploy an application to a set of EC2 instances in an Auto Scaling group. The deployment must be performed in batches, with each batch health-checked before proceeding. Which AWS CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime is the correct deployment configuration because it deploys the application revision to one EC2 instance at a time, waiting for the instance to pass health checks before proceeding to the next. This ensures that the deployment is performed in batches of one, with each batch health-checked before moving on, which aligns with the requirement for batch-based, health-checked deployments.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.Custom

Question 7

A company runs 200 EC2 Linux instances across three accounts. The security team requires that critical OS patches are applied automatically every Sunday at 2 AM UTC. Currently patches are applied manually and inconsistently. What is the recommended AWS-native solution?

Accepted Answer

Configure a Patch Manager patch baseline and maintenance window scheduled for Sunday 02:00 UTC; associate the Run Patch Baseline task with all EC2 instance targets. AWS Systems Manager Patch Manager, combined with a Maintenance Window, provides a fully AWS-native, automated solution for patching EC2 instances on a schedule. The Patch Manager service uses a patch baseline to define which patches are approved (e.g., critical OS patches), and the Maintenance Window triggers the 'AWS-RunPatchBaseline' SSM document at the specified time (Sunday 02:00 UTC) against all targeted instances. This eliminates manual effort and ensures consistent, auditable patching across multiple accounts and instances.

Answer

Create a cron job on each instance that runs 'yum update -y' every Sunday at 2 AM

Answer

Use AWS Config managed rules to detect unpatched instances and send SNS notifications for manual remediation

Answer

Build a CodePipeline that runs weekly, creates new AMIs with the latest patches, and replaces all instances via an Auto Scaling instance refresh

Question 8

A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?

Accepted Answer

Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.. Placing a Network Load Balancer (NLB) in front of the ALB allows Global Accelerator to terminate the TCP connection at the edge, then forward traffic to the NLB. The NLB preserves the original client IP address by default (since it operates at Layer 4 and does not terminate the connection), and the ALB can still read the client IP from the X-Forwarded-For header. This setup meets both the performance requirement (via Global Accelerator's edge routing) and the logging requirement (preserving the original client IP).

Answer

Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.

Answer

Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.

Answer

Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.

Question 9

An EC2 instance runs a database on a 2 TB EBS gp3 volume. After a corruption event, the team must restore from a snapshot. When they detach the corrupted volume, attach a new volume restored from the snapshot, and start the database, performance is 10 to 20 times lower than normal for the first two hours. What causes this behavior, and what feature eliminates it?

Accepted Answer

Enable Fast Snapshot Restore (FSR) on the snapshot in the target Availability Zone before creating the replacement volume. When you create an EBS volume from a snapshot, the volume's data blocks are lazily loaded from Amazon S3 on first access. This causes high latency and low IOPS until all blocks are fetched. Fast Snapshot Restore (FSR) pre-initializes the volume in a specific Availability Zone, eliminating the need for lazy loading and providing full performance immediately.

Answer

Use a Provisioned IOPS (io2) volume type instead of gp3 to get higher IOPS during initialization

Answer

Run a full dd or fio pre-warm pass over the volume after attaching it but before starting the database

Answer

Increase the EBS volume size to 4 TB when restoring from the snapshot to get double the throughput baseline

Question 10

A company's security team notices that an IAM user has been making unauthorized API calls from an IP address outside the company's VPN. The team wants to immediately block all API calls from that specific IP address for all users. Which action should be taken?

Accepted Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.. A service control policy (SCP) attached to the root organizational unit (OU) applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and roles across those accounts. Option A is incorrect because attaching an IAM policy to all users only affects the current account and is not scalable for organization-wide enforcement. Option B is incorrect because IAM policies cannot be attached to an organization root; only SCPs can be applied at that level. Option D is incorrect because SCPs cannot be attached directly to IAM users; they apply to OUs or accounts.

Answer

Create a new IAM policy that denies access from the IP address and attach it to all users.

Answer

Create an IAM policy that denies access from the IP address and attach it to the organization root.

Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the IAM user.

Question 11

Drag and drop the steps to troubleshoot an unhealthy target in an Application Load Balancer target group into the correct order.

Accepted Answer

Verify security group rules allow traffic from the ALB, then verify health check settings (path, port, protocol), then check instance status and application health, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.. Troubleshooting starts with security group rules, then health check configuration, then instance and application status, then logs, and finally replacement if needed.

Answer

Verify health check settings (path, port, protocol), then verify security group rules, then check instance status and application health, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.

Answer

Check instance status and application health, then verify security group rules, then verify health check settings, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.

Answer

Review ALB access logs and CloudWatch metrics, then verify security group rules, then verify health check settings, then check instance status and application health, then replace the target instance if necessary.

Question 12

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed in a single AWS region. The company wants to improve performance for users in other regions and reduce the load on the origin servers. The SysOps administrator decides to use Amazon CloudFront. After implementing CloudFront, the administrator notices that the cache hit ratio is very low (around 10%) for the dynamic API responses that are served by the application. These API responses are personalized per user and change frequently. The administrator wants to improve performance for these dynamic requests while still using CloudFront. The application uses cookies for session management and the API responses depend on the user's session. The administrator must ensure that users receive the correct personalized content. Which configuration should the administrator use?

Accepted Answer

Use Lambda@Edge to generate personalized responses at the edge without forwarding all requests to the origin.. For dynamic, personalized API responses that depend on user session cookies, caching is ineffective because each user's response is unique. Lambda@Edge allows you to run code at CloudFront edge locations to generate personalized responses or modify requests/responses. By using a Lambda function that inspects the session cookie and generates the appropriate API response at the edge, you can serve personalized content without forwarding every request to the origin. This improves performance by reducing round trips and origin load while ensuring users receive correct personalized content. Options B, C, and D do not effectively address the need for dynamic personalization with low cache hit ratio.

Answer

Configure CloudFront to use origin shield and enable keep-alive connections to the origin.

Answer

Configure CloudFront to forward cookies to the origin and enable caching based on cookies.

Answer

Disable caching for the API behavior in CloudFront and enable real-time logs.

Question 13

Drag and drop the steps to configure a VPC peering connection between two VPCs into the correct order.

Accepted Answer

Step 1: Create the peering request, Step 2: Accept the peering request, Step 3: Update route tables in both VPCs, Step 4: Adjust security groups.. First create the peering request, then accept it, then update route tables in both VPCs, and finally adjust security groups.

Answer

Step 1: Create the peering request, Step 2: Update route tables in both VPCs, Step 3: Accept the peering request, Step 4: Adjust security groups.

Answer

Step 1: Accept the peering request, Step 2: Create the peering request, Step 3: Update route tables in both VPCs, Step 4: Adjust security groups.

Answer

Step 1: Update route tables in both VPCs, Step 2: Create the peering request, Step 3: Accept the peering request, Step 4: Adjust security groups.

Question 14

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda. It uses Amazon CloudWatch alarms to monitor CPU utilization metrics and trigger an SNS topic, which then invokes an AWS Lambda function. The Lambda function can execute the logic to stop the EC2 instance when the alarm state indicates CPU utilization above 90% for 30 minutes, providing automated cost control without manual intervention.

Answer

Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation

Answer

Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions

Answer

AWS CloudTrail + Amazon EventBridge + AWS CodePipeline

Question 15

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

Accepted Answer

Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.. The correct action is to use the 'Release change' button in the CodePipeline console. This manually reruns the pipeline from the source stage, using the latest source revision. Option A is incorrect because creating a new commit with an empty message would trigger the pipeline only if the source repository is configured to detect changes, but it is unnecessary. Option C is incorrect because CodePipeline does not automatically retry after a failure; it stops at the failed stage. Option D is incorrect because re-uploading the same artifact may not trigger the pipeline if the S3 event is configured to detect only new objects, and it is not the standard procedure to rerun the pipeline.

Answer

Create a new commit with an empty message to trigger the pipeline.

Answer

Wait for the pipeline to automatically retry after the failure.

Answer

Re-upload the same artifact to the source S3 bucket to trigger the pipeline.

Question 16

Drag and drop the steps to enable AWS CloudTrail logging for a specific S3 bucket into the correct order.

Accepted Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.. First create a log bucket with proper policy, then create the trail and configure it to log events for the target bucket.

Answer

Step 2: Create a CloudTrail trail.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.

Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 2: Create a CloudTrail trail.

Answer

Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.

Question 17

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning. AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Answer

Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning

Answer

Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action

Answer

Use AWS Service Catalog to enforce versioning on all buckets provisioned through it

Question 18

A media company stores millions of video files in S3. Some files are accessed heavily after upload (when new) and rarely afterward; others are accessed unpredictably across months. The team cannot predict which files will be accessed and when. They want to minimize storage costs without risking retrieval latency penalties or per-object retrieval fees. Which storage class is appropriate?

Accepted Answer

Use S3 Intelligent-Tiering so objects automatically move between Frequent and Infrequent Access tiers based on access patterns, with no retrieval fees. S3 Intelligent-Tiering is the correct choice because it automatically moves objects between Frequent Access and Infrequent Access tiers based on changing access patterns, with no retrieval fees and no performance impact (millisecond latency). This matches the unpredictable access pattern described, as the service monitors access at the object level and adjusts storage tier without manual lifecycle rules or retrieval costs.

Answer

Use S3 Standard-IA and configure a lifecycle policy to move objects back to Standard after every access

Answer

Use S3 Glacier Instant Retrieval for all objects because it offers the lowest storage cost with millisecond retrieval

Answer

Use S3 Standard for all objects because it has no retrieval fees and provides the best availability

Question 19

A SysOps administrator manages an Amazon RDS for MySQL instance that handles a critical web application. During peak traffic, the number of database connections exceeds 500 for more than 15 minutes, leading to connection timeouts. The administrator wants to automatically increase the DB instance size when the connection count remains high, and decrease it when the load drops, to balance performance and cost. Which combination of AWS services should be used to achieve this automation with the least operational overhead?

Accepted Answer

Set up an Amazon CloudWatch alarm on the DatabaseConnections metric that triggers an AWS Lambda function to modify the DB instance class via the RDS API.. It uses a CloudWatch alarm to monitor the DatabaseConnections metric, which triggers an AWS Lambda function that directly calls the RDS ModifyDBInstance API to change the instance class. This approach provides the least operational overhead by leveraging native AWS services without additional infrastructure, custom resources, or periodic polling, and it enables real-time, event-driven scaling based on the specified threshold.

Answer

Configure a CloudWatch alarm on DatabaseConnections that triggers an Amazon CloudWatch Events rule, which directly modifies the DB instance class using a CloudFormation custom resource.

Answer

Use an AWS Config rule to monitor DatabaseConnections and invoke an AWS Lambda function to scale the RDS instance when the threshold is breached.

Answer

Use an AWS Systems Manager Automation runbook to periodically check the DatabaseConnections metric and adjust the RDS instance class if needed.

Question 20

A company runs a read-heavy database workload on Amazon RDS for PostgreSQL with a primary instance and two read replicas. The SysOps administrator observes that the read replicas frequently experience high replica lag during peak hours, causing stale reads for the application. The administrator needs to reduce replica lag while optimizing costs. The workload is predictable, with spikes during business hours and low traffic at night. Which combination of actions should the administrator take?

Accepted Answer

Upgrade the instance class of the read replicas to a larger type with more CPU and memory to handle the increased WAL replay rate.. Upgrading the read replica instance class provides more CPU and memory, which directly increases the WAL replay rate. In RDS for PostgreSQL, replica lag is primarily caused by the replica's inability to apply WAL changes as fast as the primary generates them. A larger instance class alleviates this bottleneck without incurring the cost of upgrading the primary instance.

Answer

Convert the read replicas to Multi-AZ instances to improve the replication process and reduce lag.

Answer

Add additional read replicas to distribute the read load and reduce the lag on each individual replica.

Answer

Upgrade the primary DB instance to a larger class with increased IOPS to reduce the amount of data that needs to be replicated.