SOA-C02 Practice Test 25 — 15 Questions

Question 1

A company has a VPC with public and private subnets. The private subnets host application servers that need to make outbound HTTPS connections to the internet. The SysOps administrator must implement a solution that provides outbound internet connectivity while preventing inbound connections from the internet. Additionally, the solution must allow the company to control which domains the application servers can access. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a NAT instance with proxy software and use route tables to direct traffic from private subnets to the NAT instance.. A NAT instance with proxy software (e.g., Squid) allows outbound HTTPS connections from private subnets while blocking inbound connections, and the proxy software can enforce domain-level access control via allow/deny lists. This meets the requirement to restrict which domains the application servers can access, which a standard NAT Gateway cannot do because it only translates IP addresses and cannot filter by domain name.

Answer

Configure a NAT Gateway and use security group outbound rules to restrict destinations.

Answer

Configure an egress-only Internet Gateway and route private subnet traffic to it.

Answer

Configure a VPC endpoint for HTTPS and route private subnet traffic to it.

Question 2

A company has an Auto Scaling group of EC2 instances behind an Application Load Balancer. The SysOps administrator notices that the healthy host count is lower than expected. The instances are in service, and security groups allow traffic. What is a likely cause?

Accepted Answer

The health check path is returning HTTP 503.. A health check path returning HTTP 503 (Service Unavailable) indicates that the target instances are reachable but the application is failing to respond correctly. The Application Load Balancer (ALB) marks instances as unhealthy when the health check receives any non-2xx or non-3xx response, which reduces the healthy host count even though the instances are in service and security groups are properly configured.

Answer

The instances are not registered with the target group.

Answer

The security group for the load balancer does not allow inbound traffic.

Answer

The target group is not associated with the load balancer.

Question 3

Which TWO statements about Amazon CloudFront origins are correct? (Choose two.)

Accepted Answer

CloudFront can use an Application Load Balancer as an origin.. CloudFront can use an Application Load Balancer (ALB) as a custom origin. This allows you to distribute traffic from a web application running behind an ALB, enabling dynamic content delivery with CloudFront's edge caching and HTTPS termination.

Answer

CloudFront only supports HTTP origins, not HTTPS.

Answer

CloudFront can only use S3 buckets as origins.

Answer

CloudFront origins must be in the same region as the distribution.

Question 4

A company uses AWS CodeDeploy to deploy an application to Amazon EC2 instances. The SysOps administrator wants to implement a deployment strategy that minimizes risk by deploying the new version to a small number of instances first, verifying that the deployment is successful, and then deploying to the remaining instances. If the initial deployment fails, the process should stop and roll back. Which CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime, is correct because it deploys the new application revision to one instance at a time, checking for success before proceeding to the next. If any deployment step fails, the process stops and automatically rolls back, minimizing risk by limiting the blast radius of a bad deployment.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.Canary10Percent10Minutes

Question 5

A company is using AWS CloudTrail to log API activity. The security team wants to be notified when an IAM user attempts to modify an S3 bucket policy. Which actions should be taken to meet this requirement? (Select THREE.)

Accepted Answer

Create an Amazon EventBridge rule that matches the PutBucketPolicy API call via CloudTrail.. Amazon EventBridge can match specific API calls (like PutBucketPolicy) by using CloudTrail as an event source. This allows the security team to trigger a notification when an IAM user attempts to modify an S3 bucket policy, without needing to poll or set up custom monitoring.

Answer

Create a CloudWatch alarm on the number of PutBucketPolicy calls.

Answer

Enable CloudTrail data events for S3 to capture bucket policy changes.

Question 6

Refer to the exhibit. A SysOps administrator ran the commands shown. What is the state of the EC2 instance?

Accepted Answer

The instance is running but has a system impairment.. The `aws ec2 describe-instance-status` command with the `--instance-id` flag returns the instance's system status checks. The output shows `SystemStatus: impaired`, which indicates that the instance is running but has a system impairment (e.g., loss of network connectivity or power). This status is determined by AWS's automated status checks that run every minute, and an impaired status means the underlying host has an issue that affects the instance.

Answer

The instance is running and healthy.

Answer

The instance is terminated.

Answer

The instance is stopped.

Question 7

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application is deployed in a single Availability Zone. The SysOps administrator notices that during peak hours, the application becomes slow and some requests fail. CloudWatch metrics show that CPU utilization on the instances reaches 90%, but the Auto Scaling group does not scale out. The administrator has configured a target tracking scaling policy based on average CPU utilization with a target value of 75%. The Auto Scaling group has a minimum of 2, maximum of 10, and desired capacity of 2. What is the MOST likely reason the Auto Scaling group is not scaling out?

Accepted Answer

The Auto Scaling group is configured with a single Availability Zone, and the target tracking policy cannot scale out beyond the capacity of that single AZ.. The most likely reason is that the Auto Scaling group is configured with a single Availability Zone. Target tracking scaling policies operate within the constraints of the configured subnets. If the group is only in one AZ, the subnet may have insufficient IP addresses or the AZ may have reached its instance limit, preventing the group from scaling out beyond that AZ's capacity. Since the group has a maximum of 10, but the AZ capacity is limited, the scaling policy cannot add more instances. This is a common issue: AWS recommends using multiple Availability Zones for Auto Scaling groups to allow scaling across AZs and avoid single points of failure.

Answer

The target tracking policy uses a target value of 75%, but the average CPU is above that, so it should scale out.

Answer

The target tracking policy requires detailed monitoring to be enabled on the instances.

Answer

The Auto Scaling group has reached its maximum capacity of 10 instances.

Question 8

A company requires that all API calls to AWS services be logged for compliance. The logs must be stored in a centralized S3 bucket with server-side encryption enabled. Which AWS service should be used to capture the API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across AWS services, capturing who made what call, from where, and when, and can deliver logs to a centralized S3 bucket with SSE enabled. It is the designated service for auditing API calls for compliance.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 9

A SysOps administrator needs to monitor the disk space usage on an EC2 instance running Windows Server. Which actions are required to collect this metric? (Select TWO.)

Accepted Answer

Create an IAM role with permissions to publish custom metrics and attach it to the instance.. Option E is correct because the CloudWatch agent is the AWS-supported tool that runs on a Windows Server EC2 instance and can be configured (via the wizard or a JSON config file) to collect disk metrics such as LogicalDisk % Free Space and publish them to CloudWatch. Option D is correct because the agent needs AWS credentials to call cloudwatch:PutMetricData, and attaching an IAM role with permissions to publish custom metrics to the instance provides those credentials without hardcoding keys. Option A is wrong because the CloudWatch Logs agent ships log files, not disk-space metrics, so it cannot collect this metric. Option B is wrong because EC2 status checks report instance and system reachability (hypervisor and network level), not guest OS disk space. Option C is wrong because Windows Performance Monitor alone does not send data to CloudWatch; you still need the CloudWatch agent to publish those counters as metrics.

Answer

Install the CloudWatch Logs agent to monitor disk usage logs.

Answer

Enable EC2 status checks to monitor disk health.

Answer

Use Windows Performance Monitor to track disk space and send to CloudWatch.

Question 10

A SysOps administrator is configuring a new VPC and wants to ensure that only traffic from a specific IP address range can access an EC2 instance via SSH. Which TWO components should be configured? (Choose two.)

Accepted Answer

Network ACL (NACL). To restrict SSH access to a specific IP range, you configure a network ACL at the subnet level and a security group at the instance level. NACLs are stateless and evaluate rules in order; security groups are stateful. Both can allow inbound SSH from the specific IP range. Internet gateway enables internet access but does not filter by IP. Route tables direct traffic but do not filter. VPC endpoint is for private connectivity to AWS services.

Answer

VPC endpoint

Answer

Internet gateway

Answer

Route table

Question 11

An organization is using OpsWorks to manage a stack of application servers. They need to automatically scale out based on CPU utilization. Which configuration should the SysOps administrator use to achieve this?

Accepted Answer

Add a load-based layer and configure the scaling thresholds for CPU utilization.. OpsWorks load-based layers automatically scale instances based on CloudWatch alarms, such as CPU utilization thresholds. Option A is incorrect because auto-healing replaces failed instances, not scales out. Option B is incorrect because custom Chef recipes run on lifecycle events (setup, configure, etc.) but do not directly handle automatic scaling. Option D is incorrect because time-based instances scale on a schedule, not based on CPU utilization.

Answer

Enable auto-healing on the layer to replace unhealthy instances automatically.

Answer

Create a custom Chef recipe that runs on a lifecycle event to launch new instances.

Answer

Configure a time-based instance with a recurring schedule to add instances during peak hours.

Question 12

A company has a production AWS account that uses Consolidated Billing with several member accounts. The finance team wants to identify the top cost drivers and allocate costs to different departments. Which AWS tool should be used to visualize and allocate costs?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer allows visualization and filtering of costs by tags, accounts, and services, enabling cost allocation and identification of top cost drivers. AWS Organizations (A) is used to centrally manage policies and accounts but does not provide cost visualization. AWS Trusted Advisor (B) offers best practice recommendations but not detailed cost analysis. AWS Budgets (D) sets budget alerts but does not provide historical cost exploration or allocation.

Answer

AWS Organizations

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Question 13

A SysOps administrator needs to grant an IAM user the ability to rotate their own access keys. What is the minimum set of permissions required?

Accepted Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey. The minimum permissions to allow an IAM user to rotate their own access keys are: iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, and iam:UpdateAccessKey. Option D is correct. Option A is wrong because it includes iam:PutUserPolicy, which is unnecessary for key rotation and grants additional permissions to modify user policies. Option B is wrong because it includes kms:*, which is unrelated to access key rotation and grants excessive permissions. Option C is wrong because it includes iam:GetUser, which is not required for rotating own keys; the user already knows their username or can be resolved via the policy variable.

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:PutUserPolicy

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, kms:*

Answer

iam:GetUser, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey

Question 14

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The SysOps administrator checks the deployment logs and finds that the BeforeInstall lifecycle event script is failing on some instances. The instances are Amazon Linux 2. What should the administrator do to troubleshoot this issue?

Accepted Answer

Review the BeforeInstall script's output and exit code in the deployment logs or on the instance.. The error indicates that the BeforeInstall lifecycle script is failing. The correct first step is to examine the script's output and exit code, which can be found in the deployment logs (under the instance's CodeDeploy agent logs) or directly on the instance. This allows you to identify why the script is failing. Option A is not directly relevant because the issue is not agent connectivity but script execution. Option B is incorrect because changing the deployment configuration to 'OneAtATime' would only affect the pace of deployments, not fix a failing script. Option C is unnecessary because the appspec.yml syntax is likely correct if the script runs at all; the problem lies in the script itself.

Answer

Verify that the CodeDeploy agent on the instances is running and can communicate with the CodeDeploy service.

Answer

Ensure that the CodeDeploy deployment configuration is set to 'OneAtATime' to reduce instance failures.

Answer

Check the appspec.yml file for syntax errors in the hooks section.

Question 15

A web application on EC2 instances behind an ALB experiences increased latency during peak hours. The SysOps administrator notices that the ALB's RequestCount per target is high. What design change should improve performance?

Accepted Answer

Add more EC2 instances to the target group.. Increasing the number of targets (EC2 instances) spreads the load and reduces latency.

Answer

Switch to a Network Load Balancer.

Answer

Enable sticky sessions on the ALB.

Answer

Reduce the idle timeout on the ALB.