SOA-C02 Practice Test 21 — 15 Questions

Question 1

A company has a production application running on Amazon ECS with Fargate. The application must be highly available across multiple Availability Zones. Which TWO configurations should be implemented?

Accepted Answer

Configure the ECS service to run tasks in at least two Availability Zones.. Running ECS tasks across at least two Availability Zones ensures that if one AZ fails, the service continues to operate in the other AZ, meeting the high-availability requirement. Option D is correct because placing the ECS service behind an Application Load Balancer (ALB) enables health checks and automatic traffic distribution to healthy tasks, which is essential for maintaining availability during task failures or AZ disruptions.

Answer

Configure the ECS service to run tasks in a single Availability Zone to reduce network latency.

Answer

Use the awsvpc network mode for the task definition.

Answer

Use Fargate Spot capacity providers to reduce costs.

Question 2

A company is running a critical application on EC2 instances in an Auto Scaling group. The application experiences occasional CPU spikes. The SysOps administrator needs to configure a scaling policy that reacts quickly to increased load but avoids unnecessary scaling actions due to short bursts. Which scaling policy type should be used?

Accepted Answer

Target tracking scaling policy with a CPU utilization target of 70%. Target tracking scaling policy with a CPU utilization target of 70% is correct because it dynamically adjusts the Auto Scaling group's desired capacity to maintain a specified metric (CPU utilization) at the target value. It uses a built-in algorithm that reacts quickly to sustained load increases while smoothing out short bursts by applying a cooldown and proportional control logic, preventing unnecessary scaling actions from transient spikes.

Answer

Manual scaling

Answer

Scheduled scaling policy

Answer

Simple scaling policy

Question 3

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The stack creation fails with the error 'The maximum number of VPCs has been reached.' The SysOps administrator needs to deploy the stack as soon as possible. What should the administrator do?

Accepted Answer

Request a VPC limit increase from AWS Support.. The error 'The maximum number of VPCs has been reached' indicates the AWS account has hit the default VPC limit (5 per region). Requesting a service limit increase from AWS Support is the fastest way to raise this soft limit without modifying existing infrastructure or templates, allowing the stack to deploy in the same region.

Answer

Delete unused VPCs to free up capacity.

Answer

Modify the CloudFormation template to use an existing VPC.

Answer

Deploy the stack in a different AWS region.

Question 4

Refer to the exhibit. An IAM role has the trust policy shown. Which entity can assume this role?

Accepted Answer

Any IAM user in the AWS account 123456789012. The trust policy specifies `"AWS": "arn:aws:iam::123456789012:root"` as the principal, which allows any IAM user or role within the AWS account 123456789012 to assume the role, provided they have the necessary permissions in their own identity-based policies. This is because the root ARN of an account acts as a wildcard for all identities in that account. Option C correctly identifies that any IAM user in that account can assume the role.

Answer

Only the IAM user with the ARN arn:aws:iam::123456789012:user/Admin

Answer

Any IAM user in any AWS account

Answer

Only users who have MFA enabled

Question 5

A SysOps administrator needs to ensure that an S3 bucket can recover from accidental deletions by users. The bucket stores versioned objects. What additional configuration should be enabled to prevent permanent deletion?

Accepted Answer

Enable MFA Delete on the bucket.. Enabling MFA Delete on the S3 bucket adds an extra layer of protection by requiring multi-factor authentication for any DeleteObject or DeleteBucket operations. Even if a user has s3:DeleteObject permission, they cannot permanently delete versioned objects unless they present a valid MFA code. This prevents accidental or unauthorized permanent deletions while still allowing versioned objects to be recovered.

Answer

Enable S3 Server-Side Encryption.

Answer

Enable S3 Lifecycle rules to expire objects.

Answer

Configure a bucket policy to deny s3:DeleteObject.

Question 6

Refer to the exhibit. A Lambda function is unable to write logs to CloudWatch Logs. The IAM role attached to the Lambda function includes the policy shown. What is the issue?

Accepted Answer

The resource ARN does not include a log-stream component.. The Lambda function's IAM policy grants permissions for `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` on the resource ARN `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:*`. However, this ARN only specifies the log group and a wildcard for log streams, which is insufficient for the `logs:PutLogEvents` action. The `logs:PutLogEvents` action requires a resource ARN that includes a specific log-stream component (e.g., `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:log-stream:*`), because the API call targets a particular log stream within the log group. Without this, the Lambda function cannot write logs, resulting in a permissions error.

Answer

The log group name is incorrect.

Answer

The policy effect is Deny.

Answer

The 'logs:PutLogEvents' action is not allowed.

Question 7

A company wants to ensure that it receives notifications whenever any AWS Identity and Access Management (IAM) user in the account creates a new access key. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture API calls from AWS CloudTrail and trigger a notification (e.g., via SNS) when an IAM user creates a new access key. By setting up a rule that matches the `CreateAccessKey` API call, the company can receive real-time alerts for this specific action.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 8

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator notices that the application's response time is increasing during peak hours. The administrator wants to set up a CloudWatch dashboard that displays the average latency of requests across all instances and the number of healthy hosts. Which metrics should be used?

Accepted Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'HealthyHostCount' metric.. The ALB's 'TargetResponseTime' metric measures the average time (in seconds) that requests are routed to targets, which directly reflects application latency. The ALB's 'HealthyHostCount' metric shows the number of healthy registered targets, which is the exact metric needed to monitor host health. Together, these two metrics provide the required visibility into average latency and healthy host count across all instances.

Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'UnhealthyHostCount' metric.

Answer

Use the ALB's 'RequestCount' metric and the EC2 Auto Scaling group's 'GroupInServiceInstances' metric.

Answer

Use the ALB's 'Latency' metric and the EC2 instance's 'CPUUtilization' metric.

Question 9

A SysOps administrator is investigating why a CloudWatch alarm did not trigger an SNS notification. The alarm state changed to ALARM, but the notification was not sent. The SNS topic has a subscription to an email endpoint. What is the most likely cause?

Accepted Answer

The email subscription to the SNS topic has not been confirmed.. The most likely cause is that the email subscription to the SNS topic has not been confirmed. When an SNS topic has an email subscription, AWS sends a confirmation email to the endpoint, and the subscriber must click the confirmation link before notifications can be delivered. Until the subscription is confirmed, the SNS topic will not send any messages to that endpoint, even if the CloudWatch alarm enters the ALARM state and successfully publishes to the topic.

Answer

The alarm's evaluation period is too short.

Answer

The alarm's actions are not configured to send to the SNS topic.

Answer

The SNS topic is encrypted with a KMS key that the alarm does not have permissions to use.

Question 10

A company is using Amazon S3 to store critical data with versioning enabled. The SysOps administrator needs to implement a solution that automatically transitions objects to S3 Glacier Deep Archive after 90 days and permanently deletes them after 7 years. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies are the correct choice because they allow you to define rules that automatically transition objects to S3 Glacier Deep Archive after a specified number of days (90) and then permanently expire (delete) them after a longer period (7 years). This directly meets the requirements for automated, time-based storage class transitions and deletion without manual intervention.

Answer

S3 Intelligent-Tiering

Answer

S3 Object Lock

Answer

S3 Cross-Region Replication

Question 11

A SysOps administrator is troubleshooting a slow-running RDS MySQL instance. The administrator notices that the ReadIOPS metric is consistently high, but the WriteIOPS is low. The instance type is db.m5.large with 300 GB of General Purpose SSD (gp2). What is the most likely cause?

Accepted Answer

The gp2 volume is experiencing I/O credit exhaustion.. A db.m5.large instance with 300 GB of gp2 storage has a baseline IOPS of 900 (3 IOPS per GB) and a burst balance of 5.4 million I/O credits. With consistently high ReadIOPS and low WriteIOPS, the volume is likely exhausting its I/O credit balance, causing performance throttling. This is a classic symptom of gp2 I/O credit exhaustion, where read-heavy workloads deplete the burst bucket, leading to degraded performance.

Answer

The instance type is too small for the workload.

Answer

The database is experiencing write contention.

Answer

The network bandwidth is insufficient.

Question 12

An organization uses AWS CloudTrail to log API calls across multiple accounts in AWS Organizations. The logs are delivered to a central S3 bucket. The security team wants to receive near-real-time notifications whenever an IAM user creates a new access key. Which solution is the MOST operationally efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event from CloudTrail and publishes to an Amazon SNS topic.. Amazon EventBridge can directly consume CloudTrail events (including `CreateAccessKey`) in near-real-time without polling or custom code. By creating a rule that matches this specific event and targets an SNS topic, the security team gets immediate notifications with minimal operational overhead. This approach is serverless, event-driven, and requires no intermediate services or custom functions.

Answer

Enable S3 Event Notifications on the CloudTrail bucket to trigger a Lambda function that scans new objects for access key creation.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and set up a metric filter that triggers an alarm.

Answer

Use Amazon CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 13

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running a custom application. The instance is not using the default CloudWatch metrics for memory. What should the administrator do to collect memory metrics?

Accepted Answer

Install and configure the CloudWatch agent on the instance. The default CloudWatch metrics for EC2 include CPU, disk, and network utilization, but not memory utilization. To collect custom metrics like memory usage, you must install and configure the CloudWatch agent on the instance. The agent collects memory and disk metrics from the OS and sends them to CloudWatch as custom metrics.

Answer

Enable detailed monitoring on the EC2 instance

Answer

Use AWS Trusted Advisor to check memory utilization

Answer

Use Amazon Inspector to monitor memory

Question 14

A company wants to distribute content with low latency to users globally. The content is static and stored in an S3 bucket. Which AWS service should be used?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users by serving data from the nearest edge. It integrates directly with S3 buckets as an origin, providing low-latency distribution of static content without requiring any changes to the S3 bucket configuration.

Answer

Application Load Balancer

Answer

AWS Global Accelerator

Answer

S3 Transfer Acceleration

Question 15

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used to track these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes such as CreatePolicy, PutUserPolicy, AttachRolePolicy, and DeletePolicy. CloudTrail logs these events with details like the user, source IP, and timestamp, providing a complete audit trail for security and compliance. AWS Config, while capable of tracking configuration changes, does not capture the API-level detail required for auditing who made the change and how.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor