SOA-C02 Practice Test 5 — 25 Questions

Question 1

A company wants to provide low-latency access to a web application for users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. Which AWS service should be used to route users to the nearest region?

Accepted Answer

Amazon Route 53 with latency-based routing. Amazon Route 53 with latency-based routing directs user traffic to the AWS region that provides the lowest latency for the end user. By configuring latency records for the EC2 instances in us-east-1 and eu-west-1, Route 53 responds to DNS queries with the IP address of the region that offers the best network performance, effectively routing users to the nearest region.

Answer

Application Load Balancer with cross-region load balancing

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 2

A company has an application running on EC2 instances behind an Application Load Balancer. They want to receive an email notification when the average latency exceeds 2 seconds. Which combination of steps should the SysOps administrator take? (Select TWO.)

Accepted Answer

Configure the alarm to send a notification to an Amazon SNS topic.. Option D is correct because Amazon CloudWatch alarms can be configured to send notifications to an Amazon SNS topic when a metric threshold is breached. By creating an SNS topic and subscribing an email endpoint to it, the SysOps administrator can receive email alerts when the alarm state changes, such as when the average latency exceeds 2 seconds.

Answer

Enable AWS CloudTrail to capture API calls and monitor latency.

Answer

Use CloudWatch Logs to stream logs to Amazon ES for latency analysis.

Answer

Create a CloudWatch alarm on the EC2 instance's CPUUtilization metric.

Question 3

A company is using Amazon Route 53 as its DNS service. The company has a web application running on an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that if the ALB fails, traffic is automatically redirected to a static error page hosted on an Amazon S3 bucket. Which Route 53 routing policy should be used to achieve this?

Accepted Answer

Failover routing policy. The Failover routing policy in Amazon Route 53 is designed to route traffic to a primary resource (the ALB) and automatically redirect to a secondary resource (the S3 bucket static error page) when the primary health check fails. This ensures high availability by failing over to the static error page if the ALB becomes unhealthy, meeting the requirement precisely.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 4

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Windows Server. Which steps are required to collect memory metrics?

Accepted Answer

Install and configure the Amazon CloudWatch agent on the instance.. Amazon CloudWatch does not collect memory metrics from EC2 instances by default; it only captures hypervisor-level metrics such as CPU, network, and disk I/O. To monitor in-guest memory utilization on a Windows Server instance, you must install and configure the Amazon CloudWatch agent, which sends custom metrics (e.g., Memory % Committed Bytes In Use) to CloudWatch. The agent uses the Windows Performance Monitor (PerfMon) counters to gather this data.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and use Run Command.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Use the AWS Management Console to enable memory monitoring.

Question 5

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. Which of the following route table configurations is required for the private subnet to enable internet access through the NAT gateway?

Accepted Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the private subnet route table. Option B is correct because a private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface (ENI) to forward outbound internet traffic from private instances through the NAT gateway. The NAT gateway, residing in the public subnet, then uses its own route table with a route to the internet gateway (IGW) to reach the internet. Without this route, traffic from the private subnet would have no path to the internet.

Answer

Add a route to 0.0.0.0/0 pointing to the internet gateway in the private subnet route table

Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the public subnet route table

Answer

Add a route to the NAT gateway's private IP in the private subnet route table

Question 6

A company has a VPC with a public subnet and a private subnet. The private subnet contains an EC2 instance that must access the internet for software updates. Which TWO actions are required to enable this? (Choose TWO.)

Accepted Answer

Deploy a NAT Gateway in a public subnet.. A NAT Gateway in a public subnet provides outbound internet access for private instances while preventing inbound connections. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling traffic to be forwarded to the internet via the Internet Gateway attached to the VPC.

Answer

Add an Internet Gateway to the private subnet's route table.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach an Internet Gateway to the NAT Gateway.

Question 7

A company runs a production application on EC2 instances in an Auto Scaling group. The application stores data on an EBS volume. The SysOps administrator wants to ensure that the data is durable and available even if an EC2 instance fails. Which approach should the administrator take?

Accepted Answer

Migrate the data to Amazon EFS and mount it to all instances.. Amazon EFS provides a fully managed, scalable, and shared file system that can be mounted concurrently to multiple EC2 instances across Availability Zones. By migrating the data to EFS and mounting it to all instances in the Auto Scaling group, the data remains durable and available even if an individual EC2 instance fails, because the file system persists independently of any single instance's lifecycle.

Answer

Use an instance store volume and replicate data across instances.

Answer

Use an EBS volume with snapshots taken every hour.

Answer

Move the data to an S3 bucket and access it via S3 API.

Question 8

A SysOps administrator notices that traffic to an Amazon EC2 instance is being blocked even though the security group allows all inbound traffic. The subnet's network ACL allows all inbound and outbound traffic. What could be the issue?

Accepted Answer

The instance's operating system firewall is blocking the traffic.. The security group and network ACL both allow all traffic, so the issue must be at the instance level. The operating system's built-in firewall (e.g., iptables for Linux, Windows Firewall for Windows) can block inbound traffic independently of AWS networking constructs. Since the OS firewall is not managed by AWS, it can override security group rules, causing traffic to be dropped even when AWS-side configurations are permissive.

Answer

The network ACL is not associated with the subnet correctly.

Answer

VPC Flow Logs are misconfigured.

Answer

The route table does not have a default route to an internet gateway.

Question 9

A company is using Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. How should this be configured?

Accepted Answer

Configure Origin Access Control (OAC) with the S3 bucket policy.. Origin Access Control (OAC) is the recommended method to restrict access to an S3 bucket so that only CloudFront can retrieve objects. When OAC is enabled, CloudFront signs requests to S3 using a specific principal, and the S3 bucket policy is configured to allow access only to that principal. This prevents direct access to the bucket via S3 URLs or other AWS services, ensuring that content is served exclusively through CloudFront.

Answer

Use CloudFront signed URLs or cookies.

Answer

Attach an IAM role to CloudFront that grants S3 read access.

Answer

Create a bucket policy that allows access only from the CloudFront distribution's IP addresses.

Question 10

A company is running a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across two Availability Zones. The company needs to ensure that if an entire Availability Zone fails, the application remains available. Which configuration meets this requirement?

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones.. Option D is correct because configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) continue to serve traffic. The Application Load Balancer automatically distributes incoming requests across healthy instances in all configured AZs, and the Auto Scaling group replaces failed instances in the remaining AZs, maintaining capacity. This design provides high availability without relying on a single AZ, which would be a single point of failure.

Answer

Use larger EC2 instance types to handle the load during a failure.

Answer

Use Amazon CloudFront to distribute traffic across multiple regions.

Answer

Launch all instances in the same Availability Zone to reduce latency.

Question 11

A SysOps administrator is troubleshooting an issue where an Auto Scaling group is not launching EC2 instances despite having a scaling policy that should trigger when CPU utilization exceeds 80%. The CloudWatch alarm shows that the metric is breaching the threshold, but no instances are launched. What is the most likely cause?

Accepted Answer

The Auto Scaling group has reached its maximum size.. Option C is correct because when an Auto Scaling group reaches its maximum size, it cannot launch new instances even if a scaling policy is triggered. The CloudWatch alarm breaching the threshold indicates the scaling condition is met, but the group's capacity limit prevents any new instance launches. This is a common misconfiguration where the max size is set too low relative to the desired or current capacity.

Answer

The scaling policy is incorrectly configured to use a simple scaling policy instead of a step scaling policy.

Answer

The health check grace period is too long.

Answer

The CloudWatch alarm is in insufficient data state.

Question 12

A company wants to back up its on-premises file server to AWS. The backup must be encrypted in transit and at rest. Which AWS service should the company use to meet these requirements?

Accepted Answer

AWS Storage Gateway (File Gateway) backed by Amazon S3.. AWS Storage Gateway File Gateway provides a native NFS/SMB interface that allows on-premises file servers to back up data directly to Amazon S3. It encrypts data in transit using TLS (HTTPS) and at rest using S3 server-side encryption (SSE-S3 or SSE-KMS), meeting both requirements without custom scripting or additional infrastructure.

Answer

Amazon EBS volumes attached to an EC2 instance acting as a file server.

Answer

AWS CloudFormation to replicate the file server configuration.

Answer

Amazon S3 with server-side encryption and a custom script to upload files.

Question 13

A company is running a stateful web application on a single EC2 instance in a public subnet. The instance stores user sessions locally. The company wants to improve availability without rewriting the application. Which design should they use?

Accepted Answer

Deploy an Application Load Balancer across multiple AZs, move session storage to ElastiCache, and use an Auto Scaling group.. Option C is correct because it addresses the core issue of stateful sessions without rewriting the application. By moving session storage to ElastiCache (a centralized, external data store), the application becomes stateless from the instance's perspective, allowing an Auto Scaling group across multiple Availability Zones (AZs) and an Application Load Balancer (ALB) to distribute traffic seamlessly. This design improves availability by enabling horizontal scaling and fault tolerance, as any instance can handle any request since sessions are stored externally.

Answer

Create a second EC2 instance in a different AZ and use Route 53 with health checks.

Answer

Use an Auto Scaling group across multiple AZs but keep sessions on instance.

Answer

Use an Application Load Balancer with sticky sessions and an Auto Scaling group in a single AZ.

Question 14

An organization needs to back up an Amazon EFS file system daily and retain backups for 30 days. Which AWS service provides a managed backup solution for EFS?

Accepted Answer

AWS Backup. AWS Backup is the correct answer because it is a fully managed, policy-based backup service that supports Amazon EFS natively. It allows you to define backup plans with daily schedules and retention rules (e.g., 30 days) without needing to manage any backup infrastructure or scripts. AWS Backup handles the lifecycle of backups, including incremental backups and automatic deletion of expired recovery points.

Answer

Amazon Data Lifecycle Manager (DLM)

Answer

EFS replication to another region

Answer

S3 Lifecycle policies

Question 15

A SysOps administrator is tasked with designing a disaster recovery strategy for an Amazon RDS for PostgreSQL database. The database is currently in us-east-1. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 1 minute. Which solution meets these requirements?

Accepted Answer

Enable Multi-AZ deployment with automatic failover.. Multi-AZ deployment for Amazon RDS provides synchronous replication to a standby instance in a different Availability Zone, with automatic failover typically completing within 1-2 minutes. This meets the RTO of 1 minute and, because replication is synchronous, the RPO is effectively zero seconds (no data loss), which satisfies the 5-second RPO requirement.

Answer

Create a cross-region read replica in us-west-2 and promote it during a disaster.

Answer

Take daily automated snapshots and copy them to another region.

Answer

Deploy the database in a single AZ and use point-in-time recovery.

Question 16

A SysOps administrator is designing a disaster recovery plan for a critical application that runs on EC2 instances with data stored on EBS volumes. The application requires an RPO of 15 minutes and an RTO of 2 hours. The current solution uses EBS snapshots taken every 6 hours. The administrator needs to improve the backup strategy to meet the RPO. What is the most cost-effective way to achieve this?

Accepted Answer

Increase the snapshot frequency to every 15 minutes.. Option C is correct because increasing the snapshot frequency to every 15 minutes directly reduces the recovery point objective (RPO) from 6 hours to 15 minutes, meeting the requirement without incurring additional infrastructure costs. EBS snapshots are incremental and cost-effective, as only changed blocks are stored after the initial snapshot, making frequent snapshots a practical approach for achieving a low RPO.

Answer

Enable EBS Recycle Bin with a retention rule of 15 minutes.

Answer

Change the EBS volume type to io2 Block Express.

Answer

Use EBS Multi-Attach to attach volumes to multiple instances for redundancy.

Question 17

A company uses S3 to store critical data. They need to ensure that data can be recovered in the event of accidental deletion or overwriting by users. Which combination of actions should they take?

Accepted Answer

Enable S3 Versioning and MFA Delete.. Option C is correct because enabling S3 Versioning preserves all versions of an object, allowing recovery from accidental deletion or overwriting. MFA Delete adds an extra layer of protection by requiring multi-factor authentication to permanently delete object versions or suspend versioning, preventing unauthorized or accidental permanent data loss.

Answer

Enable S3 Cross-Region Replication and S3 Transfer Acceleration.

Answer

Enable S3 Versioning and S3 Transfer Acceleration.

Answer

Enable S3 Server Access Logging and S3 Object Lock.

Question 18

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume. The SysOps administrator needs to implement a backup strategy that ensures data can be recovered in the event of an AZ failure. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure automated snapshots using Amazon Data Lifecycle Manager.. Option B is correct because Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots, providing a scheduled backup mechanism that protects against data loss. Option C is correct because copying snapshots to another region ensures data is recoverable even if an entire AWS Availability Zone (AZ) fails, as the snapshots are stored independently in a different geographic region.

Answer

Increase the EBS volume size to maximize I/O performance.

Answer

Enable EBS encryption using AWS KMS.

Answer

Enable EBS Multi-Attach to allow the volume to be attached to instances in another AZ.

Question 19

A company runs a critical application on EC2 instances in an Auto Scaling group with a minimum of 2 instances. The instances are in a single Availability Zone. The company wants to achieve 99.99% availability. Which change should they make?

Accepted Answer

Modify the Auto Scaling group to launch instances in multiple Availability Zones and place an Application Load Balancer in front.. To achieve 99.99% availability, the application must survive an Availability Zone (AZ) failure. Running instances in a single AZ creates a single point of failure. By modifying the Auto Scaling group to launch instances in multiple AZs and placing an Application Load Balancer (ALB) in front, traffic is automatically distributed across healthy instances in different AZs, ensuring fault tolerance even if an entire AZ becomes unavailable.

Answer

Increase the minimum size of the Auto Scaling group to 4 instances.

Answer

Use a larger EC2 instance type to handle more traffic.

Answer

Configure the Auto Scaling group to scale based on memory utilization.

Question 20

A company is designing a highly available web application using an Application Load Balancer (ALB) with EC2 instances in an Auto Scaling group across two Availability Zones. Which configuration ensures that the application remains available if one Availability Zone fails?

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones. Option C is correct because configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ continues to serve traffic. The ALB distributes incoming requests across healthy targets in all enabled AZs, and Auto Scaling replaces failed instances in the remaining AZs automatically, maintaining application availability.

Answer

Use a single large EC2 instance instead of multiple instances

Answer

Disable health checks on the ALB to avoid false positives

Answer

Launch all EC2 instances in a single Availability Zone