SOA-C02 Practice Exam 3 — 20 Questions

Question 1

A company runs a web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across three Availability Zones. To improve reliability, the company wants to ensure that if an entire Availability Zone fails, the application remains available. Which configuration should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Auto Scaling group to launch instances in three Availability Zones.. Configuring the Auto Scaling group to launch instances across three Availability Zones ensures that if one AZ fails, the remaining AZs continue to serve traffic. The Application Load Balancer automatically distributes incoming requests to healthy instances in the surviving AZs, maintaining application availability without manual intervention.

Answer

Remove the load balancer and use Route 53 weighted routing to distribute traffic.

Answer

Launch all instances in a single Availability Zone to reduce latency.

Answer

Use a Network Load Balancer instead of an Application Load Balancer.

Question 2

A SysOps administrator is responsible for an AWS account that hosts a development environment. The environment includes several EC2 instances that are used only during business hours (9 AM to 5 PM) on weekdays. The administrator wants to reduce costs by stopping the instances during off-hours. Which action should the administrator take to automate this process?

Accepted Answer

Use the AWS Instance Scheduler to define a schedule that stops instances at 5 PM and starts them at 9 AM on weekdays.. AWS Instance Scheduler is a solution that automates the starting and stopping of EC2 instances based on a schedule. It uses Lambda functions and DynamoDB to manage schedules, and it can be configured to stop instances at 5 PM and start them at 9 AM on weekdays, reducing costs during off-hours.

Answer

Manually stop the instances at 5 PM and start them at 9 AM each weekday.

Answer

Create an Auto Scaling group with a scheduled scaling action to set desired capacity to 0 during off-hours.

Answer

Set up a CloudWatch alarm that stops instances when CPU utilization is below 1% for 30 minutes.

Question 3

A SysOps administrator is designing a disaster recovery plan for a critical application that runs on EC2 instances in a single region. The RTO is 1 hour, and the RPO is 15 minutes. The application data is stored on an Amazon EBS volume. Which approach meets these requirements at the lowest cost?

Accepted Answer

Take automated EBS snapshots every 15 minutes and copy them to the DR region. Use a pre-configured Amazon Machine Image (AMI) to launch EC2 instances from the latest snapshot.. Automated EBS snapshots taken every 15 minutes meet the RPO of 15 minutes, and copying them to the DR region allows launching EC2 instances from the latest snapshot using a pre-configured AMI, which can achieve an RTO of 1 hour. This approach is the lowest cost as it only incurs snapshot storage and cross-region data transfer costs, without requiring continuous replication infrastructure or additional compute resources.

Answer

Deploy the application across multiple Availability Zones using an Auto Scaling group and an Application Load Balancer.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to an EC2 instance in the DR region.

Answer

Use S3 Cross-Region Replication to replicate the EBS volume data to an S3 bucket in the DR region.

Question 4

A company needs to continuously scan Amazon EC2 instances for software vulnerabilities and unintended network exposure. Which AWS service should be used?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is specifically designed to automatically scan Amazon EC2 instances for software vulnerabilities (CVEs) and unintended network exposure (network reachability). It uses a combination of a managed agent (for OS-level assessment) and network configuration analysis to produce a detailed findings report, directly meeting the requirement for continuous scanning.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 5

A company runs a web application on Amazon EC2 instances. The application's traffic pattern is unpredictable, often spiking to 3x normal load for short periods. The SysOps administrator needs to ensure that the application can handle spikes without performance degradation while minimizing costs. Which combination of purchasing options and scaling strategies should the administrator use?

Accepted Answer

Use a mix of Reserved Instances for baseline and On-Demand for spikes, with a target tracking scaling policy.. It combines Reserved Instances for the predictable baseline load, which reduces costs through a significant discount, with On-Demand Instances to handle unpredictable spikes. The target tracking scaling policy automatically adjusts capacity based on a target metric (e.g., average CPU utilization), ensuring performance is maintained during spikes without manual intervention or over-provisioning.

Answer

Use all Spot Instances with a simple scaling policy.

Answer

Use all On-Demand Instances with a scheduled scaling policy.

Answer

Use only Reserved Instances with a manual scaling policy.

Question 6

A company has a production AWS account with multiple IAM users. The security team wants to implement a policy that prevents users from launching EC2 instances without an IAM role that grants access to an S3 bucket containing sensitive data. The policy should also allow users to launch instances with other roles. A SysOps administrator creates an IAM policy that denies ec2:RunInstances if the instance does not have a specific IAM instance profile. However, users are still able to launch instances without any role. What is the most likely reason, and what should be done to fix it?

Accepted Answer

The condition key is incorrect; the policy should use 'ec2:InstanceProfile' condition key with a specific ARN.. The correct condition key for checking an instance's IAM role at launch is 'ec2:InstanceProfile', not 'ec2:InstanceProfileArn'. The 'ec2:InstanceProfile' condition key evaluates the ARN of the instance profile associated with the instance. Using 'ec2:InstanceProfileArn' is not a valid condition key for EC2, so the policy never matches, and the deny effect never applies, allowing users to launch instances without any role.

Answer

The condition key 'ec2:InstanceProfileArn' is misspelled; it should be 'ec2:IamInstanceProfile'.

Answer

The policy should be attached to the user's group instead of the user.

Answer

The policy needs to be applied as a service control policy (SCP) to be effective.

Question 7

An application writes error logs to Amazon CloudWatch Logs. The SysOps administrator needs to monitor for the occurrence of the string 'ERROR' in the logs and trigger an Amazon SNS notification if more than 10 errors occur within a 5-minute window. The administrator also wants to visualize the error count over time. Which approach should be used to meet these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch Logs metric filter to count 'ERROR' entries, then create a CloudWatch alarm on that metric with a period of 5 minutes and a threshold of 10.. CloudWatch Logs metric filters can extract a count of 'ERROR' occurrences from incoming log events and emit a custom metric. A CloudWatch alarm on that metric with a period of 5 minutes and a threshold of 10 directly triggers an SNS notification when the error count exceeds 10 within the window, and the metric itself can be graphed in CloudWatch dashboards for visualization—all with minimal configuration and no custom code.

Answer

Use CloudWatch Logs Insights to run a query every 5 minutes and send notifications via a scheduled AWS Lambda function.

Answer

Create an AWS Lambda function that processes log events in real-time and publishes to Amazon SNS when the error count exceeds 10 in 5 minutes.

Answer

Use Amazon EventBridge to match log events with the pattern 'ERROR' and send them to an SNS topic.

Question 8

A company has an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The company wants to enable path-based routing to send requests to different target groups. Which TWO resources must be created to achieve this?

Accepted Answer

Target group for each backend service. (Target group for each backend service) and Option D (Listener rule with a path pattern condition) are correct. Path-based routing requires creating target groups for each backend service and a listener rule with a path pattern condition to direct requests to the appropriate target group. Option A is incorrect because subnets are needed for the ALB, but they are not specifically required for path-based routing. Option C is incorrect because a Network Load Balancer is not used; the ALB itself handles path-based routing. Option E is incorrect because a security group controls traffic but does not enable path-based routing.

Answer

Subnet for the ALB

Answer

Network Load Balancer (NLB)

Answer

Security group for the ALB

Question 9

A company is using Amazon S3 to store media files. The files are accessed frequently for the first 90 days, then rarely after that. The company wants to optimize storage costs. Which TWO actions should the SysOps administrator take? (Choose two.)

Accepted Answer

Configure a lifecycle policy to delete incomplete multipart uploads after 7 days. Configuring a lifecycle policy to delete incomplete multipart uploads after 7 days prevents orphaned parts from incurring storage costs. Option C is correct because creating a lifecycle policy to transition objects to S3 Standard-IA after 90 days reduces storage costs for infrequently accessed data. Option B is incorrect because S3 Object Lock is used for compliance and retention, not cost optimization. Option D is incorrect because enabling S3 Versioning can increase storage costs by retaining multiple versions of objects. Option E is incorrect because enabling Requester Pays shifts the cost of requests and data transfer to the requester, but does not optimize storage costs for the company.

Answer

Enable S3 Object Lock to prevent deletion

Answer

Enable S3 Versioning to keep multiple versions

Answer

Enable Requester Pays on the bucket

Question 10

A SysOps administrator needs to implement a backup strategy for an Amazon RDS for PostgreSQL database. The database is 500 GB and experiences heavy write traffic. Which solution provides the most cost-effective backup with the least impact on database performance?

Accepted Answer

Enable automated backups with a retention period of 7 days.. Automated backups are enabled by default with minimal performance impact and include transaction logs for point-in-time recovery. Option B is wrong; while using a standby for backups in Multi-AZ can reduce impact, automated backups already have minimal impact and are more cost-effective. Option C is wrong because AWS DMS replication to S3 is not a backup solution and adds complexity and cost. Option D is wrong because manual snapshots cause a brief I/O suspension and are less automated than automated backups.

Answer

Create a Multi-AZ deployment and use the standby for backups.

Answer

Use AWS Database Migration Service to continuously replicate data to an S3 bucket.

Answer

Take manual DB snapshots daily during off-peak hours.

Question 11

A company runs a batch processing job every night that takes 2 hours on a single m5.xlarge EC2 instance. The job is fault-tolerant and can be interrupted. The SysOps administrator wants to reduce costs. Which solution is MOST cost-effective?

Accepted Answer

Use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available.. The most cost-effective solution is to use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available (Option B). The job is fault-tolerant and can be interrupted, making it ideal for Spot Instances which offer significant cost savings (up to 90% compared to On-Demand). The Spot Fleet with an On-Demand fallback ensures the job completes even if Spot capacity is unavailable. Option A (On-Demand with CloudWatch alarm) does not reduce costs since On-Demand is more expensive. Option C (Dedicated Host) is costly and unnecessary for a batch job. Option D (Reserved Instance) requires a 1- or 3-year commitment and is not cost-effective for a 2-hour daily job.

Answer

Use an On-Demand instance and set up a CloudWatch alarm to stop it when the job completes.

Answer

Use a Dedicated Host to run the job.

Answer

Purchase a Reserved Instance for the m5.xlarge instance.

Question 12

A company is running a stateful web application on a single EC2 instance with a 500 GB gp2 EBS volume. The instance is currently at 80% CPU and memory utilization during peak hours. The company wants to improve performance and scalability without incurring high costs. What should the SysOps administrator do?

Accepted Answer

Implement an Application Load Balancer with an Auto Scaling group to distribute traffic across multiple instances.. Implementing an Application Load Balancer (ALB) with an Auto Scaling group allows the application to scale horizontally (scale out) based on demand. This improves both performance and scalability while optimizing costs because you only pay for the resources you use. Option B (vertical scaling) is incorrect because upgrading to a larger instance may require downtime and does not provide the same level of scalability; it also might be more costly. Option C (increasing swap space) is a temporary fix that does not address the root cause of high CPU and memory utilization; excessive swapping can degrade performance. Option D (migrating to gp3) improves I/O performance but does not help with CPU or memory constraints, and it does not enable scalability.

Answer

Upgrade the instance to a larger size (vertical scaling).

Answer

Increase the swap space on the instance to handle memory pressure.

Answer

Migrate the EBS volume from gp2 to gp3 to improve I/O performance.

Question 13

A company has a VPC with public and private subnets. The private subnets contain RDS databases that should not be accessible from the internet. Which configuration ensures that the databases are only accessible from the application servers in the public subnets?

Accepted Answer

Create a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers.. Security groups act as a virtual firewall at the instance level, and you can reference another security group as a source. By creating a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers, you ensure that only those application servers (regardless of their IP addresses) can reach the databases. This approach is more dynamic and secure than using CIDR-based rules, as it automatically accommodates changes in the application servers' IP addresses or scaling events.

Answer

Attach an internet gateway to the VPC and route the private subnet's traffic to it.

Answer

Attach a NAT gateway to the private subnet and route traffic through it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

Question 14

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should the administrator use to set up an alarm based on the status check metric?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because EC2 instance status checks are published as CloudWatch metrics (e.g., StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System). A CloudWatch Alarm can be configured to monitor these metrics and trigger an action, such as sending a notification via Amazon SNS, when the alarm state changes to ALARM. This directly meets the requirement to receive a notification when a status check fails.

Answer

Amazon EventBridge

Answer

AWS Config

Answer

AWS Systems Manager

Question 15

A company is using AWS CloudTrail to log API activity. They need to ensure that log files are protected from unauthorized modification and can be used to verify the integrity of log files. Which AWS feature should be enabled?

Accepted Answer

Enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation uses a SHA-256 hash chain to create a digest file that can be used to verify that log files have not been modified, deleted, or tampered with after delivery. This feature is specifically designed to provide cryptographic assurance of log file integrity, meeting the requirement to protect against unauthorized modification and enable verification.

Answer

Enable S3 server-side encryption on the CloudTrail S3 bucket.

Answer

Stream CloudTrail logs to Amazon CloudWatch Logs.

Answer

Enable S3 Multi-Factor Authentication (MFA) Delete on the CloudTrail S3 bucket.

Question 16

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) for traffic distribution. The SysOps administrator has configured a CloudWatch alarm to monitor the ALB's `TargetResponseTime` metric, with a threshold of 5 seconds. The alarm triggers when the average response time exceeds 5 seconds for 2 consecutive periods. Recently, the alarm has been triggering frequently during peak hours, but the application team reports that the response time is acceptable and the application is performing normally. The administrator investigates and finds that a small number of requests are taking a very long time (over 30 seconds), skewing the average. The administrator needs to reduce the number of false alarms while still being alerted if the overall application performance degrades. Which course of action should the administrator take?

Accepted Answer

Change the statistic to p95 and keep the threshold at 5 seconds. Using the p95 (95th percentile) statistic instead of the average filters out the impact of the small number of outlier requests that take over 30 seconds. The p95 metric shows the response time below which 95% of requests fall, providing a more accurate representation of typical application performance. This reduces false alarms from skewed averages while still alerting if the majority of users experience degraded response times exceeding 5 seconds.

Answer

Increase the threshold to 30 seconds

Answer

Decrease the period to 60 seconds and lower the threshold to 3 seconds

Answer

Increase the evaluation periods to 5 consecutive periods

Question 17

A SysOps administrator uses AWS CloudFormation to deploy a three-tier application. The administrator has a single template that can be used for development, test, and production environments. The only differences between environments are the EC2 instance type and the RDS DB instance class. Which CloudFormation feature should the administrator use to define these environment-specific values without duplicating the template?

Accepted Answer

Parameters. Parameters allow you to input environment-specific values (e.g., EC2 instance type, RDS DB instance class) at stack creation or update time without modifying the template. This is the correct feature because the question explicitly requires defining values that differ per environment while reusing a single template.

Answer

Conditions

Answer

Mappings

Answer

Outputs

Question 18

A SysOps admin is troubleshooting an Auto Scaling group that fails to launch instances. The group uses a launch template with an Amazon Linux 2 AMI. The admin reviews the scaling activity history and sees: 'Launching a new EC2 instance. Status: Failed. Description: Your spot request price is lower than the minimum required Spot price.' Which change should the admin make to resolve the issue?

Accepted Answer

Increase the maximum price for the Spot request in the launch template. The error message indicates that the Spot Instance request failed because the maximum price specified in the launch template is below the current Spot market price. By increasing the maximum price in the launch template (Option A), you allow the Spot request to meet or exceed the minimum required Spot price, enabling the Auto Scaling group to successfully launch instances. This is the direct fix for the price-related failure.

Answer

Modify the Auto Scaling group to use On-Demand instances instead of Spot

Answer

Change the Auto Scaling group to a different AWS Region

Answer

Increase the desired capacity of the Auto Scaling group

Question 19

A SysOps administrator is asked to ensure that all objects in an S3 bucket are encrypted at rest using a customer-managed KMS key. The bucket currently has default encryption set to SSE-S3. What must be done to meet the requirement?

Accepted Answer

Update the bucket's default encryption to SSE-KMS using the customer-managed key, and re-upload existing objects.. Default encryption on an S3 bucket only applies to newly uploaded objects; existing objects remain encrypted with the previous method (SSE-S3). To ensure all objects are encrypted at rest with a customer-managed KMS key, you must update the bucket's default encryption to SSE-KMS with the desired key and then re-upload (or copy) existing objects so they inherit the new encryption setting. Simply changing the default encryption does not retroactively re-encrypt objects already stored.

Answer

Add a bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.

Answer

Apply a service control policy to enforce SSE-KMS across the organization.

Answer

Enable S3 Versioning and set the bucket's default encryption to SSE-KMS.

Question 20

A company wants to ensure that its EC2 instances automatically recover from an instance failure. Which feature should be used?

Accepted Answer

Enable EC2 Auto Recovery on the instance.. EC2 Auto Recovery is a feature that automatically recovers an EC2 instance when it becomes impaired due to an underlying hardware or system issue. When enabled, CloudWatch monitors the instance's status checks and, upon detecting a failure, automatically stops and starts the instance on a new healthy host, preserving its private IP, Elastic IP, and instance metadata.

Answer

Create a CloudWatch alarm that sends an email when the instance status check fails.

Answer

Configure an Auto Scaling group with a launch configuration.

Answer

Attach the instance to an Elastic Load Balancer.