SOA-C02 Practice Test 24 — 15 Questions

Question 1

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application experiences intermittent latency spikes. The SysOps administrator has enabled detailed CloudWatch metrics on the ALB and the EC2 instances. The administrator notices that during the latency spikes, the ALB's TargetResponseTime metric increases, but the EC2 instance's CPU utilization and memory usage remain normal. The administrator also observes that the number of concurrent connections to the ALB spikes during these periods. Which action should the administrator take to identify the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the ALB's ActiveConnectionCount and RequestCountPerTarget metrics to see if the load balancer is reaching its connection limit.. The ALB's ActiveConnectionCount and RequestCountPerTarget metrics directly indicate whether the load balancer is approaching its connection limit (default 50,000 for ALBs). During latency spikes, if concurrent connections spike but instance CPU/memory are normal, the bottleneck is likely at the load balancer level, not the instances. Analyzing these metrics helps determine if the ALB is queuing or dropping requests due to connection limits, causing increased TargetResponseTime.

Answer

Check the RDS database's DatabaseConnections metric to see if the database is overwhelmed.

Answer

Enable VPC Flow Logs and analyze the traffic patterns for dropped packets.

Answer

Enable detailed monitoring on the EC2 instances to capture CPU credits for burstable instances.

Question 2

A company has an AWS account with multiple VPCs connected via a transit gateway. The security team wants to centrally manage VPC security group rules and ensure compliance. Which approach is most effective?

Accepted Answer

Use AWS Firewall Manager to centrally define and enforce security group rules across all VPCs.. AWS Firewall Manager is the correct choice because it provides centralized administration of security group rules across multiple VPCs and accounts, enabling the security team to define a common set of rules and automatically enforce compliance. It integrates with AWS Organizations to apply policies to all VPCs in the organization, ensuring consistent security posture without manual intervention.

Answer

Create a single security group and attach it to all VPCs.

Answer

Define security group rules in AWS CloudFormation templates and deploy them to each VPC.

Answer

Use network ACLs instead of security groups for centralized management.

Question 3

Match each AWS compute service to its use case.

Accepted Answer

Amazon EC2: Full control over virtual servers including OS and software.. Amazon EC2 gives full server control; AWS Lambda runs serverless code; Amazon ECS manages containers. Distractors swap definitions with Lambda or Elastic Beanstalk.

Answer

Amazon EC2: Run code without provisioning or managing servers.

Answer

AWS Lambda: Managed container orchestration service.

Answer

Amazon ECS: Deploy web applications without managing infrastructure.

Question 4

A SysOps administrator is planning for disaster recovery of an RDS MySQL database. The database is currently in a single AZ. Which TWO actions will improve recovery time and reduce data loss? (Select TWO.)

Accepted Answer

Enable automated backups with a retention period of 7 days.. Enabling automated backups with a 7-day retention period allows point-in-time recovery (PITR) to any second within the retention window, minimizing data loss (RPO) by restoring to the most recent backup. Option C is correct because Multi-AZ deployment provides automatic synchronous standby replication to a different Availability Zone, enabling automatic failover with minimal downtime (RTO) in case of an AZ failure or instance issue.

Answer

Create a read replica in a different AWS Region.

Answer

Enable deletion protection on the RDS instance.

Answer

Increase the allocated storage to improve performance.

Question 5

A SysOps administrator is designing a disaster recovery strategy for a production RDS MySQL database. The database must be recoverable within 15 minutes with a Recovery Point Objective (RPO) of less than 5 seconds. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Enable Multi-AZ deployment for the RDS instance.. Multi-AZ deployment (Option B) provides automatic failover to a standby replica in a different Availability Zone, enabling recovery within minutes and meeting the 15-minute RTO. Cross-Region read replicas (Option C) allow asynchronous replication to another region with an RPO typically under 5 seconds, satisfying the RPO requirement. Together, they ensure both rapid failover and minimal data loss.

Answer

Create a read replica in the same AWS Region.

Answer

Enable automated backups with a retention period of 35 days.

Answer

Take manual snapshots every hour.

Question 6

A company wants to ensure that its EC2 instances receive patches automatically to maintain security compliance. Which AWS service can be used to automate patch management?

Accepted Answer

AWS Systems Manager. AWS Systems Manager Patch Manager automates the process of patching managed EC2 instances and on-premises servers. It uses patch baselines to define approved patches and can schedule patching across maintenance windows, ensuring security compliance without manual intervention.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

AWS CloudTrail

Question 7

A SysOps administrator needs to create a custom metric to track the number of active connections to an EC2 instance. Which steps should be taken? (Select TWO.)

Accepted Answer

Use the AWS CLI to call put-metric-data and publish the custom metric.. The AWS CLI `put-metric-data` command allows you to publish custom metrics directly to CloudWatch, which is the standard method for sending application-level or OS-level metrics that are not automatically provided by AWS. Option E is correct because the Amazon CloudWatch agent can collect custom metrics from the EC2 instance (e.g., active connection counts from netstat or a script) and publish them to CloudWatch, making it the recommended approach for in-guest metric collection.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Store the metric data in an S3 bucket and configure CloudWatch to read from it.

Answer

Use the EC2 console to enable custom metric collection.

Question 8

A SysOps administrator needs to ensure that an Amazon S3 bucket can withstand the loss of an entire AWS Availability Zone. What is the SIMPLEST configuration to meet this requirement?

Accepted Answer

Use S3 Standard storage class.. S3 Standard automatically stores objects across a minimum of three Availability Zones (AZs) within the same AWS Region. This design ensures that the bucket can withstand the loss of an entire AZ without any additional configuration, making it the simplest option to meet the requirement.

Answer

Enable cross-region replication to a bucket in another Region.

Answer

Use S3 One Zone-IA storage class.

Answer

Enable MFA Delete on the bucket.

Question 9

A company is designing a highly available architecture for a web application using AWS services. Which TWO actions should the SysOps administrator take to improve reliability? (Choose TWO.)

Accepted Answer

Use an Auto Scaling group with an Elastic Load Balancer.. An Auto Scaling group combined with an Elastic Load Balancer automatically distributes incoming traffic across healthy EC2 instances and replaces any failed instances, ensuring the application remains available even during instance failures or traffic spikes. This architecture is a core AWS best practice for building highly available and resilient web applications.

Answer

Use a single large EC2 instance to eliminate complexity.

Answer

Use a single NAT gateway for outbound traffic.

Answer

Store application data on a single EBS volume.

Question 10

A company runs a web application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an RDS MySQL database. The SysOps administrator needs to improve the reliability of the database layer. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Enable Multi-AZ on the RDS instance.. Enabling Multi-AZ on an RDS MySQL instance automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary instance fails, Amazon RDS automatically fails over to the standby, providing high availability and improving database reliability without manual intervention. This directly addresses the need for a resilient database layer.

Answer

Take a manual snapshot every hour.

Answer

Create a read replica in a different Region.

Answer

Increase the DB instance class to the largest available.

Question 11

Which THREE AWS services can be used to improve security and performance for a web application that uses an Application Load Balancer? (Select three.)

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protection against Distributed Denial of Service (DDoS) attacks, including application-layer attacks targeting the Application Load Balancer (ALB). It integrates directly with ALB to offer always-on detection and automatic mitigation, improving security without requiring changes to the application architecture.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 12

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is becoming unresponsive under high load. The administrator has enabled detailed monitoring and set up CPUUtilization alarms. Which THREE additional steps could help diagnose the root cause? (Choose THREE.)

Accepted Answer

Install the CloudWatch agent and collect disk space metrics.. Under high load, the web server could become unresponsive due to disk space exhaustion (e.g., from log files filling the root partition). The CloudWatch agent can collect disk space metrics, which are not available by default, allowing the administrator to correlate disk usage with performance degradation.

Answer

Place the instance behind an Auto Scaling group.

Answer

Increase the instance size to handle more load.

Question 13

A company uses Amazon CloudWatch to monitor its AWS infrastructure. The operations team wants to receive notifications when any EC2 instance's status check fails. Which TWO steps should be taken to achieve this?

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when the alarm state changes. This allows the operations team to receive immediate notifications (e.g., via email, SMS, or HTTP) when an EC2 instance's status check fails. Option E is also correct because the StatusCheckFailed metric (or StatusCheckFailed_Instance) directly reflects the result of the EC2 status check; setting an alarm with a threshold of greater than 0 triggers when any status check fails.

Answer

Create a CloudWatch alarm on the CPUUtilization metric with a threshold of 90%.

Answer

Enable AWS CloudTrail to capture instance state changes.

Answer

Install the CloudWatch agent on the instance and publish custom memory metrics.

Question 14

A company is using an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. The SysOps administrator notices that the scaling is not triggering as expected. Which THREE steps should the administrator take to troubleshoot the issue?

Accepted Answer

Check the scaling activity history in the Auto Scaling group for any errors or cooldown periods.. The scaling activity history provides a log of all scaling actions, including errors, cooldown periods, and why a scaling event was or was not triggered. By reviewing this history, the administrator can identify if the scaling policy was blocked by a cooldown period, if the alarm state was not reached, or if there were any configuration errors that prevented the scaling action from executing.

Answer

Ensure that the EC2 instances are passing the ELB health checks.

Answer

Manually increase the desired capacity to see if the scaling policy takes effect.

Question 15

A company uses Amazon CloudFront to serve content from an S3 bucket. The bucket is configured as an origin with Origin Access Control (OAC). Users report that they can access the content via CloudFront but also directly via the S3 bucket URL. How can the company restrict direct access to the S3 bucket?

Accepted Answer

Update the S3 bucket policy to deny access to any principal other than the CloudFront service.. With Origin Access Control (OAC), CloudFront signs requests to S3, and the S3 bucket policy must be updated to allow only the CloudFront distribution (via the cloudfront.amazonaws.com service principal with a condition on the distribution ARN) and deny all other principals. This blocks direct access via the S3 URL while preserving CloudFront access.

Answer

Disable OAC and use Origin Access Identity (OAI) instead.

Answer

Use pre-signed URLs for all S3 requests.

Answer

Remove the bucket policy and rely on ACLs.