SOA-C02 Practice Test 23 — 15 Questions

Question 1

A SysOps administrator notices that an EC2 instance's CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a CPU utilization-based scaling policy. However, no new instances have been launched. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Auto Scaling cooldown period is preventing additional scaling activities.. The most likely cause is that the Auto Scaling cooldown period is preventing additional scaling activities. When a scaling activity completes, a cooldown period (default 300 seconds) starts during which the Auto Scaling group ignores additional CloudWatch alarms to allow metrics to stabilize. If the instance has been above 90% CPU for an hour but no new instances launched, the cooldown period may have been triggered by a previous scaling event and is still active, blocking further scale-out actions despite sustained high utilization.

Answer

The EC2 instance is in a private subnet and cannot communicate with the Auto Scaling service.

Answer

The CloudWatch alarm is publishing to an S3 bucket that is full.

Answer

The scaling policy is based on memory utilization, not CPU.

Question 2

A company uses Amazon RDS for MySQL and wants to monitor the number of database connections in real time. Which CloudWatch metric should the SysOps administrator use?

Accepted Answer

DatabaseConnections. Amazon RDS for MySQL exposes a CloudWatch metric named `DatabaseConnections` that reports the number of client connections to the DB instance. This metric is derived from the MySQL `Threads_connected` status variable and is updated every minute, providing real-time visibility into connection counts for monitoring and alarming.

Answer

CPUUtilization

Answer

ActiveConnections

Answer

ConnectionCount

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team needs a centralized view of all API calls made across all accounts. Which solution should the SysOps administrator implement?

Accepted Answer

Create a CloudTrail trail in the management account that logs events for all accounts in the organization.. AWS CloudTrail supports an organization trail that, when created in the management account, automatically logs API calls for all member accounts in the AWS Organization. This provides a centralized, single point of access to all API activity across the organization without needing to configure individual trails per account.

Answer

Use AWS Config aggregator to view configuration changes across accounts.

Answer

Use CloudWatch cross-account dashboards to view metrics from all accounts.

Answer

Enable CloudTrail in each account and have each account send logs to its own S3 bucket.

Question 4

A company wants to back up its on-premises file server to AWS. The backup must be encrypted in transit and at rest. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Storage Gateway (File Gateway) backed by Amazon S3.. AWS Storage Gateway File Gateway provides a native NFS/SMB interface that allows on-premises file servers to back up data directly to Amazon S3. It encrypts data in transit using TLS (HTTPS) and at rest using S3 server-side encryption (SSE-S3 or SSE-KMS), meeting both requirements without custom scripting or additional infrastructure.

Answer

Amazon EBS volumes attached to an EC2 instance acting as a file server.

Answer

AWS CloudFormation to replicate the file server configuration.

Answer

Amazon S3 with server-side encryption and a custom script to upload files.

Question 5

A SysOps administrator is creating a CloudFormation template to provision an Amazon S3 bucket with versioning enabled and server access logging. Which TWO properties must be configured in the AWS::S3::Bucket resource?

Accepted Answer

VersioningConfiguration. The `VersioningConfiguration` property must be set to `Enabled` to enable versioning on the S3 bucket. Option C is correct because the `LoggingConfiguration` property must specify the target bucket and prefix to enable server access logging. Both are explicit properties of the `AWS::S3::Bucket` resource in CloudFormation.

Answer

Tags

Answer

LifecycleConfiguration

Answer

AccessControl

Question 6

A company is designing a multi-tier application in a VPC. The web tier must be in public subnets and the application tier in private subnets. The application tier needs to receive traffic only from the web tier. Which TWO configurations are required?

Accepted Answer

Configure the security group for the application tier to allow inbound traffic from the web tier's security group.. Security groups support stateful, rule-based traffic control using logical references to other security groups. By specifying the web tier's security group as the source in the application tier's inbound rule, traffic is allowed only from instances associated with that web tier security group, regardless of IP address changes. This provides a more secure and manageable configuration than using CIDR blocks, as it automatically adapts to scaling or instance replacements.

Answer

Use a network ACL on the private subnet to deny all inbound traffic except from the public subnet CIDR.

Answer

Add a route to the Internet Gateway in the private subnet's route table.

Answer

Assign public IP addresses to the application tier instances for outbound access.

Question 7

A SysOps administrator is configuring CloudTrail to log all management events and data events for S3 buckets. Which of the following are true about CloudTrail logging? (Choose THREE.)

Accepted Answer

CloudTrail logs include the identity of the user who made the API call. CloudTrail logs include the identity of the user or role that made the API call, captured as the `userIdentity` element in the log record. This element contains details such as the ARN, access key ID, and whether the call was made by an IAM user, federated user, or assumed role, enabling full auditability of who performed each action.

Answer

Data events for S3 are logged by default for all buckets

Answer

CloudTrail can log events for all AWS services automatically

Question 8

A company is designing a disaster recovery strategy for a production RDS for MySQL database. The database is currently single-AZ. The recovery point objective (RPO) is 1 hour, and the recovery time objective (RTO) is 15 minutes. Which steps should the SysOps administrator take to meet these requirements? (Choose THREE.)

Accepted Answer

Take manual DB snapshots every hour.. Manual DB snapshots can be taken on demand, and taking them every hour ensures that the recovery point objective (RPO) of 1 hour is met. In the event of a failure, you can restore the database from the latest manual snapshot, which provides a point-in-time recovery point within the RPO window. However, manual snapshots alone do not meet the 15-minute recovery time objective (RTO), so they must be combined with other measures like Multi-AZ and automated backups.

Answer

Disable automated backups to reduce performance impact.

Answer

Create a read replica in a different Availability Zone.

Question 9

A SysOps administrator is creating an IAM policy for automation. The policy is attached to an IAM role used by an automated deployment script. The script needs to launch EC2 instances of type t2.micro and describe all EC2 resources. However, the script fails when trying to launch instances. What is the MOST likely reason?

Accepted Answer

The policy does not grant permissions for additional resources required by RunInstances, such as images, network interfaces, and security groups.. The RunInstances API action requires permissions for not only the EC2 instance resource itself but also for dependent resources such as Amazon Machine Images (AMI), network interfaces, security groups, and key pairs. If the IAM policy only grants ec2:RunInstances on the instance resource ARN but omits these supporting resources, the launch will fail with an 'unauthorized operation' error. Option C correctly identifies this missing dependency.

Answer

The Resource ARN for the instance is incorrect.

Answer

The policy does not include the 'ec2:DescribeInstances' action.

Answer

The Condition key 'ec2:InstanceType' is misspelled.

Question 10

A SysOps administrator needs to audit all IAM user activity in the AWS account for the last 90 days. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM users, including console sign-in events, CLI commands, and SDK actions, and retains these logs for up to 90 days by default in the event history. This allows the SysOps administrator to audit all IAM user activity over the last 90 days without additional configuration.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 11

A company is running a web application on a fleet of EC2 instances behind an Application Load Balancer. The application experiences variable traffic patterns with predictable spikes every day at 2 PM. The company wants to optimize costs while maintaining performance. Which solution is MOST cost-effective?

Accepted Answer

Use scheduled scaling to add instances before the spike and remove them after.. Scheduled scaling is the correct answer because the traffic spikes are predictable and occur at a known time (2 PM daily). Scheduled scaling allows you to define a schedule (using cron expressions) to automatically increase the desired capacity of the Auto Scaling group before the spike and decrease it afterward, ensuring performance while minimizing costs during off-peak hours. This is more cost-effective than manual scaling because it eliminates the need for human intervention and ensures instances are only running when needed.

Answer

Use manual scaling by adjusting the desired capacity each day at 2 PM.

Answer

Purchase Reserved Instances for the entire fleet to reduce costs.

Answer

Use dynamic scaling policies based on CPU utilization.

Question 12

Refer to the exhibit. An application running on EC2 is using the AWS SDK to publish custom metrics to CloudWatch. The application fails to publish metrics. The IAM role attached to the EC2 instance has this policy. What is the issue?

Accepted Answer

The application may be using a different namespace than 'MyApp'.. The IAM policy explicitly allows 'cloudwatch:PutMetricData' on the condition that the namespace is 'MyApp'. If the application's AWS SDK code publishes metrics under a different namespace (e.g., 'AWS/EC2' or a custom namespace like 'MyOtherApp'), the condition fails and the API call is denied. This is the most likely cause of the failure, as the policy is otherwise correctly configured for the specified namespace.

Answer

The condition key 'cloudwatch:namespace' is misspelled.

Answer

The policy does not specify a specific resource ARN.

Answer

The action 'cloudwatch:PutMetricData' is not allowed for custom metrics.

Question 13

A SysOps administrator wants to back up an Amazon EBS volume that is attached to an EC2 instance running a production database. The backup must be crash-consistent and should not cause any downtime. Which TWO steps should the administrator take? (Choose two.)

Accepted Answer

Take a snapshot of the EBS volume after freezing.. Taking a snapshot after freezing the filesystem ensures that the snapshot captures a crash-consistent state of the EBS volume. Option E is correct because using a tool like fsfreeze flushes all pending I/O operations and freezes the filesystem, which prevents data inconsistencies without stopping the EC2 instance or detaching the volume.

Answer

Stop the EC2 instance before taking the snapshot.

Answer

Take a snapshot directly from the attached volume without any preparation.

Answer

Detach the volume from the instance before taking a snapshot.

Question 14

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a sticky session (session affinity) feature of the Application Load Balancer. During a scale-in event, some users lose their session data. What should the SysOps administrator do to prevent session data loss?

Accepted Answer

Store session state in an external data store such as Amazon ElastiCache.. Sticky sessions (session affinity) tie a user's session to a specific EC2 instance. When a scale-in event terminates that instance, the session data stored locally on the instance is lost. Storing session state in an external data store like Amazon ElastiCache decouples session data from individual instances, allowing any healthy instance to serve the user's request without data loss, even after a scale-in event.

Answer

Disable sticky sessions and use a round-robin routing algorithm.

Answer

Use a lifecycle hook to back up session data before termination.

Answer

Increase the Auto Scaling group's cooldown period to delay termination.

Question 15

A SysOps administrator is designing a backup strategy for an Amazon EFS file system. The file system stores critical data that must be recoverable within 15 minutes of a failure. Which solution meets these requirements?

Accepted Answer

Use AWS Backup to create automated backups of the EFS file system and restore to a new file system if needed.. AWS Backup provides a fully managed, policy-driven backup solution for Amazon EFS that supports automated, scheduled backups with point-in-time recovery. Restoring an EFS file system from a backup typically completes within minutes, meeting the 15-minute recovery time objective (RTO). This is the only option that directly addresses the requirement for recoverable backups with a defined RTO.

Answer

Configure EFS lifecycle management to move files to Infrequent Access storage class.

Answer

Take periodic EBS snapshots of the EC2 instance that mounts the EFS volume.

Answer

Create a Lambda function that copies files to an S3 bucket every hour.