SOA-C02 Practice Test 4 — 25 Questions

Question 1

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot pull secrets from AWS Secrets Manager. The instance has an IAM role with a policy that allows secretsmanager:GetSecretValue. The secret is in the same account and region. What are possible reasons for the failure? (Choose THREE.)

Accepted Answer

The EC2 instance is in a private subnet with no route to the internet or a VPC endpoint for Secrets Manager. Option A is correct because if the EC2 instance is in a private subnet without a route to the internet (no NAT gateway or internet gateway) and no VPC endpoint for Secrets Manager, the instance cannot reach the Secrets Manager API endpoint. Secrets Manager requires network connectivity over HTTPS (port 443) to the service endpoint, and without either a public route or a VPC endpoint, the API calls will time out or fail with a connection error.

Answer

The secret is in a different AWS account

Answer

The IAM role is not attached to the instance profile

Question 2

A company uses AWS Organizations to manage multiple AWS accounts. The security team requires that all Amazon S3 buckets in every account be encrypted at rest using AWS KMS customer managed keys. The SysOps administrator needs to enforce this requirement centrally without requiring changes in each account individually. Which approach should the administrator use?

Accepted Answer

Create a service control policy (SCP) in the management account that denies creation of S3 buckets without KMS encryption. Option C is correct because a service control policy (SCP) applied at the AWS Organizations management account can centrally deny the creation of S3 buckets that do not have AWS KMS encryption enabled, affecting all member accounts without requiring individual account changes. SCPs act as a permission guardrail that restricts what actions accounts can perform, even for account administrators, making them ideal for enforcing organization-wide security policies like mandatory KMS encryption on S3 bucket creation.

Answer

Create an IAM policy in each account that denies creation of unencrypted S3 buckets

Answer

Configure an S3 bucket policy on each bucket to require encryption

Answer

Enable AWS Config rules in each account to detect and remediate non-compliant buckets

Question 3

An application running on EC2 instances sends large amounts of data to an S3 bucket. The SysOps administrator wants to reduce data transfer costs while ensuring the traffic stays within AWS. What is the most cost-effective solution?

Accepted Answer

Create a VPC Endpoint for S3 (Gateway type) and use it from the EC2 instances.. A VPC Endpoint for S3 (Gateway type) allows EC2 instances to access S3 over the AWS private network without traversing the public internet, eliminating data transfer costs for traffic within the same region. Since the traffic stays within AWS, this is the most cost-effective solution as it avoids NAT Gateway, Direct Connect, or S3 Transfer Acceleration charges.

Answer

Set up an AWS Direct Connect connection.

Answer

Use S3 Transfer Acceleration.

Answer

Route traffic through a NAT Gateway in a public subnet.

Question 4

A company wants to reduce data transfer costs for traffic between EC2 instances in the same AWS Region. Which action should the SysOps administrator take?

Accepted Answer

Ensure instances communicate using private IP addresses within the same VPC. Option C is correct because traffic between EC2 instances in the same VPC using private IP addresses stays within the AWS network backbone and does not incur data transfer charges. AWS does not bill for data transfer between instances within the same VPC when using private IPv4 or IPv6 addresses, regardless of the Availability Zone, as long as the traffic does not traverse a NAT gateway, internet gateway, or VPN connection. This directly reduces data transfer costs compared to using public IPs or routing through gateways.

Answer

Use Elastic IP addresses for all instances

Answer

Place instances in public subnets and route traffic through a NAT Gateway

Answer

Use VPC endpoints to communicate between instances

Question 5

A company stores log files in Amazon S3. The logs are accessed frequently for the first 30 days, then rarely after that. The company wants to automatically transition objects to a lower-cost storage class after 30 days. Which S3 feature should be configured?

Accepted Answer

S3 Lifecycle rule. An S3 Lifecycle rule is the correct feature because it allows you to define a transition action that automatically moves objects from a higher-cost storage class (e.g., S3 Standard) to a lower-cost storage class (e.g., S3 Standard-IA or S3 Glacier) after a specified number of days. This directly meets the requirement to transition logs after 30 days without manual intervention, optimizing storage costs based on access patterns.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 6

A SysOps administrator notices that a Lambda function is timing out after 30 seconds. The function processes large files from S3. How can the administrator improve performance while minimizing cost?

Accepted Answer

Increase the memory allocation of the Lambda function.. Increasing the memory allocation of the Lambda function also proportionally increases the allocated CPU power, which directly reduces the execution time for CPU-bound tasks like processing large files. This often resolves timeout issues without incurring additional cost per invocation, as the cost is a product of memory and duration, and a faster execution can offset the higher memory price.

Answer

Increase the timeout value to 5 minutes.

Answer

Enable Provisioned Concurrency.

Answer

Deploy the function on an EC2 instance.

Question 7

A company has multiple VPCs in the same account that need to communicate with each other. The VPCs are in the same region. Which solution provides the simplest and most scalable connectivity?

Accepted Answer

Create a Transit Gateway and attach all VPCs.. AWS Transit Gateway acts as a central hub that allows you to attach multiple VPCs and manage inter-VPC routing through a single gateway, simplifying connectivity and scaling easily as you add more VPCs. It eliminates the need for complex mesh or star configurations and supports transitive routing, making it the simplest and most scalable solution for multi-VPC communication within the same region.

Answer

Set up AWS Direct Connect and route through a single VPC.

Answer

Use AWS PrivateLink to connect the VPCs.

Answer

Create VPC Peering connections between each pair of VPCs.

Question 8

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a database. Which TWO components are required to allow an EC2 instance in the public subnet to connect to the database?

Accepted Answer

A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR.. A security group rule on the database allowing inbound traffic from the EC2 instance's security group (Option E) is required because security groups act as a virtual firewall at the instance level, and by default they deny all inbound traffic. A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR (Option B) is also required because network ACLs are stateless and control traffic at the subnet boundary; without an inbound allow rule, traffic from the public subnet would be dropped by the private subnet's ACL.

Answer

A NAT Gateway in the public subnet.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Endpoint for the database service.

Question 9

Which THREE configurations are required to enable an EC2 instance in a private subnet to access the internet for software updates while preventing inbound internet traffic?

Accepted Answer

Attach an Internet Gateway to the VPC.. An Internet Gateway (IGW) is required for any VPC to enable internet connectivity. Without an IGW, traffic cannot leave or enter the VPC from the internet. For a private subnet EC2 instance to reach the internet for software updates, the VPC must have an IGW attached, and the NAT Gateway (placed in a public subnet) uses the IGW to forward outbound traffic while blocking inbound connections.

Answer

Assign an Elastic IP address to the EC2 instance.

Answer

Deploy a bastion host in the private subnet.

Question 10

A company hosts a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. Which step should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Verify the target group health check settings.. Intermittent 503 errors from an Application Load Balancer typically indicate that the target instances are failing health checks or are unable to handle the request load. Verifying the target group health check settings (e.g., path, interval, threshold, and protocol) is the first troubleshooting step because if the health checks are misconfigured or the targets are unhealthy, the ALB will stop routing traffic to them, resulting in 503 responses.

Answer

Enable cross-zone load balancing.

Answer

Increase the idle timeout on the load balancer.

Answer

Add more subnets to the load balancer.

Question 11

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which step is necessary?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. To enable IPv6 communication in an existing VPC, you must first associate an Amazon-provided IPv6 CIDR block with the VPC. This is a prerequisite for configuring subnets, route tables, and internet gateways to support IPv6 traffic. Without an IPv6 CIDR block assigned to the VPC, no EC2 instance can obtain an IPv6 address or route IPv6 traffic.

Answer

Attach an internet gateway that supports IPv6.

Answer

Create a new VPC with an IPv6 CIDR block and migrate resources.

Answer

Enable DNS64 in the VPC.

Question 12

Which TWO actions can reduce data transfer costs for content delivered to users globally? (Choose two.)

Accepted Answer

Deploy multiple Application Load Balancers in different regions.. Option A is correct because deploying multiple Application Load Balancers (ALBs) in different regions allows traffic to be routed to the nearest regional endpoint, reducing the distance data must travel over the public internet and lowering egress costs. Option B is correct because Amazon CloudFront caches content at edge locations closer to users, minimizing the amount of data transferred from the origin and reducing overall data transfer costs, especially for frequently accessed static content.

Answer

Use AWS Direct Connect for all traffic.

Answer

Use a single S3 bucket in one region with cross-region replication.

Answer

Enable S3 Transfer Acceleration.

Question 13

A company's security policy requires that IAM users rotate their access keys every 90 days. The SysOps administrator must automatically identify users whose access keys are older than 90 days and notify the security team. Which combination of AWS services should be used to meet this requirement with the least operational overhead?

Accepted Answer

AWS Config with the 'access-keys-rotated' managed rule and Amazon SNS. AWS Config's 'access-keys-rotated' managed rule checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a non-compliant resource is detected, AWS Config can trigger an Amazon SNS notification directly, without any custom code or additional infrastructure. This combination provides a fully managed, serverless solution with the least operational overhead.

Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters and alarms

Answer

IAM Access Analyzer and AWS Lambda

Answer

Amazon GuardDuty and Amazon EventBridge

Question 14

A SysOps Administrator needs to allow an EC2 instance in a private subnet to access the internet for software updates. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables EC2 instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP of the instance to the NAT Gateway's Elastic IP using Source Network Address Translation (SNAT). This is the correct service because the instance is in a private subnet and requires internet access without being directly reachable.

Answer

VPN Connection

Answer

Internet Gateway

Answer

VPC Peering

Question 15

A SysOps administrator is designing a VPC for a web application that must be secure. Which THREE security measures should the administrator implement? (Choose THREE.)

Accepted Answer

Configure network ACLs to filter traffic at the subnet level.. Network ACLs (NACLs) are stateless firewalls that operate at the subnet level, providing an additional layer of security by filtering traffic entering and exiting each subnet. By default, NACLs allow all traffic, but you can configure custom rules to explicitly allow or deny traffic based on IP addresses, protocols, and port ranges, which is essential for securing a web application VPC.

Answer

Place all resources in public subnets to simplify access.

Answer

Use the default VPC for simplicity.

Question 16

Which TWO AWS services can be used to encrypt data at rest in Amazon RDS? (Choose TWO.)

Accepted Answer

Amazon RDS encryption feature. Amazon RDS provides a built-in encryption feature that uses AWS KMS to encrypt data at rest. When you enable encryption for an RDS DB instance, the data stored on the underlying storage, automated backups, read replicas, and snapshots are encrypted using a KMS key. This feature is the primary method for encrypting data at rest in RDS, making option D correct.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Question 17

A company has deployed an Application Load Balancer (ALB) in a VPC. The ALB is configured with a target group pointing to EC2 instances in a private subnet. Clients receive HTTP 503 errors. What is the likely cause?

Accepted Answer

The target instances are unhealthy and the target group has zero healthy hosts.. HTTP 503 errors from an Application Load Balancer indicate that the target group has no healthy registered targets to forward traffic to. When all EC2 instances in the target group are unhealthy (e.g., failing health checks), the ALB cannot route requests, resulting in a 503 response. This is the most common cause of 503 errors in ALB deployments.

Answer

The ALB does not have an Elastic IP address.

Answer

The security group for the ALB does not allow inbound HTTP traffic.

Answer

The route table for the private subnet does not have a route to the ALB.

Question 18

An organization has a requirement to prevent any IAM user from deleting an S3 bucket that contains critical data. The SysOps administrator needs to implement a preventive control that works even if the user has full administrative privileges. Which solution should the administrator implement?

Accepted Answer

Apply a service control policy (SCP) that denies s3:DeleteBucket for the account.. Option C is correct because a Service Control Policy (SCP) is an AWS Organizations policy that can restrict permissions for all IAM users and roles within an account, including the root user. SCPs act as a preventive guardrail that overrides any IAM or bucket policies, so even a user with full administrative privileges (e.g., AdministratorAccess) cannot perform the denied action. This ensures that s3:DeleteBucket is blocked at the account level, providing a robust preventive control that cannot be bypassed by the user's own permissions.

Answer

Attach an IAM policy to the user that explicitly denies s3:DeleteBucket.

Answer

Enable MFA Delete on the bucket.

Answer

Add a bucket policy that denies s3:DeleteBucket for the user.

Question 19

A company uses S3 to store sensitive data. To meet compliance requirements, all S3 buckets must be encrypted at rest. The security team notices that some objects in a bucket are not encrypted. What is the MOST efficient way to enforce encryption for all future objects?

Accepted Answer

Create an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption header is not present. Option D is correct because a bucket policy that denies PutObject unless the `x-amz-server-side-encryption` header is present enforces encryption at the API level, preventing any unencrypted object from being uploaded. This is the most efficient approach as it proactively blocks non-compliant uploads without requiring post-upload remediation or manual intervention.

Answer

Use AWS Config managed rule to identify unencrypted objects and re-upload them manually

Answer

Use S3 Inventory to list unencrypted objects and apply encryption via S3 Batch Operations

Answer

Enable default encryption on the bucket using AES-256

Question 20

A company requires that all access to the AWS Management Console be protected by multi-factor authentication (MFA). The SysOps administrator has enabled an IAM policy that denies all actions if the user does not authenticate with MFA. However, some users report they cannot list their own MFA devices. What is the MOST likely cause?

Accepted Answer

The policy denies the iam:ListMFADevices action without an MFA-authenticated session. The IAM policy that denies all actions unless the user is authenticated with MFA will also block the iam:ListMFADevices action because that API call is made without an MFA-authenticated session. When a user tries to list their own MFA devices, they have not yet passed the MFA challenge, so the session is not MFA-authenticated, and the deny policy applies. This creates a catch-22: the user cannot list their devices to manage MFA because listing requires MFA, but they need to list devices to set up MFA.

Answer

The policy is applied to the root user only

Answer

Users are not using MFA-enabled access keys

Answer

The policy is not applied in the us-east-1 region