SOA-C02 Practice Test 27 — 15 Questions

Question 1

A company wants to centrally manage access to AWS accounts for its employees. Which AWS service should be used to create and manage users and groups across multiple accounts?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (successor to AWS SSO) allows you to centrally create and manage users and groups and assign them single sign-on access to multiple AWS accounts. Option C is correct. Option A (AWS IAM) is wrong because IAM is per-account and not designed for cross-account user management. Option B (AWS Directory Service) is wrong because it provides managed Microsoft Active Directory, not multi-account user management. Option D (AWS Organizations) is wrong because it manages accounts and policies, not users and groups.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS Organizations

Question 2

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects in the bucket be encrypted at rest using AWS KMS. An administrator notices that some objects are not encrypted. What is the MOST efficient way to enforce encryption for future uploads?

Accepted Answer

Add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms.. Adding a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms is the most efficient way to enforce encryption for future uploads. This policy prevents any upload without proper encryption. Option A is incorrect because SCPs (Service Control Policies) limit IAM permissions but do not directly enforce encryption on S3 objects. Option B is incorrect because AWS Config can detect unencrypted objects but does not automatically encrypt them; it is a reactive measure. Option D is incorrect because S3 default encryption can be overridden by the client specifying a different encryption header in the upload request.

Answer

Use an SCP to require KMS encryption for all S3 actions.

Answer

Use AWS Config to detect unencrypted objects and automatically encrypt them.

Answer

Enable S3 default encryption on the bucket with KMS.

Question 3

A company uses AWS CloudFormation to manage infrastructure. The SysOps administrator needs to update a stack that contains a critical database. The update may require a replacement of the database resource. The administrator wants to review the changes before they are applied. What is the BEST way to achieve this?

Accepted Answer

Use the AWS CloudFormation create-change-set command and then review the changes before executing.. Creating a change set allows you to review all changes, including replacements, before executing them. Option A is incorrect because the '--no-fail-on-empty-changeset' flag does not provide a review. Option B is incorrect because a stack policy can protect resources but does not allow reviewing changes. Option D is incorrect because the drift detection feature detects drift, not planned changes.

Answer

Use the AWS CloudFormation update-stack command with the --no-fail-on-empty-changeset flag.

Answer

Apply a stack policy that prevents replacement of the database resource.

Answer

Use the AWS CloudFormation detect-stack-drift command to check for differences.

Question 4

An organization requires that all Amazon S3 buckets be encrypted with AES-256 server-side encryption. A SysOps administrator needs to enforce this policy across the entire AWS account. Which action should be taken?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to AES256.. A bucket policy that denies PutObject without the x-amz-server-side-encryption header set to AES256 will enforce encryption. Option A is wrong because default encryption does not prevent objects from being uploaded without encryption header. Option B is wrong because CloudTrail logs but does not enforce. Option C is wrong because S3 Inventory does not enforce.

Answer

Enable default encryption on all existing and future S3 buckets.

Answer

Use AWS CloudTrail to monitor uploads without encryption and alert the administrator.

Answer

Use S3 Inventory to list unencrypted objects and remediate them manually.

Question 5

An application uses an RDS MySQL DB instance. The administrator notices that read performance is poor during peak hours. What is a cost-effective way to improve read performance?

Accepted Answer

Create a read replica in the same region.. Creating a read replica offloads read traffic from the primary RDS instance, improving read performance during peak hours at a relatively low cost. Option A (ElastiCache) adds complexity and additional cost. Option B (Multi-AZ) is for high availability and disaster recovery, not for read performance. Option C (scaling up) addresses performance but is more expensive than adding a read replica.

Answer

Use Amazon ElastiCache for caching.

Answer

Enable Multi-AZ deployment.

Answer

Scale up the DB instance to a larger size.

Question 6

A SysOps administrator discovers that an EC2 instance was compromised because the SSH key pair was leaked. The administrator wants to ensure that future access to EC2 instances is secured using a method that does not rely on static keys. Which solution should the administrator implement?

Accepted Answer

Use EC2 Instance Connect to connect to instances.. EC2 Instance Connect allows you to connect to EC2 instances using IAM policies and does not require managing or distributing static SSH key pairs. This eliminates the risk of key leakage. Option A (bastion host with limited IP range) still relies on SSH key pairs for authentication. Option B (create new key pair) continues to use static keys and does not address the root cause. Option C (Systems Manager Session Manager) provides secure access without keys, but it requires the SSM Agent and an IAM instance role, and is not as directly focused on SSH key replacement as EC2 Instance Connect. Therefore, Option D is the best solution.

Answer

Use a bastion host with a security group that allows SSH from a limited IP range.

Answer

Create a new key pair and distribute it securely to authorized users.

Answer

Use AWS Systems Manager Session Manager to connect to instances.

Question 7

A company wants to monitor the performance of its application running on EC2. Which TWO metrics should be monitored to detect performance bottlenecks? (Choose TWO.)

Accepted Answer

CPU Utilization. To detect performance bottlenecks on EC2, you should monitor CPU Utilization (B) and Memory Utilization (E). High CPU utilization indicates CPU-bound issues, while high memory utilization can cause swapping and degrade performance. Network Packets In (A) is a network metric but not typically a direct performance bottleneck indicator. Status Check Failed (C) is for instance health, not performance. Disk Space Utilization (D) is a storage capacity metric, not a performance metric, and is not available by default (requires custom scripts).

Answer

Network Packets In

Answer

Status Check Failed

Answer

Disk Space Utilization

Question 8

A company is using AWS OpsWorks for configuration management. They have a stack with multiple layers, and they want to automate the deployment of a custom configuration file to all instances in a specific layer. What is the MOST efficient way to achieve this?

Accepted Answer

Create a custom cookbook and assign it to the layer.. OpsWorks custom cookbooks allow you to run recipes that can deploy files to instances in a layer. Option A is incorrect because the AWS::OpsWorks::App resource is used to deploy applications, not configuration files, and it does not directly add custom configuration files to instances. Option C is incorrect because AWS Systems Manager Run Command can execute commands but is not specific to OpsWorks layers and is less efficient for automating deployments tied to a specific layer's lifecycle. Option D is incorrect because user data scripts run at boot time only, not on demand, and they are not directly associated with OpsWorks layers.

Answer

Define the file in an AWS CloudFormation template using the AWS::OpsWorks::App resource.

Answer

Use AWS Systems Manager Run Command to execute a script on each instance.

Answer

Add the configuration file as user data in the layer's Auto Scaling group.

Question 9

A company uses AWS CloudFormation with nested stacks. The parent stack creates a child stack that launches an Auto Scaling group. The child stack fails to create, and the parent stack rolls back. The administrator wants to debug the child stack. What is the most efficient way to view the child stack's events?

Accepted Answer

Navigate to the child stack in the AWS CloudFormation console and view its events.. After a nested stack fails, it remains in a FAILED state and is visible in the AWS CloudFormation console. You can navigate directly to the child stack to view its events and identify the cause of failure. Option B is incorrect because rerunning the parent stack with a different name would create a new child stack, not help debug the original failed child stack. Option C is incorrect because CloudWatch Logs are not automatically enabled for CloudFormation stacks; you would need to configure logging. Option D is incorrect because the parent stack's events only show aggregated status or a failure message for the child stack, not the detailed events inside the child stack.

Answer

Rerun the parent stack with a different name to see the child stack creation.

Answer

Check the CloudWatch Logs for the parent stack.

Answer

View the parent stack's events in the AWS Management Console.

Question 10

A company is using AWS Organizations with SCPs to restrict access to services. The security team wants to ensure that no IAM user can create access keys, but the SCP is not working as expected. What is the most likely cause?

Accepted Answer

The SCP is applied to a member account, but the IAM user is in the management account.. SCPs apply only to member accounts, not the management account. If the IAM user is in the management account, the SCP cannot restrict their actions. Option A is incorrect because SCPs are inherited from the root OU to all member accounts, so the SCP would be applied if the account were a member account; the issue is that the user is in the management account. Option C is wrong because SCPs take effect almost immediately, not 24 hours. Option D is wrong because SCPs apply to all principals (including IAM users) in member accounts, not just root users.

Answer

The SCP is applied to the root OU but not inherited by the account.

Answer

The SCP has a Deny effect, but it takes 24 hours to apply.

Answer

The SCP only applies to root users, not IAM users.

Question 11

A company wants to ensure that all data in Amazon S3 is encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be used to deny any PUT request that does not include the 'x-amz-server-side-encryption' header with value 'aws:kms'?

Accepted Answer

Condition: { StringNotEquals: { 's3:x-amz-server-side-encryption': 'aws:kms' } }. It uses the condition key 's3:x-amz-server-side-encryption' and denies the request when the header value is not 'aws:kms', enforcing SSE-KMS. Option B is incorrect because it checks the specific KMS key ID via 's3:x-amz-server-side-encryption-aws-kms-key-id', not the encryption type. Option C is incorrect because 's3:ServerSideEncryption' is not a valid condition key for S3; the correct key is 's3:x-amz-server-side-encryption'. Option D is incorrect because using StringEquals with this condition key would only match requests that include the header with value 'aws:kms', but a deny policy with this condition would not block requests that omit the header entirely; additionally, the question requires denying requests that do not include the specified encryption header.

Answer

Condition: { StringNotEquals: { 's3:x-amz-server-side-encryption-aws-kms-key-id': 'alias/aws/s3' } }

Answer

Condition: { StringNotEquals: { 's3:ServerSideEncryption': 'KMS' } }

Answer

Condition: { StringEquals: { 's3:x-amz-server-side-encryption': 'aws:kms' } }

Question 12

A company is using Amazon S3 to host a static website. The website receives millions of requests per month from users around the world. The company wants to reduce latency and S3 data transfer costs. Which solution should the company implement?

Accepted Answer

Use Amazon CloudFront as a content delivery network in front of the S3 bucket.. Amazon CloudFront is a content delivery network that caches content at edge locations, reducing latency and data transfer costs from S3. S3 Transfer Acceleration speeds up uploads but not downloads. S3 Replication does not reduce latency. S3 Cross-Region Replication is for data redundancy, not performance.

Answer

Enable S3 replication to multiple regions.

Answer

Enable S3 Transfer Acceleration.

Answer

Use S3 Cross-Region Replication to replicate objects to all regions.

Question 13

A SysOps administrator is automating the deployment of a three-tier web application using AWS CloudFormation. The administrator wants to ensure that the database tier is created before the application tier. How should the administrator define this dependency in the CloudFormation template?

Accepted Answer

Use the DependsOn attribute on the application tier resources to reference the database tier resources.. CloudFormation supports the DependsOn attribute to specify resource dependencies. The application tier resources must wait for the database tier resources to be created. Option A is wrong because the Conditions section determines whether resources are created based on conditions, not the creation order. Option B is wrong because the Outputs section exports values for use in other stacks, but does not control the order of creation within the same stack. Option D is wrong because the Parameters section defines input values passed to the template, not dependencies.

Answer

Use the Conditions section to check if the database exists before creating the application tier.

Answer

Use the Outputs section to export the database endpoint and import it in the application tier.

Answer

Use the Parameters section to pass the database instance identifier to the application stack.

Question 14

Match each AWS service to its primary function.

Accepted Answer

CloudTrail: Records API activity for auditing. AWS CloudTrail records API calls for auditing; AWS Config evaluates resource configurations; AWS Trusted Advisor gives recommendations. Common confusions involve swapping CloudTrail and Config functions.

Answer

CloudTrail: Monitors resource configurations for compliance

Answer

Config: Records API activity for audit trail

Question 15

An S3 bucket policy is shown in the exhibit. The AdminRole attempts to upload an object to my-bucket without specifying any server-side encryption header. What will happen?

Accepted Answer

The upload fails because the Deny statement denies PutObject without encryption.. The Deny statement denies PutObject when encryption is not aws:kms. Since the request has no encryption header, it does not equal aws:kms, so the Deny applies and the upload fails. The Allow statement allows the action only when encryption is aws:kms, so without encryption, it does not apply. Because the Deny overrides Allow, the upload is denied. Option A is wrong because the Allow does not apply. Option B is wrong because the Deny applies. Option C is wrong because the Deny does apply to the AdminRole.

Answer

The upload fails because the Allow statement requires encryption, but the Deny statement is evaluated first.

Answer

The upload succeeds because the Allow statement grants permission to the AdminRole.

Answer

The upload succeeds because the Deny statement does not apply to the AdminRole.