SOA-C02 Practice Test 5 — 25 Questions

Question 1

A company runs a global e-commerce application that uses Amazon DynamoDB as its primary database. The application requires single-digit millisecond read and write latency from any region and must continue to operate during a regional outage with minimal data loss. Which DynamoDB feature should the SysOps administrator enable to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DynamoDB global tables. DynamoDB global tables provide multi-Region, multi-active replication, enabling single-digit millisecond reads and writes from any Region while offering automatic failover and recovery during a regional outage. This feature uses DynamoDB Streams to replicate data across Regions with eventual consistency, meeting the requirement for continued operation with minimal data loss.

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB Point-in-Time Recovery (PITR)

Answer

DynamoDB Auto Scaling

Question 2

Refer to the exhibit. A SysOps administrator runs this CloudWatch Logs Insights query against an application log group. The query returns no results, even though the administrator knows that errors occurred in the last hour. What is the most likely cause?

Accepted Answer

The log group contains too many log events, causing the query to time out.. In CloudWatch Logs Insights, `stats count() by bin(5m)` is valid syntax; `bin()` does not require a preceding field. Therefore option A is not the cause. The most likely cause among the options is that the log group contains too many log events, causing the query to time out before results are returned. Retention policy does not affect events from the last hour, and `@message` is a valid field.

Answer

The 'stats' command requires a 'by' clause with a field name, but 'bin(5m)' is invalid.

Answer

The @message field is not a valid field in CloudWatch Logs Insights.

Answer

The log group's retention policy is set to 1 day and the data is older than the retention period.

Question 3

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts have encryption enabled. What is the most efficient way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies S3 actions without encryption.. A service control policy (SCP) applied to the root organizational unit in AWS Organizations can centrally enforce encryption requirements for all S3 buckets across every member account. By denying S3 actions (such as s3:PutObject) unless the request includes encryption parameters (e.g., x-amz-server-side-encryption), the SCP acts as a guardrail that cannot be overridden by account-level IAM policies, ensuring compliance without per-account configuration.

Answer

Configure an IAM role in the master account to enforce encryption via cross-account access.

Answer

Create an IAM policy in each account that denies s3:PutObject without encryption.

Answer

Use AWS CloudFormation StackSets to deploy a bucket policy to each account.

Question 4

A company has a production environment with multiple EC2 instances running a web application. The SysOps administrator wants to automate the remediation of instances that fail the EC2 status check. Which approach should the administrator use?

Accepted Answer

Create an Amazon EventBridge rule that matches EC2 status check failures and triggers an AWS Lambda function to terminate the instance and launch a new one.. It provides a fully automated, event-driven remediation workflow. When an EC2 instance fails a status check, an EventBridge rule detects the state change and triggers a Lambda function that terminates the unhealthy instance and launches a replacement. This approach directly addresses the requirement to automate remediation without manual intervention.

Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure an SNS notification to alert the team.

Answer

Use AWS Systems Manager Automation to create a document that runs a script on the instance to fix the issue.

Answer

Configure the Auto Scaling group's health check to use EC2 status checks and set a custom termination policy.

Question 5

A company is deploying a new web application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) with specific software pre-installed. The SysOps administrator creates a custom AMI and configures Elastic Beanstalk to use it. However, during deployment, the instances fail to pass the health check. The health check endpoint is a simple 'index.html' file. What is the MOST likely cause?

Accepted Answer

The custom AMI does not have a web server installed and configured to serve the application.. Elastic Beanstalk expects the web server (e.g., Apache, Nginx) to be installed and configured to serve the application. If the custom AMI does not have a web server installed, the health check endpoint will not respond. Option A is incorrect because the environment URL is created regardless of the AMI. Option C is incorrect because Elastic Beanstalk does not require a specific AMI ID; it uses the one provided. Option D is incorrect because the health check is based on HTTP response, not instance status checks.

Answer

The Elastic Beanstalk environment was created before the custom AMI was registered.

Answer

The custom AMI is not registered with the same account that owns the Elastic Beanstalk environment.

Answer

The custom AMI does not have the latest patches, causing the instance to fail the EC2 status checks.

Question 6

An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?

Accepted Answer

The NAT gateway's subnet does not have a route to an internet gateway. The NAT gateway must be in a public subnet with a route table that includes a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, because the IGW is the only way to reach public IP addresses. The question states the NAT gateway is deployed in a public subnet, but if that subnet's route table lacks the IGW route, outbound traffic from the NAT gateway will fail.

Answer

The private subnet's network ACL blocks outbound HTTPS traffic

Answer

The security group attached to the NAT gateway does not allow outbound traffic

Answer

The private instances do not have a public IP address assigned

Question 7

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB) in the us-west-2 Region. Users are distributed globally and experience high latency. The SysOps administrator wants to improve latency and offload SSL termination to the edge. Which AWS service should be used with the ALB as the origin?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations worldwide, reducing latency for global users. It can offload SSL termination at the edge by accepting HTTPS requests from clients and forwarding them to the ALB over HTTP or HTTPS, thereby reducing the load on the origin. This directly addresses the requirements of improving latency and offloading SSL termination.

Answer

AWS Global Accelerator

Answer

AWS WAF (Web Application Firewall)

Answer

Amazon Route 53 with Latency Based Routing

Question 8

A SysOps administrator wants to deploy a new version of an application to an existing Auto Scaling group of Amazon EC2 instances. The deployment must minimize disruption by launching new instances, performing health checks, and shifting traffic to the new instances before terminating the old ones. Which AWS CodeDeploy deployment configuration should the administrator choose?

Accepted Answer

Blue/green. The blue/green deployment configuration in AWS CodeDeploy is designed to minimize disruption by provisioning a new set of instances (green environment), performing health checks against them, and then shifting traffic from the old instances (blue environment) to the new ones before terminating the old instances. This matches the requirement of launching new instances, health-checking, and shifting traffic before termination, which is not possible with in-place deployment types like rolling or all-at-once.

Answer

Rolling

Answer

AllAtOnce

Answer

Canary

Question 9

A SysOps administrator creates the above IAM policy for a user. The user reports that they cannot delete an object in the bucket 'my-bucket' even though they are using MFA. What is the likely cause?

Accepted Answer

The user is not using MFA when making the API call.. The policy requires MFA for all s3:DeleteObject actions, as indicated by the condition key aws:MultiFactorAuthPresent set to 'true'. If the user reports they cannot delete an object despite using MFA, the most likely cause is that they are not actually using MFA when making the API call — for example, they may have authenticated with long-term credentials (access key/secret key) without a multi-factor authentication session. The condition key checks the presence of an MFA-authenticated session token, not just whether the user has MFA enabled on their account.

Answer

The resource ARN is missing the bucket-level permission.

Answer

The condition key aws:MultiFactorAuthPresent is incorrectly spelled.

Answer

The policy does not include s3:DeleteObjectVersion.

Question 10

An organization uses AWS OpsWorks for configuration management. The SysOps administrator notices that a stack's instances are not receiving the updated custom cookbooks after a new deployment. The cookbooks are stored in a private GitHub repository. What is the most likely cause?

Accepted Answer

The SSH key for the Git repository is not configured in the stack.. AWS OpsWorks uses the SSH key configured in the stack to clone private Git repositories. Without a valid SSH key, the cookbook update fails silently. Option A is incorrect because cookbooks can be stored in S3 or Git; S3 is not required. Option B is incorrect because the OpsWorks agent must be running, but the symptom of a missing SSH key is specific to private repositories. Option C is incorrect while instances need internet access to reach GitHub, a missing SSH key is a more specific cause for private repos.

Answer

The cookbooks are not stored in an S3 bucket.

Answer

The OpsWorks agent is not running on the instances.

Answer

The instances do not have internet access.

Question 11

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending a notification via Amazon SNS, when a status check fails. This is the native AWS service designed for real-time monitoring and alerting on metric thresholds, making it the correct choice for this use case.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 12

A company runs a critical database on an RDS for PostgreSQL instance in a single Availability Zone. The database experiences high write latency. The SysOps Administrator needs to improve the database's reliability and performance without downtime. Which solution meets these requirements?

Accepted Answer

Modify the RDS instance to be Multi-AZ with a standby in another Availability Zone.. Enabling Multi-AZ for an RDS for PostgreSQL instance provisions a standby replica in a different Availability Zone and synchronously replicates data to it. This eliminates the single point of failure, improving reliability. The modification is performed as a zero-downtime operation via a DNS update, meeting the requirement for no downtime. Note that Multi-AZ improves availability but does not reduce write latency; performance improvement may come from offloading backups and other administrative tasks to the standby.

Answer

Create a Multi-AZ deployment in the same Availability Zone.

Answer

Increase the allocated storage for the RDS instance.

Answer

Create a read replica in another Availability Zone and redirect read traffic.

Question 13

A SysOps administrator needs to allow traffic from a specific IP address range (203.0.113.0/24) to access an Amazon EC2 instance in a VPC. Which configuration step should be performed?

Accepted Answer

Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.. Security groups act as a virtual firewall for EC2 instances, allowing you to specify inbound rules to permit traffic from specific IP ranges like 203.0.113.0/24. Option A is incorrect because IAM policies manage permissions for AWS actions, not network traffic filtering. Option B is incorrect because network ACLs provide stateless filtering at the subnet level, but security groups are more appropriate for instance-level control and are stateful. Option C is incorrect because route tables control the direction of outbound traffic and do not restrict inbound access to instances.

Answer

Create an IAM policy that allows inbound traffic from 203.0.113.0/24.

Answer

Add a rule to the network ACL associated with the subnet to allow inbound traffic from 203.0.113.0/24.

Answer

Modify the route table of the subnet to include a route for 203.0.113.0/24 to the internet gateway.

Question 14

A SysOps administrator is troubleshooting an application that runs on an EC2 instance. The application is experiencing high latency, and the administrator suspects a memory leak. Which metrics should the administrator examine first?

Accepted Answer

Custom CloudWatch metrics published by the CloudWatch agent, such as mem_used_percent.. A memory leak causes the application to consume increasing amounts of memory over time, leading to high latency as the OS begins swapping or the kernel reclaims memory. The CloudWatch agent can publish custom metrics like `mem_used_percent`, which directly tracks memory usage percentage and is the most relevant metric to confirm a memory leak. Default EC2 metrics do not include memory utilization, so the administrator must rely on custom metrics from the CloudWatch agent.

Answer

CloudWatch metrics from the Detailed Monitoring feature, such as DiskReadOps.

Answer

CloudWatch metrics for the instance's Elastic Network Interface.

Answer

CloudWatch default EC2 metrics, such as CPUUtilization and NetworkIn.

Question 15

A company stores sensitive data in an RDS database. Which AWS service should be used to encrypt the database at rest?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) provides encryption keys that can be used to enable encryption at rest for Amazon RDS databases. Option A is incorrect because AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for encryption at rest. Option B is incorrect because AWS Identity and Access Management (IAM) manages user identities and permissions, not encryption keys. Option D is incorrect because AWS CloudHSM provides hardware security modules but is not the primary service used for RDS encryption; KMS is the simpler and recommended service for RDS encryption.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 16

A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?

Accepted Answer

Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.. Options A, B, and D are correct. A bucket policy with a condition for vpc:SourceVpce, a VPC endpoint for S3, and route table updates are required. Option C is wrong because IAM users alone do not restrict access by VPC; a bucket policy with a VPC condition is needed. Option E is wrong because security groups cannot be attached to S3 buckets as they are not network interfaces.

Answer

Create IAM users and assign them permissions to access the bucket.

Answer

Attach a security group to the S3 bucket.

Question 17

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The operations team uses CloudWatch alarms to monitor the application's health. Recently, they noticed that the application's error rate has increased sporadically, but the CPU utilization and memory usage remain normal. The team suspects that the issue is related to a specific HTTP endpoint returning 5xx errors. They want to set up monitoring that will alert them when the error rate exceeds 5% of total requests over a 5-minute period. The application logs are already sent to CloudWatch Logs. Which combination of steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Create a metric filter in CloudWatch Logs to extract error codes and total requests from the application logs. Create two custom metrics: one for error count and one for total requests. Then create a CloudWatch alarm using a math expression that calculates error rate (error count / total requests) and triggers when >0.05 for 5 minutes.. It creates a metric filter on the log group to count errors and total requests, then an alarm on the error rate. Option B is wrong because AWS X-Ray is for tracing, not for error rate monitoring from logs. Option C is wrong because it relies on the CloudWatch agent to generate metrics, which is not already set up. Option D is wrong because it uses the ALB's HTTPCode_ELB_5XX metric, but the issue is application-specific, not ALB-level.

Answer

Enable AWS X-Ray on the application to trace requests and identify error patterns. Create a CloudWatch alarm on the X-Ray error rate metric.

Answer

Install the CloudWatch agent on the EC2 instances to collect application-level metrics. Configure the agent to emit a custom metric for error rate. Then create an alarm on that metric.

Answer

Enable detailed monitoring on the ALB and create a CloudWatch alarm on the HTTPCode_ELB_5XX metric with a threshold of 5% of the request count. Use the ALB's RequestCount metric to compute the percentage.

Question 18

A SysOps administrator is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. What should the administrator check FIRST?

Accepted Answer

The ApplicationStop lifecycle event hook script in the AppSpec file. The ApplicationStop lifecycle event hook script in the AppSpec file often fails with a non-zero exit code, causing the deployment to fail with this error. The error indicates that too many instances failed or are unhealthy, and the most common cause is a faulty script. Option A is incorrect because the CodeDeploy agent version is not the first thing to check; the error is about instance failures during deployment, not agent issues. Option B is incorrect because the Auto Scaling group's minimum size is already set to 2, and the error is not about group size but about individual instance health. Option C is incorrect because a load balancer health check configuration problem would result in a different error related to health check failures, not the specific message about instance deployment failures.

Answer

The CodeDeploy agent version on the instances

Answer

The Auto Scaling group's minimum size

Answer

The load balancer health check configuration

Question 19

A SysOps administrator notices that the monthly bill for Amazon S3 has increased significantly. The company uses S3 for storing application logs and user uploads. The logs are accessed rarely but must be retained for 3 years. User uploads are accessed frequently for the first 30 days, then rarely after. Which S3 lifecycle policy will optimize storage costs?

Accepted Answer

Transition logs to S3 Glacier Deep Archive after 30 days, and transition user uploads to S3 Standard-IA after 30 days, then to Glacier Deep Archive after 90 days.. This lifecycle policy optimizes costs by transitioning logs (rarely accessed but need retention) directly to S3 Glacier Deep Archive after 30 days, and for user uploads (frequently accessed for the first 30 days, then rarely), transition to S3 Standard-IA after 30 days, then to Glacier Deep Archive after 90 days. Option B is wrong because it transitions user uploads (initially frequent access) to Glacier Deep Archive too early, causing retrieval costs. Option C is wrong because logs should be archived, but deleting user uploads after 1 year may be premature. Option D is wrong because it transitions logs to Standard-IA, which is not cost-effective for long-term retention, and user uploads to One Zone-IA, which lacks durability.

Answer

Transition user uploads to S3 Glacier Deep Archive after 30 days, and transition logs to S3 Glacier after 90 days.

Answer

Move logs to S3 Glacier Deep Archive after 30 days, and delete user uploads after 1 year.

Answer

Transition logs to S3 Standard-IA after 30 days, and transition user uploads to S3 One Zone-IA after 30 days.

Question 20

A company wants to securely store secrets such as database credentials and API keys used by applications running on Amazon EC2. Which AWS service should be used to manage and rotate these secrets automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to manage secrets, including automatic rotation. Option A is wrong because IAM is for AWS user credentials and permissions, not for storing application secrets. Option C is wrong because AWS KMS is for encryption keys, not secrets management. Option D is wrong because AWS Systems Manager Parameter Store can store secrets but does not support automatic rotation natively (requires custom Lambda).

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store