SOA-C02 Practice Exam 4 — 20 Questions

Question 1

A SysOps administrator is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The administrator wants to identify the specific queries consuming the most CPU. What is the MOST efficient way to achieve this?

Accepted Answer

Enable Performance Insights for the RDS instance and view the top SQL queries.. Performance Insights provides a built-in database load visualization and a dashboard that directly shows the top SQL queries consuming the most resources, including CPU. This is the most efficient method because it requires no additional configuration beyond enabling the feature and immediately surfaces the specific queries causing high CPU utilization.

Answer

Use CloudWatch metrics for RDS and create a dashboard for CPU utilization.

Answer

Enable Enhanced Monitoring for the RDS instance and view the CPU metrics.

Answer

Enable CloudWatch Logs for the RDS instance and filter for slow query logs.

Question 2

A SysOps administrator wants to be alerted when an EC2 instance's status check fails. The instance is part of an Auto Scaling group. What is the BEST approach?

Accepted Answer

Create a CloudWatch alarm on the 'StatusCheckFailed' metric.. Option B is correct because the 'StatusCheckFailed' metric is automatically published by EC2 to CloudWatch, and a CloudWatch alarm on this metric can directly trigger an SNS notification or other action when the status check fails. This is the simplest and most reliable method for alerting on instance health, regardless of whether the instance is in an Auto Scaling group.

Answer

Use Amazon EventBridge to detect status check failures.

Answer

Enable CloudTrail to monitor EC2 instance status changes.

Answer

Configure an Auto Scaling lifecycle hook to send a notification.

Question 3

A SysOps administrator is setting up monitoring for an RDS MySQL database. The administrator needs to be notified when the database connection count exceeds 100. Which steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.. Option A is correct because Amazon CloudWatch alarms can send notifications to an Amazon SNS topic when the alarm state changes. This allows the SysOps administrator to receive alerts (e.g., via email, SMS, or HTTP) when the database connection count exceeds the threshold. Option B is correct because the 'DatabaseConnections' metric is a standard CloudWatch metric for RDS MySQL that tracks the number of current connections to the database instance. Creating an alarm on this metric with a threshold of 100 will trigger when the connection count exceeds that value.

Answer

Enable Enhanced Monitoring for RDS.

Answer

Enable CloudTrail to log RDS API calls.

Answer

Create an Amazon EventBridge rule that triggers on RDS events.

Question 4

A SysOps administrator wants to be alerted when the root user of the AWS account signs in. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail logs all API calls, including root user sign-ins, as `RootLogin` events in the management events trail. Option D is correct because Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches these CloudTrail log events and triggers a notification action, such as sending an SNS alert, when the root user signs in.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 5

A company needs to monitor for unauthorized changes to critical IAM policies. The SysOps administrator must receive notifications within minutes of any change. Which combination of AWS services should the administrator use?

Accepted Answer

Use AWS CloudTrail to log IAM changes, and create a CloudWatch Events rule that triggers an SNS notification when specific API calls are made.. Option B is correct because CloudTrail logs API calls to IAM, and a CloudWatch Events rule (now EventBridge) can trigger an SNS notification for specific API calls. Option A is incorrect because AWS Config evaluates resource configurations but is not the best for real-time notifications. Option C is incorrect because CloudWatch Logs does not directly monitor API calls. Option D is incorrect because Lambda alone cannot monitor without a trigger.

Answer

Use AWS Config rules to detect changes and send notifications via SNS.

Answer

Use CloudWatch Logs to monitor IAM activity and create a metric filter to trigger an alarm.

Answer

Use a Lambda function that periodically checks IAM policies and sends an SNS message if changes are detected.

Question 6

A company wants to monitor AWS API calls for suspicious activity. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. Options B and C are correct. CloudTrail logs API calls, and CloudWatch Logs can ingest those logs and use metric filters to detect suspicious patterns. Option A (AWS Config) records resource changes, not API calls. Option D (VPC Flow Logs) captures network traffic. Option E (Amazon Inspector) is for security assessments.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A company uses AWS CloudFormation to deploy a stack that includes an EC2 instance and an S3 bucket. The SysOps administrator needs to monitor the stack for any changes to the S3 bucket's bucket policy. Which AWS service should be used?

Accepted Answer

AWS Config. Option C is correct because AWS Config can monitor changes to S3 bucket policies and trigger notifications. Option A is incorrect because CloudTrail logs API calls to change the policy, but does not monitor the policy itself. Option B is incorrect because CloudWatch is for performance metrics. Option D is incorrect because Trusted Advisor does not monitor bucket policies.

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 8

An organization has a CloudWatch dashboard that displays metrics for multiple AWS services. The dashboard is shared with the operations team. Recently, some team members reported that the dashboard is not loading for them. Which action should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Confirm that the team members have the necessary IAM permissions for cloudwatch:GetDashboard.. The most likely cause of the dashboard not loading is that the team members lack the required IAM permission to retrieve the dashboard definition. CloudWatch dashboards are stored as JSON objects, and the `cloudwatch:GetDashboard` action is necessary to fetch and render that data in the console. Without this permission, the API call fails silently, resulting in a blank or non-loading dashboard.

Answer

Verify that the team members have subscribed to the metric streams.

Answer

Ensure the CloudWatch agent is installed on the instances displaying the dashboard.

Answer

Check that the dashboard is in the same region as the resources.

Question 9

A SysOps administrator is tasked with setting up a solution that automatically terminates EC2 instances that have been running for more than 24 hours. Which steps should the administrator take? (Select THREE.)

Accepted Answer

Tag each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp).. Options A, B, and D are correct. Option A creates a Lambda function to terminate instances. Option B creates an EventBridge rule that triggers the Lambda function. Option D tags instances with a launch time for the function to evaluate. Option C is wrong because CloudWatch alarms are for metric thresholds, not time-based. Option E is wrong because Auto Scaling lifecycle hooks are for lifecycle actions, not time-based termination.

Answer

Configure an Auto Scaling group lifecycle hook to terminate instances after 24 hours.

Answer

Create a CloudWatch alarm on the InstanceAge metric and set it to trigger the Lambda function.

Question 10

A company has an EC2 instance that needs to access an S3 bucket. The instance is launched in a private subnet with no internet gateway. What is the most secure way to provide access to S3 without traversing the internet?

Accepted Answer

Create an S3 VPC gateway endpoint. To provide access to S3 from a private subnet without an internet gateway, you can use an S3 VPC endpoint (Gateway type). This allows instances in the VPC to access S3 privately using the AWS network. Option C is correct. Option A is wrong because a NAT gateway would route traffic through the internet, which is less secure and requires an internet gateway. Option B is wrong because an internet gateway is needed for a NAT instance. Option D is wrong because AWS Direct Connect does not eliminate the need for a VPC endpoint; it provides a dedicated connection but still requires routing through the internet unless a VPC endpoint is used.

Answer

Use a NAT gateway in a public subnet

Answer

Set up an AWS Direct Connect connection

Answer

Attach an internet gateway to the VPC and a public IP to the instance

Question 11

A SysOps administrator notices that an IAM user can access the AWS Management Console but cannot use the AWS CLI. The user has a password and an access key. What is the most likely cause?

Accepted Answer

The IAM policy denies CLI access unless MFA is present. If the user can access the console but not the CLI, it suggests that the IAM policy allows console access but denies CLI access. This could be due to a condition in the policy that checks for an MFA device. If the user has not configured an MFA device for CLI access but has for console, the CLI requests might be denied. Option D is correct. Option A is wrong because if the access key were inactive, the user would not be able to make any CLI calls. Option B is wrong because the secret access key is not visible after creation, but that does not prevent use if the user has it. Option C is wrong because the CLI does not require the console password.

Answer

The secret access key was not saved during creation

Answer

The user's access key is inactive

Answer

The user is using the wrong password for the CLI

Question 12

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered using a VPC Peering connection. The instances in VPC A can ping the private IP of instances in VPC B, but not the DNS names. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not have 'Enable DNS Resolution' enabled.. VPC Peering does not support DNS resolution across VPCs by default unless the 'Enable DNS Resolution' option is enabled in the peering connection. Option A is irrelevant because route tables are correct (ping works). Option B is incorrect because DNS hostnames are separate from resolution. Option D is incorrect because security groups affect traffic, not DNS resolution.

Answer

The route tables in VPC A do not have a route to VPC B's CIDR.

Answer

The security groups in VPC B block DNS traffic (port 53).

Answer

The VPCs have overlapping CIDR blocks.

Question 13

A company has a production environment that includes an Amazon RDS for MySQL database. The SysOps administrator receives an alert that the database's CPU utilization has been above 90% for the past hour. The administrator checks the CloudWatch metrics and sees that the DatabaseConnections metric is also high. The application team reports that users are experiencing slow response times. The administrator wants to investigate which queries are causing the high CPU. The database is already configured to send logs to CloudWatch Logs. Which course of action should the administrator take to identify the problematic queries?

Accepted Answer

Enable the slow query log in the RDS parameter group and publish it to CloudWatch Logs. Then use CloudWatch Logs Insights to query the logs for slow queries.. Option B is correct because RDS can publish slow query logs to CloudWatch Logs, which can then be queried. Option A is wrong because Performance Insights shows performance data but not raw queries. Option C is wrong because CloudWatch Logs Insights can query logs, but the slow query logs need to be enabled first. Option D is wrong because CloudTrail does not capture database queries.

Answer

Use CloudWatch Logs Insights to query the existing RDS log group for any SQL statements.

Answer

Enable AWS CloudTrail to capture database queries and send them to CloudWatch Logs.

Answer

Enable Amazon RDS Performance Insights and use the dashboard to identify top SQL queries.

Question 14

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires very low latency and high availability. The SysOps administrator notices that the application experiences increased latency during traffic spikes even though the Auto Scaling group is scaling out. Which solution would MOST effectively reduce latency?

Accepted Answer

Change the launch configuration to use a larger instance type with more CPU and memory.. Using a larger instance type (A) can handle more requests per instance, reducing latency. Pre-warming ELB (B) is not needed for ALB. Multi-AZ (C) improves availability but not necessarily latency. Increasing cooldown (D) would slow scaling, increasing latency.

Answer

Pre-warm the load balancer by contacting AWS Support.

Answer

Increase the Auto Scaling cooldown period.

Answer

Deploy the instances in multiple Availability Zones.

Question 15

A SysOps administrator is troubleshooting an issue where an Application Load Balancer (ALB) is returning HTTP 503 errors to clients. The target group is healthy, and the instances are passing health checks. What is the most likely cause of the 503 errors?

Accepted Answer

The target instances have reached the maximum number of concurrent connections allowed by the application or operating system.. Option C is correct because HTTP 503 errors from an ALB typically indicate the load balancer cannot establish a connection to the target due to the target's connection queue being full. Option A is wrong because insufficient capacity usually causes 502 or timeout errors, not 503. Option B is wrong because misconfigured health checks would show unhealthy targets. Option D is wrong because a missing security group rule would cause 502 or timeout.

Answer

The target instances do not have enough capacity to handle the request volume.

Answer

The health check settings are configured incorrectly, causing healthy instances to be marked as unhealthy.

Answer

The security group for the targets does not allow traffic from the ALB.

Question 16

Which TWO actions should a SysOps administrator take to set up centralized logging from multiple Amazon EC2 instances running Amazon Linux 2 to Amazon CloudWatch Logs?

Accepted Answer

Attach an IAM role to each EC2 instance that includes permission for logs:PutLogEvents.. Options A and C are correct. Installing and configuring the CloudWatch Logs agent on each EC2 instance is required to send logs to CloudWatch. The IAM role must grant the logs:PutLogEvents permission to allow the agent to write log events. Option B is wrong because CloudWatch Logs does not support S3 as a direct target for real-time log ingestion; S3 is a destination for log exports. Option D is wrong because there is no 'export' action needed; the agent pushes logs. Option E is wrong because CloudWatch Logs does not require VPC endpoints for internet-facing instances; it uses public endpoints.

Answer

Create an S3 bucket and configure the EC2 instances to write logs directly to the bucket.

Answer

Create a VPC endpoint for CloudWatch Logs to allow private connectivity.

Answer

Export the logs from CloudWatch Logs to an Amazon S3 bucket for long-term retention.

Question 17

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which THREE steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Configure the Lambda function to publish a custom metric to CloudWatch.. Options A, B, and D are correct. CloudTrail logs events in JSON, so a CloudWatch Logs subscription filter can be used to match the event name 'CreateAccessKey' and send matching events to Lambda for processing. The Lambda function can then publish a custom metric to CloudWatch, and a CloudWatch alarm can be set on that metric. Option C is wrong because EventBridge can directly match events without needing a CloudWatch Logs subscription; but the scenario asks for three steps, and using EventBridge alone is simpler but does not include the metric/alarm path. Option E is wrong because SNS can send notifications but does not provide filtering logic; it would receive all events.

Answer

Configure the CloudTrail trail to deliver logs directly to an SNS topic.

Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an SNS notification.

Question 18

A SysOps administrator is troubleshooting a Lambda function that does not write logs to CloudWatch Logs. The IAM role attached to the function includes the policy shown. What is the most likely reason the logs are not being created?

Accepted Answer

The log group name in the Resource ARN does not match the actual log group created by the Lambda function.. Option B is correct because the policy only grants permissions for a specific log group '/aws/lambda/my-function', but the Lambda function likely tries to write to a different log group, such as '/aws/lambda/MyFunction' (case-sensitive). Option A is wrong because PutLogEvents is included. Option C is wrong because the Lambda service role, not user, needs the permissions. Option D is wrong because CloudWatch Logs does not require VPC endpoints.

Answer

The IAM role is not assigned to the Lambda function's execution role.

Answer

The Lambda function is in a VPC without a VPC endpoint for CloudWatch Logs.

Answer

The policy does not include the logs:PutLogEvents permission.

Question 19

A company wants to restrict access to an AWS Systems Manager Parameter Store parameter to only requests originating from the corporate network IP range (10.0.0.0/8). The SysOps administrator needs to implement this restriction using an IAM policy. Which condition key should be used?

Accepted Answer

aws:SourceIp. The correct answer is A because the `aws:SourceIp` condition key is designed to restrict access based on the requester's IP address. In this scenario, the corporate network IP range is 10.0.0.0/8, which is a private IPv4 address range. When used in an IAM policy, `aws:SourceIp` evaluates the source IP of the request as seen by AWS, allowing you to permit or deny access to Systems Manager Parameter Store based on that IP range.

Answer

aws:SourceVpc

Answer

aws:RequestedRegion

Answer

aws:UserAgent

Question 20

A company uses AWS KMS to encrypt EBS volumes. Which TWO statements about using KMS with EBS are correct? (Choose two.)

Accepted Answer

AWS managed KMS keys are automatically rotated each year. EBS can use both customer managed and AWS managed KMS keys. AWS managed keys are automatically rotated. Option A and Option D are correct. Option B is wrong because EBS does not support asymmetric KMS keys. Option C is wrong because you cannot specify a KMS key when creating a snapshot; you can only encrypt snapshots with a key. Option E is wrong because EBS does not support importing key material.

Answer

You can import key material for EBS encryption

Answer

EBS supports asymmetric KMS keys

Answer

You must specify a KMS key when creating a snapshot