SOA-C02 Practice Test 2 — 25 Questions

Question 1

A SysOps administrator is creating an AWS CloudFormation template to deploy a web application. The template will create an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The administrator wants to ensure that the Auto Scaling group is created only after the ALB and the RDS database are fully created and available. Which TWO actions should the administrator take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources.. To ensure the Auto Scaling group is created only after both the ALB and RDS database are fully available, the administrator should add a DependsOn attribute to the Auto Scaling group that lists both the ALB and RDS resources (Option B). This ensures CloudFormation creates the group after those resources. Additionally, a CreationPolicy on the RDS database resource (Option D) can be used to wait for a signal (e.g., from a cfn-signal script) indicating that the database is fully operational and accepting connections, ensuring it is 'fully available' before the Auto Scaling group creation proceeds. Option A is incorrect because it only lists the ALB, ignoring RDS. Option C is irrelevant for creation order. Option E addresses instance signaling, not resource creation.

Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists only the ALB resource.

Answer

Add an UpdatePolicy to the Auto Scaling group resource to wait for a signal.

Answer

Add a CreationPolicy to the Auto Scaling group resource to wait for a signal from the instances.

Question 2

A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 privately without needing a NAT Gateway or internet gateway. Option A is incorrect because a NAT Gateway requires an internet gateway and does not provide private access. Option C is incorrect because S3 Transfer Acceleration is for faster transfers over the internet, not private connectivity. Option D is incorrect because although a VPC Interface Endpoint can also provide private access to S3, the Gateway Endpoint is the recommended solution for S3 due to lower cost and simpler configuration.

Answer

Set up a NAT Gateway in a public subnet and route traffic through it.

Answer

Use S3 Transfer Acceleration.

Answer

Create a VPC Interface Endpoint for S3.

Question 3

A SysOps Administrator manages a VPC with public and private subnets. The private subnets need to access the internet for software updates. The Administrator creates a NAT Gateway in a public subnet and updates the private subnet route table to point 0.0.0.0/0 to the NAT Gateway. However, instances in the private subnet still cannot reach the internet. What is the MOST likely reason?

Accepted Answer

The NAT Gateway does not have an Elastic IP address assigned.. A NAT Gateway must have an Elastic IP (EIP) address assigned to it in order to function as an internet gateway for private subnets. Without an EIP, the NAT Gateway cannot communicate with the internet. Option A is unlikely because security groups allow outbound traffic by default. Option B is incorrect because the internet gateway attaches to the VPC, not to the NAT Gateway. Option D is incorrect because NAT Gateways do not have security groups; they use network ACLs at the subnet level, but the issue here is the missing EIP.

Answer

The security group on the private instances blocks outbound HTTPS traffic.

Answer

The internet gateway is not attached to the NAT Gateway.

Answer

The NAT Gateway's security group is blocking inbound traffic from the private subnet.

Question 4

A SysOps administrator needs to reduce data transfer costs for a web application hosted on EC2 instances in a VPC. The application serves content to users over the internet. Which TWO actions will help reduce data transfer costs? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for Amazon S3 to keep S3 traffic within AWS.. The correct answers are B and C. Using a VPC Gateway Endpoint for Amazon S3 allows instances to access S3 over the AWS network without traversing the internet, reducing data transfer costs. Amazon CloudFront caches content at edge locations worldwide, so users receive content from edge locations instead of the EC2 origin, reducing data transfer from EC2 to the internet. Option A is incorrect because migrating to private subnets and using AWS Direct Connect does not serve users over the internet; Direct Connect is a dedicated network connection that does not reduce data transfer costs for internet users. Option D is incorrect because an Application Load Balancer distributes traffic but does not inherently reduce data transfer costs; it may even add cost. Option E is incorrect because a larger NAT Gateway increases cost and does not reduce data transfer costs for outbound traffic.

Answer

Move all instances to private subnets and use AWS Direct Connect for user access.

Answer

Use an Application Load Balancer to distribute traffic.

Answer

Use a larger NAT Gateway to improve throughput.

Question 5

A company runs a batch processing job every night that takes 2 hours on a single m5.xlarge EC2 instance. The job is fault-tolerant and can be interrupted. The SysOps administrator wants to reduce costs. Which solution is MOST cost-effective?

Accepted Answer

Use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available.. The most cost-effective solution is to use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available (Option B). The job is fault-tolerant and can be interrupted, making it ideal for Spot Instances which offer significant cost savings (up to 90% compared to On-Demand). The Spot Fleet with an On-Demand fallback ensures the job completes even if Spot capacity is unavailable. Option A (On-Demand with CloudWatch alarm) does not reduce costs since On-Demand is more expensive. Option C (Dedicated Host) is costly and unnecessary for a batch job. Option D (Reserved Instance) requires a 1- or 3-year commitment and is not cost-effective for a 2-hour daily job.

Answer

Use an On-Demand instance and set up a CloudWatch alarm to stop it when the job completes.

Answer

Use a Dedicated Host to run the job.

Answer

Purchase a Reserved Instance for the m5.xlarge instance.

Question 6

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 7

A company runs a production web application on a single Amazon EC2 instance. The application experiences a predictable and steady workload 24/7. The SysOps administrator wants to minimize compute costs for this instance while ensuring it remains available during the expected workload. Which EC2 purchasing option should the administrator use?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the most cost-effective option for a predictable, steady-state workload running 24/7. By committing to a 1- or 3-year term, you receive a significant discount (up to 72%) compared to On-Demand pricing, while still ensuring the instance remains available for the expected workload. This matches the requirement to minimize compute costs without sacrificing availability.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 8

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 9

A company wants to receive alerts when its AWS costs exceed a certain threshold. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets and receive alerts when actual or forecasted costs exceed a defined threshold. It directly supports cost-based alerting with actions such as sending an SNS notification or applying an IAM policy to restrict resources when the budget limit is breached.

Answer

Amazon CloudWatch

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 10

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

Accepted Answer

Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.. A KMS key policy can use the 'aws:SourceVpc' condition key to restrict usage of the key to requests originating from a specific VPC. Option A is incorrect because S3 bucket policies cannot directly restrict KMS key usage; they can only control access to S3 objects. Option C is incorrect because IAM policies can include conditions based on source VPC for certain services, but for KMS actions, the condition must be in the key policy itself, not an IAM policy. Option D is incorrect because network ACLs operate at the subnet level and control network traffic, not API calls to KMS; they cannot restrict access to the KMS service.

Answer

Add a condition in the S3 bucket policy to allow only requests from the VPC.

Answer

Use an IAM policy with a condition that requires the request to come from the VPC.

Answer

Configure a network ACL that blocks all traffic to KMS except from the VPC.

Question 11

A company is using Amazon S3 to store historical data. The data is accessed frequently for the first 30 days, then accessed infrequently for the next 90 days, and after 120 days it is rarely accessed but must be retained for 7 years for compliance. Which S3 lifecycle policy provides the LOWEST cost while meeting these requirements?

Accepted Answer

Standard for 30 days, then transition to Standard-IA for 90 days, then to Glacier Deep Archive.. It aligns the storage class transitions precisely with the access patterns: Standard for frequent access (first 30 days), Standard-IA for infrequent access (next 90 days), and Glacier Deep Archive for long-term retention (after 120 days). This minimizes cost by avoiding paying for premium storage when data is rarely accessed, while still meeting the 7-year compliance requirement at the lowest possible storage cost.

Answer

Standard for 30 days, then transition to One Zone-IA for 90 days, then to Glacier Deep Archive.

Answer

Standard for 120 days, then transition to Glacier Deep Archive.

Answer

Standard for 30 days, then transition to Glacier for the remaining life.

Question 12

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

Accepted Answer

AWS Config with a custom rule and AWS Lambda. AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Answer

AWS CloudTrail and Amazon CloudWatch Events

Answer

AWS Service Catalog and AWS Organizations

Answer

Amazon Inspector and AWS Systems Manager

Question 13

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

Accepted Answer

Perform a rolling update based on health.. A rolling update based on health (Option D) is the correct method to minimize downtime when updating an instance type in Elastic Beanstalk. This approach updates instances in batches, replacing them with the new instance type only after the previous batch passes health checks, ensuring application availability throughout the process. Elastic Beanstalk's rolling update with health-based batching terminates and launches instances incrementally, avoiding full environment disruption.

Answer

Terminate all instances and let the Auto Scaling group launch new ones.

Answer

Perform an immutable update.

Answer

Clone the environment with the new configuration and swap URLs.

Question 14

A SysOps administrator is investigating a cost increase in a production AWS account. They notice that an EC2 instance with a Reservation has been running continuously for months. The instance type is m5.large in us-east-1. The administrator sees that the instance is using a Standard Reserved Instance (RI) that was purchased 6 months ago for a 1-year term. However, the current utilization shows that the instance is only used for 4 hours per day. What should the administrator do to optimize costs without affecting availability?

Accepted Answer

Modify the existing RI to a smaller instance size (e.g., m5.large to m5.xlarge? no, smaller: e.g., t3.medium) and use Auto Scaling with a schedule to start/stop the instance during business hours.. By modifying the existing Standard RI to a smaller instance size (e.g., within the same family or by converting to a Convertible RI to allow family changes), the administrator can better match the actual low utilization pattern. Additionally, using Auto Scaling with a scheduled scaling policy to start and stop the instance during business hours ensures availability during needed times and reduces waste. Option A is incorrect because stopping the instance does not stop the RI charges; Reserved Instance benefits are applied only to running instances, so the RI would be wasted during off-hours. Option B is incorrect because selling the RI on the Reserved Instance Marketplace typically incurs a loss of the upfront payment and does not directly address the over-provisioning issue. Option D is incorrect because converting to a larger instance family would increase compute capacity per hour, leading to higher costs and even more waste given the low utilization.

Answer

Stop the instance during off-hours using Instance Scheduler, but keep the RI as-is.

Answer

Sell the current RI on the Reserved Instance Marketplace and purchase a new Convertible RI for a smaller instance type.

Answer

Convert the RI to a Convertible RI and exchange it for a larger instance family to get more compute per hour.

Question 15

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. The first thing to check when private instances cannot reach an external service is the route table for the private subnet. The private subnet must have a route 0.0.0.0/0 pointing to the NAT Gateway to route internet-bound traffic through it. Option B is incorrect because the NAT Gateway must have an Elastic IP to be reachable from the internet, but the issue described is outbound access from private instances; the NAT Gateway's Elastic IP is necessary but not the first check. Option C is incorrect because security groups for NAT Gateways are not used; NAT Gateways do not have security groups; instead, network ACLs on the subnets control traffic. Option D is incorrect because the internet gateway must be attached to the VPC for the NAT Gateway to work, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.

Question 16

A SysOps team manages a fleet of EC2 instances used for batch processing. The workload runs daily, taking approximately 6 hours. The instances are launched via an Auto Scaling group using On-Demand instances from a custom AMI. The team has noticed that while the instances are running, the CPU utilization is moderate, but the memory usage is high. After the batch completes, the instances are terminated. The team wants to reduce costs without changing the architecture. Which solution would be MOST cost-effective?

Accepted Answer

Modify the Auto Scaling group to use a mixed instances policy with a percentage of Spot Instances and a fallback to On-Demand.. Spot Instances can provide significant discounts (up to 90%) for fault-tolerant batch workloads, and the team can use a mixed instances policy with On-Demand as a fallback. Option B (memory optimized instances) would likely increase cost. Option C (reserved instances) is not suitable for short-lived, sporadic workloads. Option D (savings plan) could help but still requires committing to a consistent amount, which may not align with the varying batch size. Option A offers the most flexibility and cost savings.

Answer

Use a Compute Savings Plan covering the entire compute usage across the account.

Answer

Change the instance type to a memory-optimized family to reduce the number of instances needed.

Answer

Purchase Reserved Instances for the expected daily usage to get a lower hourly rate.

Question 17

A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?

Accepted Answer

Private subnet route table with a route to the NAT Gateway. The correct answers are D and E. A NAT Gateway placed in a public subnet (E) provides outbound internet access for instances in private subnets. The private subnet's route table must have a route pointing to the NAT Gateway (D) for internet-bound traffic. VPC Peering (A) connects VPCs but does not provide internet access. An Internet Gateway (C) attached to the VPC enables internet access for public subnets, but private subnets should not have a direct route to it. Option B (private route to IGW) would make the subnet public, violating the requirement. Therefore, D and E together provide the desired outbound-only internet access.

Answer

VPC Peering connection

Answer

Private subnet route table with a route to the Internet Gateway

Answer

Internet Gateway attached to the VPC

Question 18

A SysOps administrator notices that an S3 bucket's storage costs have increased significantly. The bucket stores log files and is configured with S3 Standard storage class. Most logs are accessed only once after 30 days. Which action will reduce costs without affecting data retrieval?

Accepted Answer

Create a lifecycle policy to transition objects to S3 Glacier Instant Retrieval after 30 days.. Transitioning to S3 Glacier Instant Retrieval after 30 days reduces storage cost while maintaining millisecond access. Option A is wrong because S3 Standard-IA has retrieval fees that might increase cost for single access. Option B is wrong because S3 Glacier Deep Archive has long retrieval times (hours), making it unsuitable for logs that may need to be accessed occasionally. Option D is wrong because S3 One Zone-IA is less durable (does not replicate across AZs) and may not be appropriate for log data.

Answer

Create a lifecycle policy to transition objects to S3 Standard-IA after 30 days.

Answer

Create a lifecycle policy to transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Create a lifecycle policy to transition objects to S3 One Zone-IA after 30 days.

Question 19

A SysOps administrator is investigating a security breach. An IAM user 'Bob' is suspected of performing unauthorized actions. The administrator needs to determine the source IP addresses from which Bob's access keys were used in the last 30 days. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail event history.. AWS CloudTrail event history provides a record of all API calls made by IAM users, including the source IP address from which the request originated. By filtering the event history for the IAM user 'Bob' and the time range of the last 30 days, the administrator can identify the source IP addresses associated with each API call made using Bob's access keys. This directly meets the requirement to determine the source IP addresses of unauthorized actions.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Answer

AWS IAM credential report.

Question 20

A company wants to ensure that its Amazon RDS database can withstand the loss of an entire Availability Zone. Which feature should the SysOps administrator enable?

Accepted Answer

Enable Multi-AZ deployment.. Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, ensuring database availability without manual intervention. This is the only option that directly protects against an entire AZ loss by maintaining a hot standby in a separate AZ.

Answer

Enable automated backups with a retention period of 35 days.

Answer

Take manual snapshots and copy them to another Region.

Answer

Create a read replica in a different Availability Zone.