SOA-C02 Practice Test 3 — 25 Questions

Question 1

A company runs a batch processing job every night that takes 2 hours on a single m5.xlarge EC2 instance. The job is fault-tolerant and can be interrupted. The SysOps administrator wants to reduce costs. Which solution is MOST cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available.. The most cost-effective solution is to use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available (Option B). The job is fault-tolerant and can be interrupted, making it ideal for Spot Instances which offer significant cost savings (up to 90% compared to On-Demand). The Spot Fleet with an On-Demand fallback ensures the job completes even if Spot capacity is unavailable. Option A (On-Demand with CloudWatch alarm) does not reduce costs since On-Demand is more expensive. Option C (Dedicated Host) is costly and unnecessary for a batch job. Option D (Reserved Instance) requires a 1- or 3-year commitment and is not cost-effective for a 2-hour daily job.

Answer

Use an On-Demand instance and set up a CloudWatch alarm to stop it when the job completes.

Answer

Use a Dedicated Host to run the job.

Answer

Purchase a Reserved Instance for the m5.xlarge instance.

Question 2

A company is running a stateful web application on a single EC2 instance with a 500 GB gp2 EBS volume. The instance is currently at 80% CPU and memory utilization during peak hours. The company wants to improve performance and scalability without incurring high costs. What should the SysOps administrator do?

Accepted Answer

Implement an Application Load Balancer with an Auto Scaling group to distribute traffic across multiple instances.. Implementing an Application Load Balancer (ALB) with an Auto Scaling group allows the application to scale horizontally (scale out) based on demand. This improves both performance and scalability while optimizing costs because you only pay for the resources you use. Option B (vertical scaling) is incorrect because upgrading to a larger instance may require downtime and does not provide the same level of scalability; it also might be more costly. Option C (increasing swap space) is a temporary fix that does not address the root cause of high CPU and memory utilization; excessive swapping can degrade performance. Option D (migrating to gp3) improves I/O performance but does not help with CPU or memory constraints, and it does not enable scalability.

Answer

Upgrade the instance to a larger size (vertical scaling).

Answer

Increase the swap space on the instance to handle memory pressure.

Answer

Migrate the EBS volume from gp2 to gp3 to improve I/O performance.

Question 3

A company has a VPC with public and private subnets. The private subnets contain RDS databases that should not be accessible from the internet. Which configuration ensures that the databases are only accessible from the application servers in the public subnets?

Accepted Answer

Create a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers.. Security groups act as a virtual firewall at the instance level, and you can reference another security group as a source. By creating a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers, you ensure that only those application servers (regardless of their IP addresses) can reach the databases. This approach is more dynamic and secure than using CIDR-based rules, as it automatically accommodates changes in the application servers' IP addresses or scaling events.

Answer

Attach an internet gateway to the VPC and route the private subnet's traffic to it.

Answer

Attach a NAT gateway to the private subnet and route traffic through it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

Question 4

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should the administrator use to set up an alarm based on the status check metric?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because EC2 instance status checks are published as CloudWatch metrics (e.g., StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System). A CloudWatch Alarm can be configured to monitor these metrics and trigger an action, such as sending a notification via Amazon SNS, when the alarm state changes to ALARM. This directly meets the requirement to receive a notification when a status check fails.

Answer

Amazon EventBridge

Answer

AWS Config

Answer

AWS Systems Manager

Question 5

A company is using AWS CloudTrail to log API activity. They need to ensure that log files are protected from unauthorized modification and can be used to verify the integrity of log files. Which AWS feature should be enabled?

Accepted Answer

Enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation uses a SHA-256 hash chain to create a digest file that can be used to verify that log files have not been modified, deleted, or tampered with after delivery. This feature is specifically designed to provide cryptographic assurance of log file integrity, meeting the requirement to protect against unauthorized modification and enable verification.

Answer

Enable S3 server-side encryption on the CloudTrail S3 bucket.

Answer

Stream CloudTrail logs to Amazon CloudWatch Logs.

Answer

Enable S3 Multi-Factor Authentication (MFA) Delete on the CloudTrail S3 bucket.

Question 6

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) for traffic distribution. The SysOps administrator has configured a CloudWatch alarm to monitor the ALB's `TargetResponseTime` metric, with a threshold of 5 seconds. The alarm triggers when the average response time exceeds 5 seconds for 2 consecutive periods. Recently, the alarm has been triggering frequently during peak hours, but the application team reports that the response time is acceptable and the application is performing normally. The administrator investigates and finds that a small number of requests are taking a very long time (over 30 seconds), skewing the average. The administrator needs to reduce the number of false alarms while still being alerted if the overall application performance degrades. Which course of action should the administrator take?

Accepted Answer

Change the statistic to p95 and keep the threshold at 5 seconds. Using the p95 (95th percentile) statistic instead of the average filters out the impact of the small number of outlier requests that take over 30 seconds. The p95 metric shows the response time below which 95% of requests fall, providing a more accurate representation of typical application performance. This reduces false alarms from skewed averages while still alerting if the majority of users experience degraded response times exceeding 5 seconds.

Answer

Increase the threshold to 30 seconds

Answer

Decrease the period to 60 seconds and lower the threshold to 3 seconds

Answer

Increase the evaluation periods to 5 consecutive periods

Question 7

A SysOps administrator uses AWS CloudFormation to deploy a three-tier application. The administrator has a single template that can be used for development, test, and production environments. The only differences between environments are the EC2 instance type and the RDS DB instance class. Which CloudFormation feature should the administrator use to define these environment-specific values without duplicating the template?

Accepted Answer

Parameters. Parameters allow you to input environment-specific values (e.g., EC2 instance type, RDS DB instance class) at stack creation or update time without modifying the template. This is the correct feature because the question explicitly requires defining values that differ per environment while reusing a single template.

Answer

Conditions

Answer

Mappings

Answer

Outputs

Question 8

A SysOps admin is troubleshooting an Auto Scaling group that fails to launch instances. The group uses a launch template with an Amazon Linux 2 AMI. The admin reviews the scaling activity history and sees: 'Launching a new EC2 instance. Status: Failed. Description: Your spot request price is lower than the minimum required Spot price.' Which change should the admin make to resolve the issue?

Accepted Answer

Increase the maximum price for the Spot request in the launch template. The error message indicates that the Spot Instance request failed because the maximum price specified in the launch template is below the current Spot market price. By increasing the maximum price in the launch template (Option A), you allow the Spot request to meet or exceed the minimum required Spot price, enabling the Auto Scaling group to successfully launch instances. This is the direct fix for the price-related failure.

Answer

Modify the Auto Scaling group to use On-Demand instances instead of Spot

Answer

Change the Auto Scaling group to a different AWS Region

Answer

Increase the desired capacity of the Auto Scaling group

Question 9

A SysOps administrator is asked to ensure that all objects in an S3 bucket are encrypted at rest using a customer-managed KMS key. The bucket currently has default encryption set to SSE-S3. What must be done to meet the requirement?

Accepted Answer

Update the bucket's default encryption to SSE-KMS using the customer-managed key, and re-upload existing objects.. Default encryption on an S3 bucket only applies to newly uploaded objects; existing objects remain encrypted with the previous method (SSE-S3). To ensure all objects are encrypted at rest with a customer-managed KMS key, you must update the bucket's default encryption to SSE-KMS with the desired key and then re-upload (or copy) existing objects so they inherit the new encryption setting. Simply changing the default encryption does not retroactively re-encrypt objects already stored.

Answer

Add a bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.

Answer

Apply a service control policy to enforce SSE-KMS across the organization.

Answer

Enable S3 Versioning and set the bucket's default encryption to SSE-KMS.

Question 10

A company wants to ensure that its EC2 instances automatically recover from an instance failure. Which feature should be used?

Accepted Answer

Enable EC2 Auto Recovery on the instance.. EC2 Auto Recovery is a feature that automatically recovers an EC2 instance when it becomes impaired due to an underlying hardware or system issue. When enabled, CloudWatch monitors the instance's status checks and, upon detecting a failure, automatically stops and starts the instance on a new healthy host, preserving its private IP, Elastic IP, and instance metadata.

Answer

Create a CloudWatch alarm that sends an email when the instance status check fails.

Answer

Configure an Auto Scaling group with a launch configuration.

Answer

Attach the instance to an Elastic Load Balancer.

Question 11

A company is designing a highly available web application on AWS. The application runs on EC2 instances behind an Application Load Balancer. Which configuration ensures that the application remains available if an entire AWS Availability Zone fails?

Accepted Answer

Launch EC2 instances in at least two different Availability Zones.. Deploying EC2 instances in at least two different Availability Zones (AZs) ensures that if one AZ fails, the Application Load Balancer (ALB) can route traffic to healthy instances in the remaining AZ(s). ALBs are regional constructs that automatically distribute traffic across registered targets in multiple AZs, and they perform health checks to detect and route away from failed AZs. This design meets the high availability requirement by eliminating the AZ as a single point of failure.

Answer

Deploy EC2 instances in multiple subnets of the same Availability Zone.

Answer

Use a larger EC2 instance type to handle the load.

Answer

Use EC2 instances in multiple AWS Regions.

Question 12

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all new S3 buckets created in any account have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes the x-amz-server-side-encryption header with a valid encryption algorithm.. Service Control Policies (SCPs) in AWS Organizations allow central governance to deny actions across all accounts. An SCP can deny the s3:CreateBucket action unless the request includes the server-side-encryption header, thus enforcing encryption on new buckets. Option B is incorrect because IAM roles per account lack centralized enforcement and cannot prevent users with their own permissions from creating buckets without encryption. Option C is incorrect because AWS Config rules are detective, not preventive; they can only detect and optionally remediate after the bucket is created, not block the creation. Option D is incorrect because using CloudTrail and CloudWatch Events with a Lambda function is a reactive approach—it can delete a non-compliant bucket after creation, but does not enforce encryption at the time of creation. The requirement is to enforce the policy, making a preventive SCP the correct solution.

Answer

Create an IAM role in each member account with a policy that denies s3:CreateBucket without encryption, and require all users to assume that role.

Answer

Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' to detect non-compliant buckets and automatically remediate.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers a Lambda function to delete any bucket created without encryption.

Question 13

A company uses AWS CloudFormation to deploy a three-tier web application. The template includes an Amazon RDS DB instance. The SysOps administrator needs to ensure that the database password is not exposed in the template or in the stack outputs. The password should be stored securely and rotated automatically every 90 days. Which solution should the administrator use?

Accepted Answer

Use AWS Secrets Manager to store the password and reference it using the dynamic reference {{resolve:secretsmanager:secretId:secretString:password}} in the CloudFormation template. Enable automatic rotation.. AWS Secrets Manager is designed to securely store secrets like database passwords, supports automatic rotation (including a 90-day schedule), and can be referenced in CloudFormation templates using the dynamic reference {{resolve:secretsmanager:secretId:secretString:password}}. This ensures the password is never exposed in the template or stack outputs, and rotation is handled automatically without manual intervention.

Answer

Store the password as a plaintext parameter in the CloudFormation template and mark it as NoEcho.

Answer

Use AWS Systems Manager Parameter Store to store the password as a SecureString and reference it using the dynamic reference {{resolve:ssm-secure:password}} in the template.

Answer

Hardcode the password in a userdata script that is passed to the EC2 instances.

Question 14

A SysOps administrator receives a notification that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group. What is the immediate impact on the application?

Accepted Answer

The Auto Scaling group will launch a new instance to replace the failed one, potentially causing temporary downtime.. When an EC2 instance fails a status check, the Auto Scaling group detects the failure and initiates a replacement by launching a new instance. However, the failed instance is not immediately terminated; it may remain in a stopped or impaired state until the replacement is fully in service, which can cause temporary downtime for the application if the instance was actively handling traffic.

Answer

The instance is still accessible and serving traffic.

Answer

The instance is immediately terminated.

Answer

The instance is automatically stopped and started.

Question 15

A company runs a web application on EC2 instances in an Auto Scaling group. The application is behind an Application Load Balancer. The company wants to ensure that the application can handle a sudden spike in traffic without downtime. What should the SysOps administrator do?

Accepted Answer

Configure a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy based on average CPU utilization allows the Auto Scaling group to automatically adjust capacity in response to real-time demand spikes. This dynamic scaling approach maintains a target metric (e.g., 50% CPU) by adding or removing instances, ensuring the application can handle sudden traffic bursts without downtime.

Answer

Use a scheduled scaling policy to add instances during business hours.

Answer

Reduce the number of Availability Zones to lower latency.

Answer

Manually increase the desired capacity of the Auto Scaling group when traffic increases.

Question 16

A SysOps Administrator is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. After the peering connection is accepted, instances in VPC-A cannot ping instances in VPC-B. Both VPCs have non-overlapping CIDR blocks. What is the MOST likely cause?

Accepted Answer

The route tables in both VPCs do not have routes to the peer VPC CIDR.. The most likely cause is that the route tables in both VPCs do not have routes to the peer VPC CIDR. Even after a VPC peering connection is accepted, traffic cannot flow between the VPCs unless explicit routes are added to each VPC's route table pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, instances in VPC-A have no path to reach instances in VPC-B, so ping fails.

Answer

VPC peering does not support cross-account connections.

Answer

The CIDR blocks overlap, causing routing conflicts.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Question 17

A company uses Amazon S3 to store critical data. The SysOps administrator needs to protect against accidental deletion of objects. Which combination of actions should the administrator take? (Choose the best answer.)

Accepted Answer

Enable S3 Versioning and MFA Delete on the bucket.. Enabling S3 Versioning preserves all versions of an object, allowing recovery from accidental deletion or overwrite. MFA Delete adds an additional authentication layer, requiring multi-factor authentication to permanently delete object versions or suspend versioning, thus preventing unauthorized or accidental deletions.

Answer

Apply a bucket policy that denies s3:DeleteObject for all principals.

Answer

Set a lifecycle policy to expire objects after 30 days.

Answer

Configure cross-Region replication to a different bucket.

Question 18

A company is using AWS Organizations with multiple accounts. The security team wants to prevent any IAM user from creating access keys for themselves across all accounts. What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that denies iam:CreateAccessKey to all accounts in the organization.. Service control policies (SCPs) are the most effective way to enforce a guardrail across all accounts in an AWS Organization because they allow you to centrally deny or restrict permissions at the root, OU, or account level, overriding any IAM policies attached to users or roles. By applying an SCP that denies iam:CreateAccessKey, the security team ensures that no IAM user in any account within the organization can create access keys, regardless of their individual IAM policies. This approach is scalable and cannot be bypassed by account administrators, making it the correct choice for organization-wide enforcement.

Answer

Attach an IAM policy to the root user that denies iam:CreateAccessKey.

Answer

Configure an IAM password policy that requires strong passwords.

Answer

Use AWS CloudTrail to monitor and alert on CreateAccessKey events.

Question 19

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The Auto Scaling group uses a dynamic scaling policy based on average CPU utilization. During a traffic spike, new instances are launched but take 5 minutes to become healthy. Users experience errors during this time. Which solution would reduce the time to serve traffic from new instances?

Accepted Answer

Use a launch template with a pre-provisioned AMI.. A pre-provisioned AMI eliminates the need for software installation and configuration at launch time, reducing the time for new EC2 instances to become healthy. By baking the application and dependencies into the AMI, instances can start serving traffic almost immediately after booting, rather than waiting for user data scripts or configuration management tools to complete.

Answer

Add a lifecycle hook to delay instance termination.

Answer

Increase the cooldown period for the scaling policy.

Answer

Use a larger instance type.

Question 20

A company runs a production web application on a single Amazon EC2 instance. The application experiences a predictable and steady workload 24/7. The SysOps administrator wants to minimize compute costs for this instance while ensuring it remains available during the expected workload. Which EC2 purchasing option should the administrator use?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the most cost-effective option for a predictable, steady-state workload running 24/7. By committing to a 1- or 3-year term, you receive a significant discount (up to 72%) compared to On-Demand pricing, while still ensuring the instance remains available for the expected workload. This matches the requirement to minimize compute costs without sacrificing availability.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts