SOA-C02 Practice Test 22 — 15 Questions

Question 1

A company hosts a static website on Amazon S3 and uses Amazon CloudFront for content delivery. The marketing team wants to know how many users visit the website each day, including the geographic distribution. Which solution requires the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudFront access logs and use Amazon Athena to query the logs in S3.. Enabling CloudFront access logs and querying them with Amazon Athena provides detailed user visit counts and geographic distribution with minimal operational overhead. Access logs contain client IP addresses and request details, which Athena can analyze using SQL without managing servers or complex pipelines. This approach is serverless and cost-effective for periodic analysis.

Answer

Use CloudWatch metrics for CloudFront to view request counts and enable detailed metrics.

Answer

Enable AWS CloudTrail for CloudFront and query the event history.

Answer

Enable CloudFront real-time logs and send them to Amazon Kinesis Data Analytics for analysis.

Question 2

A company uses Amazon S3 to store sensitive data. The SysOps administrator needs to ensure that any attempt to upload an object with server-side encryption disabled is immediately detected and the administrator is notified. The administrator has enabled AWS CloudTrail and is logging S3 data events. Which approach should the administrator use to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutObject API calls without the encryption header and triggers an SNS notification.. CloudWatch Events (now Amazon EventBridge) can filter API calls captured by CloudTrail for PutObject operations that lack the x-amz-server-side-encryption header, and then trigger an SNS notification in near real-time. This ensures immediate detection and notification of any upload with server-side encryption disabled, meeting the requirement for instant alerting.

Answer

Enable S3 event notifications to send events to SNS for all PutObject operations.

Answer

Create an AWS Config rule to detect objects without encryption.

Answer

Use S3 Inventory to generate a daily report of unencrypted objects.

Question 3

A company uses AWS CloudTrail to log API activity. The security team needs to be notified immediately when an IAM user creates a new access key. Which combination of steps should a SysOps administrator take? (Choose TWO.)

Accepted Answer

Create a CloudWatch Logs metric filter for the 'CreateAccessKey' event.. CloudWatch Logs metric filters allow you to extract specific patterns from CloudTrail log data, such as the 'CreateAccessKey' event, and convert them into a metric. This enables you to monitor for this specific API call and trigger an alarm when it occurs, meeting the requirement for immediate notification.

Answer

Enable AWS Config rules to detect changes to IAM users.

Answer

Configure CloudTrail to send notifications directly to Amazon SNS.

Answer

Create an Amazon EventBridge rule to match the 'CreateAccessKey' API call.

Question 4

Refer to the exhibit. A SysOps administrator runs the command and sees the output. The administrator then creates a CloudWatch alarm on the CPUUtilization metric for this instance, but the alarm state remains 'INSUFFICIENT_DATA'. What is a likely cause?

Accepted Answer

The EC2 instance is stopped or terminated.. The command output shows the instance state is 'stopped'. CloudWatch cannot retrieve metrics from a stopped or terminated EC2 instance because the hypervisor is no longer running the instance's operating system or collecting CPU utilization data. When no metric data points are received for the configured alarm period, the alarm transitions to 'INSUFFICIENT_DATA' state.

Answer

Detailed monitoring is not enabled.

Answer

The instance is in a different AWS region.

Answer

The metric name is misspelled.

Question 5

A SysOps administrator wants to receive an email when the average CPU utilization of an EC2 instance exceeds 90% for 5 minutes. What should the administrator create?

Accepted Answer

A CloudWatch alarm on the CPUUtilization metric with an SNS notification.. A CloudWatch alarm on the CPUUtilization metric can be configured to evaluate the average CPU usage over a 5-minute period and trigger an action when it exceeds 90%. The alarm can send a notification via Amazon SNS, which can deliver an email to subscribed endpoints. This directly meets the requirement for email notification based on a sustained metric threshold.

Answer

A CloudWatch Logs metric filter on the instance logs.

Answer

An AWS Config rule to detect high CPU usage.

Answer

A CloudWatch Events rule on the EC2 instance state change.

Question 6

A SysOps administrator needs to monitor the application logs of a web server and receive an email notification when the number of 'ERROR' log entries exceeds 100 in a 5-minute window. The logs are already being sent to Amazon CloudWatch Logs. Which combination of AWS services should be used to meet this requirement with the least operational overhead?

Accepted Answer

CloudWatch Logs metric filter, CloudWatch alarm, and Amazon SNS. CloudWatch Logs metric filters can parse log events for the string 'ERROR' and count them in real time. A CloudWatch alarm can then trigger when the metric exceeds 100 in a 5-minute period, and Amazon SNS sends the email notification. This combination requires no custom code or additional infrastructure, minimizing operational overhead.

Answer

Amazon Kinesis Data Firehose and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Answer

AWS Config managed rule and Amazon SNS

Question 7

A SysOps administrator is creating a CloudFormation stack and receives the error shown in the exhibit. The template snippet for the Auto Scaling group is:

"MyAutoScalingGroup": {
  "Type": "AWS::AutoScaling::AutoScalingGroup",
  "Properties": {
    "MinSize": "1",
    "MaxSize": "5",
    "DesiredCapacity": "2",
    ...
  }
}

Accepted Answer

The MinSize value must be specified as an integer, not a string.. The `MinSize`, `MaxSize`, and `DesiredCapacity` properties in an `AWS::AutoScaling::AutoScalingGroup` resource must be specified as integer values, not strings. In the provided template snippet, `"1"` is a string literal, which causes CloudFormation to fail validation because it expects a numeric type (e.g., `1` without quotes).

Answer

The DesiredCapacity value must be less than MinSize.

Answer

The MinSize value exceeds the MaxSize value.

Answer

The Auto Scaling group must have a scaling policy.

Question 8

A SysOps administrator needs to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. Which solution is the MOST operationally efficient?

Accepted Answer

Configure CloudTrail in each account to deliver logs to the same S3 bucket in the central account.. AWS CloudTrail can be configured in each account to deliver logs directly to the same S3 bucket in a central account by specifying the central bucket's ARN and setting appropriate bucket policies. This approach is operationally efficient as it eliminates the need for intermediate services or replication, reducing complexity and cost while ensuring logs are centralized without manual intervention.

Answer

Use S3 replication to copy logs from each account's bucket to a central bucket.

Answer

Use CloudWatch Logs subscription filter to stream logs to a central account.

Answer

Use Amazon Kinesis Data Firehose to deliver logs from each account to a central S3 bucket.

Question 9

An application is running on an EC2 instance and is experiencing intermittent connection timeouts. The SysOps administrator wants to capture network traffic to analyze the issue. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including accepted and rejected connection attempts. This allows the SysOps administrator to analyze the source/destination IPs, ports, protocols, and whether the traffic was allowed or denied, which is essential for diagnosing intermittent connection timeouts.

Answer

CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 10

A SysOps administrator needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in an AWS account, including all IAM policy changes such as creating, updating, or deleting policies. CloudTrail captures these events as JSON logs, which can be stored in an S3 bucket for auditing and analysis. This makes it the appropriate tool for auditing changes to IAM policies.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3

Question 11

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which THREE steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Configure the Lambda function to publish a custom metric to CloudWatch.. The Lambda function processes CloudWatch Logs subscription filter events and publishes a custom metric to CloudWatch. This custom metric can then trigger a CloudWatch alarm (Option C) to send an SNS notification, meeting the requirement. The combination of a CloudWatch Logs subscription filter (Option D) with a Lambda function is the standard pattern for real-time log-based alerting when CloudTrail logs are delivered to CloudWatch Logs.

Answer

Configure the CloudTrail trail to deliver logs directly to an SNS topic.

Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an SNS notification.

Question 12

A company wants to ensure that its S3 bucket is accessible only from a VPC. Which configuration should the SysOps Administrator implement?

Accepted Answer

Create an S3 VPC endpoint and attach a bucket policy that restricts access to that endpoint.. An S3 VPC endpoint (either gateway or interface type) allows private connectivity between a VPC and S3 without traversing the public internet. By attaching a bucket policy that includes a condition like `aws:SourceVpce` or `aws:SourceVpc`, access is explicitly restricted to traffic originating from that specific VPC endpoint, ensuring the bucket is not accessible from any other network.

Answer

Configure a bucket policy that allows access from the public internet.

Answer

Make the bucket public and rely on IAM roles.

Answer

Attach a security group to the S3 bucket.

Question 13

A company has an AWS account with multiple VPCs connected via a transit gateway. The SysOps administrator needs to ensure that all traffic between VPCs is encrypted in transit. Which solution should the administrator implement?

Accepted Answer

Set up AWS Site-to-Site VPN connections between the VPCs via the transit gateway.. AWS Site-to-Site VPN connections between VPCs via a transit gateway can enforce IPsec encryption for all inter-VPC traffic. The transit gateway acts as a central hub, and each VPN connection encrypts traffic using IPsec tunnels, ensuring data confidentiality and integrity in transit. This meets the requirement for encrypted transit between VPCs without relying on third-party appliances.

Answer

Use VPC peering connections between the VPCs.

Answer

Use VPC endpoints to route traffic through AWS PrivateLink.

Answer

Configure network ACLs to deny unencrypted traffic.

Question 14

A company has a centralized logging solution where CloudTrail logs from multiple accounts are delivered to a single S3 bucket. The security team needs to be alerted when an IAM user is created in any of the accounts. Which steps should be taken? (Choose THREE.)

Accepted Answer

Create a CloudWatch Logs metric filter for 'CreateUser' event.. A CloudWatch Logs metric filter can parse CloudTrail logs delivered to CloudWatch Logs and match the 'CreateUser' event pattern. This filter creates a metric that can be used to trigger an alarm. Option B is correct because CloudTrail must be configured to deliver logs to CloudWatch Logs in each account so that the metric filter can be applied to the log group. Option E is correct because a CloudWatch alarm on the metric filter can publish to an SNS topic, which sends notifications (e.g., email, SMS) to the security team when an IAM user is created.

Answer

Create an AWS Config rule to detect IAM user creation.

Answer

Configure S3 event notification on the central bucket to trigger a Lambda function.

Question 15

Refer to the exhibit. A SysOps administrator needs to restore the database 'mydb' to the most recent restorable time shown. However, the administrator cannot restore to that time. What is the MOST likely reason?

Accepted Answer

Automated backups are disabled (BackupRetentionPeriod is 0).. Automated backups must be enabled with a BackupRetentionPeriod greater than 0 for point-in-time recovery (PITR) to be available. When BackupRetentionPeriod is set to 0, automated backups are disabled, and the database cannot be restored to any point in time within the retention window. The exhibit shows that the most recent restorable time is not available because no automated backups exist to support PITR.

Answer

The database engine does not support point-in-time recovery.

Answer

The backup window has already passed.

Answer

The database is not Multi-AZ.