SOA-C02 Practice Test 3 — 10 Questions

Question 1

A company uses AWS CloudTrail to record all API activity. The SysOps administrator needs to be alerted in real time when an IAM user creates a new access key. Which combination of AWS services should be used to create this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CloudTrail + Amazon EventBridge + Amazon SNS. Amazon EventBridge can directly consume CloudTrail events in real time and trigger an SNS notification when an IAM user creates a new access key. EventBridge provides a serverless event bus that matches specific API calls (e.g., CreateAccessKey) using event patterns, enabling immediate alerting without additional polling or log processing.

Answer

CloudTrail + Amazon S3 + Amazon SNS

Answer

CloudTrail + Amazon CloudWatch Logs + Amazon SNS

Answer

CloudTrail + AWS Config + Amazon SNS

Question 2

A company has two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The SysOps administrator needs to establish connectivity between these VPCs so that resources in VPC-A can reach resources in VPC-B using private IP addresses. The solution must be highly available and not involve a third-party appliance. Which solution should the administrator implement?

Accepted Answer

Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.. VPC Peering provides direct, private IP connectivity between two VPCs using the AWS global network, with no bandwidth bottleneck or single point of failure. By creating a peering connection and adding routes to the other VPC's CIDR in each VPC's route table, resources can communicate privately and the solution is highly available as the peering connection itself is redundant within AWS's infrastructure. No third-party appliance is required, and the setup is fully managed by AWS.

Answer

Create an AWS Transit Gateway and attach both VPCs to it. Configure route tables to allow communication.

Answer

Attach an internet gateway to each VPC and use Amazon Route 53 to resolve private DNS names over the internet.

Answer

Set up a site-to-site VPN connection between the two VPCs using AWS Virtual Private Gateway.

Question 3

A company runs a critical application on Amazon EC2 instances across multiple Availability Zones. The application stores state data on a shared Amazon EFS file system. The SysOps administrator needs to ensure that the file system remains available if an entire Availability Zone fails. The file system must also provide low-latency access from all instances. Which configuration meets these requirements?

Accepted Answer

Create an EFS file system with the Standard storage class in the same Region, and mount it from all instances using the regional mount target.. The EFS Standard storage class stores data redundantly across multiple Availability Zones (AZs) within a Region, ensuring high availability and durability even if an entire AZ fails. By mounting the file system using the regional mount target (which resolves to the EFS file system's regional DNS name), instances in any AZ can access the file system with low latency, as EFS automatically routes traffic to the most appropriate mount target in the same AZ. This configuration meets both the availability and low-latency requirements without additional replication or failover complexity.

Answer

Create an EFS file system with the One Zone storage class and mount it from all instances.

Answer

Create an EFS file system with the Standard storage class, enable replication to another Region, and use DNS failover.

Answer

Create an EFS file system with the Standard storage class, and enable Multi-AZ deployment.

Question 4

A company runs a batch processing application on Amazon EC2 instances every night. The job takes exactly 1 hour to complete and is time-sensitive. The SysOps administrator wants to minimize compute costs while ensuring the job can be interrupted and resumed if needed. Which EC2 purchasing option is most cost-effective?

Accepted Answer

Spot Instances. Spot Instances are the most cost-effective option because the batch job is fault-tolerant (can be interrupted and resumed) and runs for exactly 1 hour nightly. Spot Instances offer up to 90% discount compared to On-Demand, and with the ability to handle interruptions via checkpointing, they meet the requirement for cost minimization while supporting resumption.

Answer

On-Demand Instances

Answer

Reserved Instances (Standard 1-year)

Answer

Dedicated Hosts

Question 5

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS Systems Manager

Question 6

A SysOps administrator needs to monitor the health of an Amazon RDS for MySQL DB instance. The administrator wants to receive an alert when the database connection count exceeds a threshold of 500 for more than 5 minutes. Which AWS service should be used to create this alert?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service because it can monitor RDS metrics such as DatabaseConnections and trigger an alarm when the value exceeds a threshold of 500 for a specified duration (e.g., 5 consecutive evaluation periods). CloudWatch alarms evaluate metric data against a defined threshold and can then publish to an SNS topic to send notifications.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS CloudTrail

Answer

AWS Config

Question 7

A SysOps administrator needs to deploy the same AWS CloudFormation template across multiple AWS accounts and Regions in a single operation. The administrator wants to manage the deployment from a single management account. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy the same template across multiple accounts and Regions from a single management account. StackSets uses a self-managed or service-managed permission model to create, update, and delete stacks across target accounts in a single operation, making it the correct choice for this multi-account, multi-Region deployment requirement.

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS Service Catalog

Question 8

A SysOps administrator needs to monitor application logs in Amazon CloudWatch Logs for the occurrence of the string 'ERROR'. The administrator wants to create a custom metric that counts the number of 'ERROR' occurrences per 5-minute window and trigger an Amazon CloudWatch alarm when the count exceeds 10. Which action should the administrator take to create the custom metric?

Accepted Answer

Create a metric filter on the CloudWatch Logs log group that matches the term 'ERROR'.. Metric filters in CloudWatch Logs allow you to define a pattern (e.g., 'ERROR') that is evaluated against incoming log events. The filter counts occurrences and publishes a custom metric to CloudWatch, which can then be used to set an alarm with a period of 5 minutes and a threshold of 10.

Answer

Create a CloudWatch Events rule that triggers on 'ERROR' and publishes a metric.

Answer

Create a CloudWatch dashboard that displays the log group and set an alarm on the dashboard.

Answer

Enable AWS CloudTrail on the log group and select the 'ERROR' pattern.

Question 9

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The error message indicates that an IAM role creation failed because the role already exists. The administrator wants to ensure the stack creation can proceed without manual intervention. What should the administrator do?

Accepted Answer

Modify the template to use a unique name for the IAM role.. The error indicates a naming conflict: the IAM role name in the template already exists in the account. By modifying the template to use a unique name (e.g., appending a random string or using `AWS::NoValue` with `Fn::Sub`), CloudFormation can create the role without conflicting with the existing resource. This approach avoids manual intervention and allows the stack creation to proceed automatically.

Answer

Use the 'Retain' deletion policy on the IAM role resource.

Answer

Manually delete the existing IAM role and retry the stack creation.

Answer

Use a stack policy to prevent the creation of the IAM role.

Question 10

A SysOps administrator needs to ensure that an EC2 instance automatically recovers from an underlying hardware failure. Which configuration should be used?

Accepted Answer

Create a CloudWatch alarm on the StatusCheckFailed metric and configure the recovery action.. A CloudWatch alarm on the StatusCheckFailed metric can be configured with an EC2 recovery action. When the alarm triggers (e.g., due to an underlying hardware failure), the recovery action automatically stops and starts the instance on healthy hardware, preserving the instance ID, private IP, Elastic IP, and EBS attachments. This is the native AWS mechanism for automatic instance recovery from hardware failures.

Answer

Use AWS Lambda to periodically check instance health and reboot if necessary.

Answer

Enable termination protection on the instance.

Answer

Place the instance in an Auto Scaling group with a minimum size of 1.