SOA-C02 Practice Test 28 — 15 Questions

Question 1

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which solution meets this requirement with minimal administrative overhead?

Accepted Answer

Create a new encrypted DB instance and migrate the data.. To encrypt data at rest in Amazon RDS for MySQL, encryption must be enabled at launch time; it cannot be added later. Therefore, the correct approach is to create a new encrypted DB instance and migrate the existing data (Option A). Option B (application-level encryption) adds administrative overhead and is not native to RDS. Option C is incorrect because encryption cannot be enabled on an existing instance; you must create a new one. Option D is incorrect because RDS does not use S3 for its primary storage; it uses Amazon EBS volumes.

Answer

Use application-level encryption to encrypt data before storing it in the DB.

Answer

Enable encryption on the existing DB instance by modifying the DB instance.

Answer

Store the data in an S3 bucket with encryption enabled and use RDS to access it.

Question 2

A SysOps administrator wants to automate the creation of an Amazon RDS database instance using AWS CloudFormation. The database must be created in a specific VPC and must be Multi-AZ. Which CloudFormation resource property should the administrator configure to meet these requirements?

Accepted Answer

DBSubnetGroupName and MultiAZ. The DBSubnetGroupName property specifies the VPC subnets for the RDS instance, ensuring it is created in the desired VPC. The MultiAZ property enables Multi-AZ deployment for high availability. Other options: DBInstanceIdentifier (D) is only a name, Engine (B) defines the database engine type, and DBInstanceClass (C) specifies the instance size; none affect VPC placement or Multi-AZ functionality.

Answer

Engine

Answer

DBInstanceClass

Answer

DBInstanceIdentifier

Question 3

A SysOps administrator needs to automate the provisioning of AWS resources using infrastructure as code. The solution must track changes and allow rollbacks. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation provides infrastructure as code with change tracking and rollback capabilities. Option B (AWS Config) is for compliance and auditing, not provisioning. Option C (AWS Service Catalog) is for managing approved products, not general IaC. Option D (AWS OpsWorks) is a configuration management service, not primarily IaC.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS OpsWorks

Question 4

A company is using AWS CloudFormation to deploy infrastructure. They want to reduce costs by identifying unused resources. Which AWS service should they use to monitor and report on resource utilization and cost?

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor provides cost optimization checks, including identifying idle resources and underutilized instances, helping reduce costs. Option B (AWS Config) is incorrect because it tracks configuration changes and compliance, not cost optimization. Option C (Amazon CloudWatch) is incorrect because it monitors metrics and logs, not cost optimization directly. Option D (AWS CloudTrail) is incorrect because it logs API activity, not cost or resource utilization.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Question 5

A company uses S3 standard storage for all data. They have data that is accessed rarely but must be retained for 7 years. Which storage class would be MOST cost-effective?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage for long-term archival. S3 Standard is expensive, S3 IA is for infrequent access but not long-term, and S3 One Zone IA is less durable.

Answer

S3 One Zone-IA

Answer

S3 Standard

Answer

S3 Intelligent-Tiering

Question 6

A company wants to monitor the performance of its Amazon RDS for MySQL database. The database is experiencing high CPU utilization during peak hours. The SysOps administrator needs to identify the queries causing the load. Which AWS service should be used?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights provides a dashboard that visualizes database load and helps identify the queries causing high CPU usage. Option B is wrong because AWS CloudTrail records API activity, not database query performance data. Option C is wrong because Amazon Inspector is a vulnerability management service, not a database performance tool. Option D is wrong because Amazon CloudWatch Logs collects log files but does not analyze query performance or CPU usage impact.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

Amazon CloudWatch Logs

Question 7

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile has an IAM role with a policy that allows s3:GetObject on the bucket. The S3 bucket policy has a Deny for all principals except a specific service role. What is the most likely reason for the access failure?

Accepted Answer

The S3 bucket policy Deny overrides the IAM role permissions.. An explicit Deny in an S3 bucket policy overrides any Allow permissions granted by IAM policies, including those from an instance profile role. In this scenario, the bucket policy denies access to all principals except a specific service role, so even though the IAM role attached to the EC2 instance allows s3:GetObject, the Deny takes precedence, causing access failure. Option A is incorrect because the issue is not about the trust policy; if the instance profile is attached, EC2 can assume the role. Option B is incorrect because the instance profile attachment is not the likely cause; the Deny in the bucket policy would block access regardless. Option C is incorrect because a VPC endpoint is not required for S3 access and would not override the bucket policy Deny.

Answer

The IAM role trust policy does not allow EC2 to assume the role.

Answer

The instance profile is not correctly attached to the EC2 instance.

Answer

The S3 bucket requires a VPC endpoint.

Question 8

A company uses AWS OpsWorks to manage a stack of EC2 instances running a web application. They recently migrated to AWS Elastic Beanstalk for easier deployments. However, after the migration, some users report that the application is responding slowly during peak hours. The Elastic Beanstalk environment is configured with a load balancer and auto scaling based on average CPU utilization. What should the SysOps Administrator do to troubleshoot the performance issue?

Accepted Answer

Review the CloudWatch metrics and logs for the Elastic Beanstalk environment.. Reviewing CloudWatch metrics and logs from the Elastic Beanstalk environment can identify if the auto scaling policy is not aggressive enough or if there are other bottlenecks. Option A is wrong because manually scaling the environment is a reactive measure that does not help identify the root cause of the performance issue. Option B is wrong because reverting to the OpsWorks stack would be a step backward and does not address the current environment's performance problem. Option D is wrong because increasing instance size without analysis may be inefficient and not resolve the underlying issue.

Answer

Manually scale the environment to add more instances.

Answer

Revert to the OpsWorks stack configuration.

Answer

Increase the instance size in the environment configuration.

Question 9

A company wants to receive alerts when their monthly AWS spending exceeds $1,000. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets allows setting cost thresholds and alerts. CloudWatch alarms are for metrics, not budgets. Cost Explorer is for visualization. Trusted Advisor provides recommendations.

Answer

AWS Trusted Advisor

Answer

AWS CloudWatch

Answer

AWS Cost Explorer

Question 10

A company uses AWS KMS to encrypt data stored in S3. The security team wants to rotate the KMS key automatically every year. The SysOps administrator enabled automatic key rotation for the KMS key. However, after a year, the security team finds that the key has not been rotated. What is the most likely cause?

Accepted Answer

The KMS key was created by importing key material.. AWS KMS does not support automatic key rotation for customer-managed keys that were created by importing key material. This is a key limitation to remember. Options A and B are incorrect because automatic rotation is independent of the key's enabled state or the key policy; rotation occurs automatically for supported keys. Option C is incorrect because key usage is not a requirement for automatic rotation; the rotation schedule is based on time, not usage.

Answer

The KMS key is disabled.

Answer

The KMS key policy does not allow rotation.

Answer

The KMS key has not been used in the last year.

Question 11

A SysOps administrator is creating a CloudFormation stack that requires an IAM role to be passed to EC2 instances. The administrator is using the IAM policy shown in the exhibit. The stack creation fails with an error indicating insufficient permissions to pass the role. What is the most likely cause?

Accepted Answer

The iam:PassRole permission is restricted to a specific role ARN that does not match the role the administrator is trying to pass.. The IAM policy likely includes an iam:PassRole action restricted to a specific role ARN (e.g., 'arn:aws:iam::account:role/Admin'), but the CloudFormation stack is attempting to pass a different role. This causes an insufficient permissions error because the PassRole permission is scoped to that specific role. Option A is incorrect because cloudformation:* includes all CloudFormation actions, including creating stacks. Option B is incorrect because the policy uses cloudformation:*, which implicitly includes CreateStack. Option C is incorrect because ec2:RunInstances is not required for passing an IAM role; the necessary permission is iam:PassRole.

Answer

The cloudformation:* action does not include permission to create stacks.

Answer

The policy does not include the cloudformation:CreateStack action.

Answer

The ec2:RunInstances permission is missing from the policy.

Question 12

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The company needs to ensure that the ALB sends requests to instances that are healthy and can serve traffic. Which feature should be used to monitor the health of the instances?

Accepted Answer

Health checks. Health checks allow the ALB to monitor the health of EC2 instances by sending periodic requests to a specified endpoint (e.g., /health). If an instance fails consecutive health checks, the ALB stops sending traffic to it. Option B is incorrect because sticky sessions (session affinity) ensure a client's requests are sent to the same instance, not health monitoring. Option C is incorrect because cross-zone load balancing distributes traffic across instances in multiple Availability Zones. Option D is incorrect because connection draining (deregistration delay) allows in-flight requests to complete before an instance is removed from the target group.

Answer

Sticky sessions

Answer

Cross-zone load balancing

Answer

Connection draining

Question 13

A company needs to deploy a set of microservices using Docker containers on AWS. The deployment should be automated and support scaling based on demand. Which AWS service should be used to orchestrate the containers?

Accepted Answer

Amazon ECS. Amazon ECS is a fully managed container orchestration service that integrates with Auto Scaling and CloudWatch to automate deployment and scaling of Docker containers. Option A (Lambda) is for serverless functions, not containers. Option B (Elastic Beanstalk) can deploy containers but is less flexible for microservices orchestration. Option D (CodeDeploy) is for application deployments, not container orchestration.

Answer

AWS Lambda

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 14

Refer to the exhibit. The security team wants to ensure that all objects uploaded to the S3 bucket 'my-secure-bucket' are encrypted at rest. Based on the CloudTrail log entry, what can be concluded about the object 'confidential.pdf'?

Accepted Answer

The object is encrypted with SSE-S3. The CloudTrail log entry shows that the object 'confidential.pdf' was uploaded with the 'x-amz-server-side-encryption' header set to 'AES256'. This header indicates that server-side encryption with Amazon S3-managed keys (SSE-S3) was requested. The response also confirms that encryption was applied. Therefore, the object is encrypted with SSE-S3, making option C correct. Option A is incorrect because the log does not mention KMS key details. Option B is incorrect because the object is encrypted. Option D is incorrect because the encryption header was provided.

Answer

The object is encrypted with AWS KMS

Answer

The object is not encrypted

Answer

The object was uploaded without an encryption header

Question 15

Match each AWS backup and disaster recovery service to its feature.

Accepted Answer

AWS Backup: Centralized backup service that automates and consolidates backup tasks across AWS services.. The correct matches are: AWS Backup for centralized automation, AWS Elastic Disaster Recovery for continuous replication, AWS Storage Gateway for hybrid cloud storage, and AWS Snowball for offline transfer. Common confusions involve swapping the centralized backup and replication functions.

Answer

AWS Backup: Continuous block-level replication for fast recovery of applications.

Answer

AWS Elastic Disaster Recovery: Centralized backup service that automates and consolidates backup tasks across AWS services.