SOA-C02 Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. A company has a CloudTrail trail in us-east-1 that logs events for that region only. The company operates in multiple regions and wants to ensure all API calls from all regions are logged. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the existing trail to be a multi-region trail.. Updating the existing trail to be a multi-region trail is the most efficient way to log events from all regions. A multi-region trail logs API calls from all AWS regions into a single trail, aggregating them in the same S3 bucket. Option A is incorrect because CloudWatch Events can capture API calls, but it is less efficient and more complex than using a multi-region trail. Option B is incorrect because S3 event notifications are triggered by S3 events, not API calls, and cannot capture all API calls. Option C is incorrect because creating a new trail in each region results in multiple trails and log files, which is less efficient to manage than a single multi-region trail.

Answer

Use Amazon CloudWatch Events to capture API calls from all regions.

Answer

Use S3 event notifications to trigger a Lambda function that logs API calls.

Answer

Create a new CloudTrail trail in each region.

Question 2

A company uses Amazon CloudFront to distribute content globally. The operations team notices that the data transfer costs are higher than expected. The origin server is an S3 bucket in us-east-1. Which change would reduce data transfer costs?

Accepted Answer

Enable compression for compressible content.. Enabling compression reduces the amount of data transferred from CloudFront to viewers, directly lowering data transfer costs. Option A (Lambda@Edge to resize images) can reduce image sizes but adds compute costs and may not be as effective as compression. Option B (increasing default TTL) reduces origin requests but does not reduce data transfer from CloudFront to viewers. Option C (multiple S3 buckets in different regions) increases complexity and may increase costs due to cross-region replication or multiple origins. Thus, D is the correct choice.

Answer

Use Lambda@Edge to resize images on the fly.

Answer

Increase the default TTL for objects.

Answer

Use multiple S3 buckets in different regions as origins.

Question 3

A SysOps administrator needs to generate a report of all IAM users and their last activity. Which AWS service can provide this information?

Accepted Answer

IAM Credential Report. IAM Credential Report provides a consolidated report of all IAM users and their last activity, including password last used and access key last rotated. Option A is incorrect because AWS Config tracks resource configuration changes, not user activity. Option C is incorrect because AWS Trusted Advisor provides cost optimization and security recommendations, not detailed user activity reports. Option D is incorrect because AWS CloudTrail logs API calls but does not generate a summarized report of user credentials.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 4

A company wants to provide temporary security credentials to a mobile application so it can access an S3 bucket. Which AWS service should be used to issue these credentials?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is specifically designed to generate temporary security credentials for users and applications. Option A is incorrect: Amazon Cognito can issue temporary credentials via identity pools, but STS is the direct service for temporary credentials. Option B is incorrect: AWS KMS manages encryption keys, not credentials. Option D is incorrect: IAM manages long-term user credentials, not temporary ones.

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Question 5

Refer to the exhibit. A SysOps administrator is troubleshooting a CloudFront distribution that serves content from an S3 bucket. Users are receiving 'Access Denied' errors when trying to access objects. The exhibit shows the distribution configuration. What is the most likely cause?

Accepted Answer

The CloudFront distribution is not using an Origin Access Identity (OAI) to authenticate with the S3 bucket.. The exhibit shows that the Origin Access Identity (OAI) field is empty, meaning CloudFront is not using an OAI to authenticate with the S3 bucket. Without an OAI, CloudFront relies on the bucket being publicly accessible, but by default S3 buckets are private. Therefore, CloudFront cannot access the objects, resulting in 'Access Denied' errors. Option A is not evident from the exhibit; the bucket policy is not shown. Option B is incorrect because the distribution status is 'Enabled' in the exhibit. Option D is incorrect because the viewer protocol policy 'Redirect HTTP to HTTPS' would redirect users, not cause Access Denied.

Answer

The S3 bucket policy does not grant read access to CloudFront.

Answer

The distribution is not enabled.

Answer

The viewer protocol policy is set to 'redirect-to-https', but users are using HTTP.

Question 6

A company is running a production web application on EC2 instances behind an Application Load Balancer. The company wants to optimize costs without sacrificing performance. Which TWO actions should the SysOps administrator take?

Accepted Answer

Purchase Reserved Instances for the baseline capacity.. (Reserved Instances) provides a significant discount for steady-state workloads, and Option C (Auto Scaling) ensures capacity matches demand, preventing over-provisioning. Option B (Dedicated Hosts) is more expensive and unnecessary. Option D (T3 unlimited) could cause unexpected costs if credits exhausted. Option E (Multiple instance types per AZ) is not a cost optimization.

Answer

Use Dedicated Hosts for all instances to control placement.

Answer

Enable T2/T3 unlimited to handle spikes without throttling.

Answer

Use multiple instance types in each Availability Zone.

Question 7

A company uses AWS Lambda functions to process messages from an SQS queue. The Lambda function is configured with a reserved concurrency of 100. The SQS queue receives unpredictable spikes of up to 10,000 messages per second. The function takes about 1 second to process a message. The SysOps team notices that during spikes, messages are being throttled and appear in the DLQ. How can the team resolve this while optimizing cost?

Accepted Answer

Increase reserved concurrency to 1000 and enable batch processing with a batch size of 10 in the SQS event source mapping.. Increasing reserved concurrency to 1000 allows the Lambda function to scale to handle the spike of 10,000 messages per second, and enabling batch processing with a batch size of 10 reduces the number of invocations, which optimizes cost by processing up to 10 messages per invocation instead of one. Option A is wrong because reducing reserved concurrency would throttle even more messages, increasing DLQ traffic. Option C is wrong because using EC2 adds operational overhead and does not leverage Lambda's serverless scaling, increasing complexity and cost. Option D is wrong because Lambda does not use instance types; memory and timeout adjustments do not directly address concurrency limitations or batch processing.

Answer

Reduce the reserved concurrency to 10 to force the function to process messages more slowly.

Answer

Provision an EC2 fleet to poll the SQS queue and invoke the Lambda function.

Answer

Increase the Lambda function memory and timeout to use a larger instance type.

Question 8

A company wants to ensure that an EC2 instance can access an S3 bucket without storing AWS credentials on the instance. What should the SysOps administrator do?

Accepted Answer

Create an IAM role with permissions to the S3 bucket and attach it to the EC2 instance profile.. An IAM role can be attached to an EC2 instance via an instance profile, granting temporary security credentials that allow the instance to access the S3 bucket without storing long-term credentials on the instance. Option B is incorrect because an S3 bucket policy cannot be attached to an instance; it is attached to the S3 bucket itself, and using the instance's public IP is not a secure or recommended method. Option C is incorrect because storing access keys on the instance violates the requirement of not storing credentials. Option D is incorrect because while AWS STS can generate temporary credentials, storing them in instance user data is not secure and does not eliminate credential storage on the instance.

Answer

Attach an S3 bucket policy that grants access to the EC2 instance's public IP address.

Answer

Generate access keys for an IAM user and store them on the instance.

Answer

Use AWS STS to generate temporary credentials and store them in the instance's user data.

Question 9

A SysOps administrator is troubleshooting a failed Auto Scaling group launch. The group uses a launch template that specifies an Amazon Linux 2 AMI. The instances fail to pass the EC2 health check and are terminated. The administrator checks the system log and finds that the instance boots but the cloud-init script fails due to a missing package repository. What is the most likely cause?

Accepted Answer

The AMI used by the launch template is outdated and the repositories are no longer valid.. If the AMI is outdated, the package repository URLs may be deprecated, causing cloud-init failures. The launch template version is not directly related to repository access. User data script problems could cause failures but the log points to a missing repository, which is often due to an outdated AMI. IAM role issues would affect API calls, not package repos.

Answer

The launch template is using an incorrect version.

Answer

The IAM instance profile does not have sufficient permissions.

Answer

The Auto Scaling group is in a private subnet without a NAT gateway.

Question 10

A SysOps administrator reviews the CloudWatch metric data for an EC2 instance. The instance runs a web application that experiences high traffic between 12:00 and 14:00 UTC daily. The administrator wants to optimize costs while maintaining performance. What should the administrator do?

Accepted Answer

Create an Auto Scaling group with a scheduled scaling policy to add instances during peak hours.. The instance has low CPU utilization most of the day but spikes to 90% during peak hours. Using a scheduled Auto Scaling to add instances during peak hours ensures performance without over-provisioning. Option A is wrong because the instance is not constantly at high utilization. Option B is wrong because upgrading instance size increases cost during off-peak hours. Option D is wrong because a larger instance would be underutilized.

Answer

Convert the instance to a Reserved Instance to reduce hourly cost.

Answer

Replace the instance with a larger instance type and enable detailed monitoring.

Answer

Increase the instance size to handle peak load at all times.

Question 11

A company is using Amazon CloudFront to deliver content globally. Which feature can help reduce costs by minimizing data transfer from the origin?

Accepted Answer

Configure caching to serve content from edge locations.. Configuring caching in CloudFront allows content to be served from edge locations, reducing the number of requests that need to go to the origin. This minimizes data transfer from the origin and lowers costs. Option A is incorrect because multiple origins are for routing different content, not for reducing origin transfer; load balancing doesn't inherently reduce data transfer costs. Option C is incorrect because custom SSL certificates secure connections but do not affect data transfer costs. Option D is incorrect because Lambda@Edge runs custom code at edge locations but does not directly reduce the volume of data transferred from the origin; it may even add compute costs.

Answer

Enable multiple origins for load balancing.

Answer

Configure custom SSL certificates.

Answer

Use Lambda@Edge to process requests.

Question 12

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that only specific IAM roles can decrypt the volumes. Which configuration meets this requirement?

Accepted Answer

Modify the KMS key policy to allow only specific IAM roles to use kms:Decrypt.. KMS key policies allow you to specify which IAM roles are allowed to use the key for decryption. Option A is wrong because service control policies (SCPs) are used to set permission boundaries across accounts in an organization, but they are not the most direct way to restrict decryption for specific IAM roles; KMS key policies are more appropriate. Option B is wrong because EBS volumes do not have bucket policies; bucket policies apply to S3 buckets. Option D is wrong because instance profiles and policies denying ec2:DetachVolume do not affect decryption permissions.

Answer

Use a service control policy to deny kms:Decrypt for all users.

Answer

Apply a bucket policy on the EBS snapshot bucket.

Answer

Attach an instance profile with a policy that denies ec2:DetachVolume.

Question 13

Refer to the exhibit. The output shows the health status of two targets in a target group. One target is unhealthy with a 502 error. What is the most likely cause?

Accepted Answer

The web server on the target instance is returning HTTP 502 status codes.. A 502 Bad Gateway error from the target indicates that the web server on the instance is returning an invalid response, often due to an application error or misconfiguration. Option A is incorrect because a security group blocking health check traffic would result in a connection timeout or refusal, not a 502. Option B is incorrect because the health check is initiated by the ALB to the target instance, so outbound traffic from the instance is not relevant. Option D is incorrect because a misconfigured health check path would typically result in a 404 or other error, but not necessarily a 502. The 502 error is directly caused by the target's web server returning an HTTP 502 status code.

Answer

The target instance’s security group is blocking the health check traffic.

Answer

The target instance is not allowing outbound traffic to the ALB.

Answer

The ALB health check is misconfigured with an incorrect path.

Question 14

A company is using AWS Cost Explorer to analyze spending. They want to receive an email alert when costs exceed a certain threshold. Which service should they use?

Accepted Answer

AWS Budgets. AWS Budgets can send alerts when costs exceed thresholds. Option A (AWS Trusted Advisor) is wrong because it provides recommendations for cost optimization but does not send alerts based on cost thresholds. Option B (AWS Cost Explorer) is wrong because it is used for analyzing cost and usage data, not for sending alerts. Option C (Amazon CloudWatch) is wrong because CloudWatch monitors AWS resources and applications, but it does not natively monitor AWS costs or send cost threshold alerts.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

Amazon CloudWatch

Question 15

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The application consists of several Docker containers that run on Amazon ECS with Fargate launch type. The engineer wants to automate the deployment of new container versions. Which AWS service should be used to orchestrate the build, test, and deployment stages?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed continuous delivery service that orchestrates the build, test, and deploy phases of the release process. Option A is wrong because AWS CodeDeploy is for deploying applications to compute services but does not orchestrate the entire pipeline. Option C is wrong because AWS CloudFormation is for infrastructure as code, not CI/CD orchestration. Option D is wrong because AWS CodeBuild is for building and testing code, not for orchestrating the entire pipeline.

Answer

AWS CodeDeploy

Answer

AWS CloudFormation

Answer

AWS CodeBuild