SOA-C02 Practice Test 4 — 25 Questions

Question 1

A CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED. Which two actions are appropriate next steps? (Choose 2.)

Accepted Answer

Review stack events to identify the resource that blocked rollback.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED, the stack events provide detailed error messages for each resource that failed during rollback. Reviewing these events is essential to identify the specific resource that blocked the rollback, such as a resource that could not be deleted or updated due to permissions, dependencies, or configuration issues. This diagnosis is the first step before attempting a continue-update-rollback operation.

Answer

Delete the CloudFormation service role from IAM.

Answer

Rename the stack to force rollback completion.

Question 2

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 3

A company uses Amazon CloudFront to deliver its static website hosted on Amazon S3. The security team notices that users are able to access the S3 bucket directly via the S3 endpoint, bypassing CloudFront. What should be done to ensure that content is only accessible through CloudFront?

Accepted Answer

Create an origin access identity (OAI) and update the S3 bucket policy to grant access only to the OAI. An Origin Access Identity (OAI) is a special CloudFront user that can be associated with a CloudFront distribution. By updating the S3 bucket policy to grant read access only to that OAI's canonical user ID, the bucket becomes inaccessible via direct S3 endpoints, while CloudFront can still fetch and serve the content. This enforces that all traffic must go through CloudFront.

Answer

Use AWS WAF to block requests that do not include the CloudFront distribution's domain name

Answer

Create an AWS Lambda@Edge function to validate headers

Answer

Use S3 Block Public Access to prevent all public access

Question 4

A company is running a critical application on Amazon RDS for MySQL. The database is experiencing high read traffic, causing performance issues. The SysOps administrator needs to improve read performance while keeping costs low. Which solution should the administrator choose?

Accepted Answer

Add one or more Read Replicas in the same Region. Adding one or more Read Replicas in the same Region offloads read traffic from the primary RDS instance by directing SELECT queries to the replicas, which are asynchronous copies of the primary. This directly addresses high read traffic without incurring the cost of a larger instance or the complexity of caching, making it the most cost-effective solution for read scaling.

Answer

Enable Multi-AZ deployment

Answer

Increase the DB instance class to a larger size

Answer

Use Amazon ElastiCache to cache read results

Question 5

A SysOps administrator is troubleshooting an issue where an Amazon RDS DB instance's storage space is running out. The administrator has enabled CloudWatch alarms for FreeStorageSpace, but the alarm did not trigger before the storage was exhausted. What is the most likely reason?

Accepted Answer

The alarm's evaluation period was too long and the storage filled up faster than the alarm could trigger.. CloudWatch alarms evaluate metrics based on a specified evaluation period (e.g., 5 minutes). If the storage fills up faster than the alarm's evaluation period, the alarm may not have enough data points to trigger before the storage is exhausted. This is a common issue when the rate of storage consumption exceeds the alarm's evaluation frequency.

Answer

The FreeStorageSpace metric is not available for the selected DB instance class.

Answer

The alarm was configured to use a static threshold but the metric is not emitted during storage operations.

Answer

The alarm was monitoring the wrong metric, such as 'Storage' instead of 'FreeStorageSpace'.

Question 6

A company stores 1 PB of data in Amazon S3 Standard. The data is accessed frequently for the first 30 days, then rarely accessed afterwards. The company needs to optimize storage costs. What should they do?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 90 days.. It uses an S3 Lifecycle policy to automatically transition objects to S3 Standard-IA after 30 days (when access drops), then to S3 Glacier Deep Archive after 90 days for long-term cold storage. This balances cost and access needs: Standard-IA offers lower storage cost than Standard for infrequent access, and Glacier Deep Archive provides the lowest cost for rarely accessed data after 90 days. The policy automates the transitions, avoiding manual effort and ensuring cost optimization without data loss.

Answer

Move all objects to S3 Intelligent-Tiering immediately.

Answer

Delete objects older than 30 days using S3 Lifecycle expiration.

Answer

Manually change the storage class of each object to S3 Glacier Deep Archive after 30 days.

Question 7

A company uses AWS Key Management Service (KMS) to encrypt data in S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Use a KMS key policy with a condition that requires the encryption context to match the bucket ARN, and grant the IAM role decrypt permissions. It uses a KMS key policy with a condition that restricts decryption to requests where the encryption context matches the S3 bucket ARN. This ensures that only the specified IAM role, when making decrypt calls with the correct encryption context, can decrypt objects in that bucket. It directly ties the KMS key's decrypt permission to the bucket, providing a granular and secure access control mechanism.

Answer

Create a separate KMS key for each bucket and assign the IAM role as a key user

Answer

Configure an S3 bucket policy that allows only the IAM role to perform s3:GetObject

Answer

Use an S3 bucket policy that denies s3:GetObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header

Question 8

A company uses AWS CloudTrail to log API calls in a multi-account environment. The security team wants to be alerted when an IAM user in the production account modifies a security group to allow inbound SSH from 0.0.0.0/0. Which combination of actions should be taken to meet this requirement?

Accepted Answer

Stream CloudTrail logs to CloudWatch Logs, create a metric filter for the specific API call, and set a CloudWatch Alarm that sends a notification to an SNS topic.. CloudTrail logs can be streamed to CloudWatch Logs, where a metric filter can be created to match the specific API call (e.g., AuthorizeSecurityGroupIngress with a CIDR of 0.0.0.0/0 and port 22). A CloudWatch Alarm based on that metric can then trigger an SNS notification, providing a real-time alert for the exact security group modification.

Answer

Use AWS Config managed rule 'restricted-ssh' to detect the security group change and trigger an SNS notification.

Answer

Enable AWS Security Hub and configure a custom insight to detect the security group modification.

Answer

Create an AWS Lambda function that is triggered by CloudTrail events and publishes to SNS.

Question 9

Refer to the exhibit. An IAM user has this policy attached. The user tries to start an EC2 instance that has no tags. What will happen?

Accepted Answer

The user will be denied because the instance does not have the required tag. The IAM policy includes a condition that requires the EC2 instance to have a tag with key 'Environment' and value 'Production'. When the instance has no tags, the condition evaluates to false, and the default behavior for IAM policies is to deny access when a condition is not met. Since the policy does not explicitly allow the action without the tag, the request is implicitly denied.

Answer

The user will be allowed because the condition only applies if the tag exists

Answer

The user will be allowed because the resource ARN includes a wildcard

Answer

The user will be allowed because the policy does not explicitly deny the action

Question 10

A SysOps administrator notices that an Amazon RDS instance's CPU utilization is consistently above 90% during peak hours. The application is read-heavy and can tolerate eventual consistency. Which action would MOST effectively reduce CPU load?

Accepted Answer

Create one or more read replicas and direct read traffic to them.. The application is read-heavy and can tolerate eventual consistency, making read replicas the ideal solution. By offloading read traffic to one or more read replicas, the primary RDS instance's CPU load is reduced because it no longer has to process all read queries. This directly addresses the high CPU utilization during peak hours without requiring a larger instance or other changes.

Answer

Increase the instance size from db.r5.large to db.r5.xlarge.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Change the storage type to Provisioned IOPS.

Question 11

A company runs a production application on EC2 instances in an Auto Scaling group. The application stores data on an EBS volume. The SysOps administrator wants to ensure that the data is durable and available even if an EC2 instance fails. Which approach should the administrator take?

Accepted Answer

Migrate the data to Amazon EFS and mount it to all instances.. Amazon EFS provides a fully managed, scalable, and shared file system that can be mounted concurrently to multiple EC2 instances across Availability Zones. By migrating the data to EFS and mounting it to all instances in the Auto Scaling group, the data remains durable and available even if an individual EC2 instance fails, because the file system persists independently of any single instance's lifecycle.

Answer

Use an instance store volume and replicate data across instances.

Answer

Use an EBS volume with snapshots taken every hour.

Answer

Move the data to an S3 bucket and access it via S3 API.

Question 12

A SysOps administrator needs to ensure that an EC2 instance automatically recovers from an underlying hardware failure. Which action should be taken?

Accepted Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure the recovery action.. A CloudWatch alarm on the StatusCheckFailed metric can be configured with the 'recover' action to automatically restart the EC2 instance on a new underlying host if a hardware failure is detected. This recovery action preserves the instance ID, private IP, Elastic IP, and instance metadata, ensuring minimal disruption. The StatusCheckFailed metric specifically monitors the instance's system status checks, which detect AWS hardware issues.

Answer

Launch a second instance in a different Availability Zone.

Answer

Assign an Elastic IP address to the instance.

Answer

Place the instance in an Auto Scaling group with a min size of 1.

Question 13

A company is using AWS CloudFormation to manage its infrastructure. The SysOps Administrator needs to ensure that updates to a critical stack do not accidentally replace the database. Which feature should be used?

Accepted Answer

Define a stack policy that denies updates to the database resource.. A stack policy in AWS CloudFormation explicitly denies updates to specified resources, such as the database, preventing accidental replacement or deletion during stack updates. Unlike termination protection, which only prevents stack deletion, a stack policy controls update actions on individual resources within the stack.

Answer

Use drift detection to identify changes.

Answer

Enable termination protection on the stack.

Answer

Use a change set to review the updates before executing them.

Question 14

A company has a VPC with a public subnet and a private subnet. The private subnet contains an EC2 instance that must access the internet for software updates. Which TWO actions are required to enable this? (Choose TWO.)

Accepted Answer

Deploy a NAT Gateway in a public subnet.. A NAT Gateway in a public subnet provides outbound internet access for private instances while preventing inbound connections. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling traffic to be forwarded to the internet via the Internet Gateway attached to the VPC.

Answer

Add an Internet Gateway to the private subnet's route table.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach an Internet Gateway to the NAT Gateway.

Question 15

A company has an Auto Scaling group that launches EC2 instances in private subnets. The instances need to download software patches from the internet. Which component must be added to the VPC to allow outbound internet traffic while keeping the instances private?

Accepted Answer

A NAT gateway in a public subnet. A NAT gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections. The NAT gateway translates the private IPs to its own Elastic IP and routes traffic through an internet gateway attached to the VPC, keeping instances private.

Answer

An internet gateway attached to the VPC

Answer

A VPC peering connection to a VPC with internet access

Answer

An egress-only internet gateway

Question 16

A company uses AWS Backup to back up its Amazon EFS file system daily. The backup retention policy is set to 30 days. Recently, a user accidentally deleted a critical directory. The company wants to restore the directory as it existed 2 days ago. What is the MOST cost-effective and quickest way to achieve this?

Accepted Answer

Restore the backup from 2 days ago to a new EFS file system, then copy the directory to the original file system.. AWS Backup creates point-in-time snapshots of EFS file systems. Restoring a backup from 2 days ago to a new EFS file system allows you to mount that new file system, copy the specific directory back to the original file system, and then delete the temporary file system. This is the most cost-effective and quickest approach since it avoids moving data to on-premises servers and uses native AWS services without additional replication costs.

Answer

Use the EFS console to recover the directory from the .Trash folder.

Answer

Enable EFS replication to another region and then fail back.

Answer

Use AWS Backup to restore the entire file system to an on-premises server, then copy the directory back.

Question 17

A SysOps administrator needs to centrally collect operating system-level metrics from a fleet of Amazon EC2 instances running Amazon Linux 2. The metrics should include memory usage and disk I/O. Which solution should the administrator implement?

Accepted Answer

Install and configure the CloudWatch agent on the EC2 instances.. The CloudWatch agent is the correct solution because it can collect custom OS-level metrics such as memory usage and disk I/O from EC2 instances running Amazon Linux 2. Unlike the default CloudWatch metrics, which only capture hypervisor-level metrics (e.g., CPU, network), the CloudWatch agent uses the procstat and disk plugins to gather detailed system metrics and publish them to CloudWatch as custom namespaces.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log OS-level metrics.

Answer

Use AWS Systems Manager Inventory to collect metrics.

Question 18

A company runs a stateful web application on a single EC2 instance. The SysOps Administrator wants to improve fault tolerance. Which design should they implement?

Accepted Answer

Place instances in an Auto Scaling group across two Availability Zones, use an Application Load Balancer, and store session state in ElastiCache.. It distributes the web application across multiple Availability Zones for high availability, uses an Application Load Balancer to route traffic to healthy instances, and stores session state externally in ElastiCache. This decouples the stateful session data from the EC2 instances, allowing any instance to handle any request without losing session context, which is essential for fault tolerance in a stateful application.

Answer

Create a Multi-AZ RDS instance and attach it to the existing EC2 instance.

Answer

Add a second EC2 instance in the same Availability Zone and use a Network Load Balancer.

Answer

Use an Auto Scaling group with a launch configuration that stores session data on instance store.

Question 19

An organization wants to ensure that all changes to an S3 bucket policy are logged and immediately trigger a notification to the security team. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches PutBucketPolicy API call and triggers an SNS topic.. CloudWatch Events (now Amazon EventBridge) can capture the PutBucketPolicy API call via a service-specific event pattern and route it to an SNS topic for immediate notification. This approach is the most efficient as it directly monitors the API call in real-time without polling or additional configuration, ensuring the security team is alerted the moment the policy changes.

Answer

Create a CloudWatch Alarm that monitors the S3 bucket's policy.

Answer

Use AWS Config with a managed rule to detect policy changes.

Answer

Enable S3 event notifications on the bucket for 'PutBucketPolicy' events.

Question 20

A company has an RDS PostgreSQL database with a Multi-AZ deployment. The primary instance fails. What happens to the application connections?

Accepted Answer

The application must reconnect to the same endpoint; it will be redirected to the standby instance.. When the primary RDS PostgreSQL instance fails in a Multi-AZ deployment, AWS automatically fails over to the standby instance in a different Availability Zone. The DNS endpoint (CNAME) remains the same, but its resolution is updated to point to the standby instance's IP address. The application must reconnect to the same endpoint, as existing connections to the failed primary are dropped; after reconnection, traffic is seamlessly routed to the new primary.

Answer

The application will be automatically redirected to a read replica.

Answer

The administrator must manually change the CNAME to point to the standby.

Answer

The application must use a new endpoint in a different AWS Region.