SOA-C02 Practice Test 2 — 30 Questions

Question 1

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 2

A company runs a production web application on a single Amazon EC2 instance. The application experiences a predictable and steady workload 24/7. The SysOps administrator wants to minimize compute costs for this instance while ensuring it remains available during the expected workload. Which EC2 purchasing option should the administrator use?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the most cost-effective option for a predictable, steady-state workload running 24/7. By committing to a 1- or 3-year term, you receive a significant discount (up to 72%) compared to On-Demand pricing, while still ensuring the instance remains available for the expected workload. This matches the requirement to minimize compute costs without sacrificing availability.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 3

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 4

A company wants to receive alerts when its AWS costs exceed a certain threshold. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets and receive alerts when actual or forecasted costs exceed a defined threshold. It directly supports cost-based alerting with actions such as sending an SNS notification or applying an IAM policy to restrict resources when the budget limit is breached.

Answer

Amazon CloudWatch

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 5

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

Accepted Answer

Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.. A KMS key policy can use the 'aws:SourceVpc' condition key to restrict usage of the key to requests originating from a specific VPC. Option A is incorrect because S3 bucket policies cannot directly restrict KMS key usage; they can only control access to S3 objects. Option C is incorrect because IAM policies can include conditions based on source VPC for certain services, but for KMS actions, the condition must be in the key policy itself, not an IAM policy. Option D is incorrect because network ACLs operate at the subnet level and control network traffic, not API calls to KMS; they cannot restrict access to the KMS service.

Answer

Add a condition in the S3 bucket policy to allow only requests from the VPC.

Answer

Use an IAM policy with a condition that requires the request to come from the VPC.

Answer

Configure a network ACL that blocks all traffic to KMS except from the VPC.

Question 6

A company is using Amazon S3 to store historical data. The data is accessed frequently for the first 30 days, then accessed infrequently for the next 90 days, and after 120 days it is rarely accessed but must be retained for 7 years for compliance. Which S3 lifecycle policy provides the LOWEST cost while meeting these requirements?

Accepted Answer

Standard for 30 days, then transition to Standard-IA for 90 days, then to Glacier Deep Archive.. It aligns the storage class transitions precisely with the access patterns: Standard for frequent access (first 30 days), Standard-IA for infrequent access (next 90 days), and Glacier Deep Archive for long-term retention (after 120 days). This minimizes cost by avoiding paying for premium storage when data is rarely accessed, while still meeting the 7-year compliance requirement at the lowest possible storage cost.

Answer

Standard for 30 days, then transition to One Zone-IA for 90 days, then to Glacier Deep Archive.

Answer

Standard for 120 days, then transition to Glacier Deep Archive.

Answer

Standard for 30 days, then transition to Glacier for the remaining life.

Question 7

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

Accepted Answer

AWS Config with a custom rule and AWS Lambda. AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Answer

AWS CloudTrail and Amazon CloudWatch Events

Answer

AWS Service Catalog and AWS Organizations

Answer

Amazon Inspector and AWS Systems Manager

Question 8

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

Accepted Answer

Perform a rolling update based on health.. A rolling update based on health (Option D) is the correct method to minimize downtime when updating an instance type in Elastic Beanstalk. This approach updates instances in batches, replacing them with the new instance type only after the previous batch passes health checks, ensuring application availability throughout the process. Elastic Beanstalk's rolling update with health-based batching terminates and launches instances incrementally, avoiding full environment disruption.

Answer

Terminate all instances and let the Auto Scaling group launch new ones.

Answer

Perform an immutable update.

Answer

Clone the environment with the new configuration and swap URLs.

Question 9

A SysOps administrator is investigating a cost increase in a production AWS account. They notice that an EC2 instance with a Reservation has been running continuously for months. The instance type is m5.large in us-east-1. The administrator sees that the instance is using a Standard Reserved Instance (RI) that was purchased 6 months ago for a 1-year term. However, the current utilization shows that the instance is only used for 4 hours per day. What should the administrator do to optimize costs without affecting availability?

Accepted Answer

Modify the existing RI to a smaller instance size (e.g., m5.large to m5.xlarge? no, smaller: e.g., t3.medium) and use Auto Scaling with a schedule to start/stop the instance during business hours.. By modifying the existing Standard RI to a smaller instance size (e.g., within the same family or by converting to a Convertible RI to allow family changes), the administrator can better match the actual low utilization pattern. Additionally, using Auto Scaling with a scheduled scaling policy to start and stop the instance during business hours ensures availability during needed times and reduces waste. Option A is incorrect because stopping the instance does not stop the RI charges; Reserved Instance benefits are applied only to running instances, so the RI would be wasted during off-hours. Option B is incorrect because selling the RI on the Reserved Instance Marketplace typically incurs a loss of the upfront payment and does not directly address the over-provisioning issue. Option D is incorrect because converting to a larger instance family would increase compute capacity per hour, leading to higher costs and even more waste given the low utilization.

Answer

Stop the instance during off-hours using Instance Scheduler, but keep the RI as-is.

Answer

Sell the current RI on the Reserved Instance Marketplace and purchase a new Convertible RI for a smaller instance type.

Answer

Convert the RI to a Convertible RI and exchange it for a larger instance family to get more compute per hour.

Question 10

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. The first thing to check when private instances cannot reach an external service is the route table for the private subnet. The private subnet must have a route 0.0.0.0/0 pointing to the NAT Gateway to route internet-bound traffic through it. Option B is incorrect because the NAT Gateway must have an Elastic IP to be reachable from the internet, but the issue described is outbound access from private instances; the NAT Gateway's Elastic IP is necessary but not the first check. Option C is incorrect because security groups for NAT Gateways are not used; NAT Gateways do not have security groups; instead, network ACLs on the subnets control traffic. Option D is incorrect because the internet gateway must be attached to the VPC for the NAT Gateway to work, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.

Question 11

A SysOps team manages a fleet of EC2 instances used for batch processing. The workload runs daily, taking approximately 6 hours. The instances are launched via an Auto Scaling group using On-Demand instances from a custom AMI. The team has noticed that while the instances are running, the CPU utilization is moderate, but the memory usage is high. After the batch completes, the instances are terminated. The team wants to reduce costs without changing the architecture. Which solution would be MOST cost-effective?

Accepted Answer

Modify the Auto Scaling group to use a mixed instances policy with a percentage of Spot Instances and a fallback to On-Demand.. Spot Instances can provide significant discounts (up to 90%) for fault-tolerant batch workloads, and the team can use a mixed instances policy with On-Demand as a fallback. Option B (memory optimized instances) would likely increase cost. Option C (reserved instances) is not suitable for short-lived, sporadic workloads. Option D (savings plan) could help but still requires committing to a consistent amount, which may not align with the varying batch size. Option A offers the most flexibility and cost savings.

Answer

Use a Compute Savings Plan covering the entire compute usage across the account.

Answer

Change the instance type to a memory-optimized family to reduce the number of instances needed.

Answer

Purchase Reserved Instances for the expected daily usage to get a lower hourly rate.

Question 12

A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?

Accepted Answer

Private subnet route table with a route to the NAT Gateway. The correct answers are D and E. A NAT Gateway placed in a public subnet (E) provides outbound internet access for instances in private subnets. The private subnet's route table must have a route pointing to the NAT Gateway (D) for internet-bound traffic. VPC Peering (A) connects VPCs but does not provide internet access. An Internet Gateway (C) attached to the VPC enables internet access for public subnets, but private subnets should not have a direct route to it. Option B (private route to IGW) would make the subnet public, violating the requirement. Therefore, D and E together provide the desired outbound-only internet access.

Answer

VPC Peering connection

Answer

Private subnet route table with a route to the Internet Gateway

Answer

Internet Gateway attached to the VPC

Question 13

A SysOps administrator notices that an S3 bucket's storage costs have increased significantly. The bucket stores log files and is configured with S3 Standard storage class. Most logs are accessed only once after 30 days. Which action will reduce costs without affecting data retrieval?

Accepted Answer

Create a lifecycle policy to transition objects to S3 Glacier Instant Retrieval after 30 days.. Transitioning to S3 Glacier Instant Retrieval after 30 days reduces storage cost while maintaining millisecond access. Option A is wrong because S3 Standard-IA has retrieval fees that might increase cost for single access. Option B is wrong because S3 Glacier Deep Archive has long retrieval times (hours), making it unsuitable for logs that may need to be accessed occasionally. Option D is wrong because S3 One Zone-IA is less durable (does not replicate across AZs) and may not be appropriate for log data.

Answer

Create a lifecycle policy to transition objects to S3 Standard-IA after 30 days.

Answer

Create a lifecycle policy to transition objects to S3 Glacier Deep Archive after 30 days.

Answer

Create a lifecycle policy to transition objects to S3 One Zone-IA after 30 days.

Question 14

A SysOps administrator is investigating a security breach. An IAM user 'Bob' is suspected of performing unauthorized actions. The administrator needs to determine the source IP addresses from which Bob's access keys were used in the last 30 days. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail event history.. AWS CloudTrail event history provides a record of all API calls made by IAM users, including the source IP address from which the request originated. By filtering the event history for the IAM user 'Bob' and the time range of the last 30 days, the administrator can identify the source IP addresses associated with each API call made using Bob's access keys. This directly meets the requirement to determine the source IP addresses of unauthorized actions.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Answer

AWS IAM credential report.

Question 15

A company wants to ensure that its Amazon RDS database can withstand the loss of an entire Availability Zone. Which feature should the SysOps administrator enable?

Accepted Answer

Enable Multi-AZ deployment.. Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, ensuring database availability without manual intervention. This is the only option that directly protects against an entire AZ loss by maintaining a hot standby in a separate AZ.

Answer

Enable automated backups with a retention period of 35 days.

Answer

Take manual snapshots and copy them to another Region.

Answer

Create a read replica in a different Availability Zone.

Question 16

A SysOps administrator needs to deploy an application to a set of EC2 instances in an Auto Scaling group. The deployment must be performed in batches, with each batch health-checked before proceeding. Which AWS CodeDeploy deployment configuration should be used?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime is the correct deployment configuration because it deploys the application revision to one EC2 instance at a time, waiting for the instance to pass health checks before proceeding to the next. This ensures that the deployment is performed in batches of one, with each batch health-checked before moving on, which aligns with the requirement for batch-based, health-checked deployments.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.Custom

Question 17

A company runs 200 EC2 Linux instances across three accounts. The security team requires that critical OS patches are applied automatically every Sunday at 2 AM UTC. Currently patches are applied manually and inconsistently. What is the recommended AWS-native solution?

Accepted Answer

Configure a Patch Manager patch baseline and maintenance window scheduled for Sunday 02:00 UTC; associate the Run Patch Baseline task with all EC2 instance targets. AWS Systems Manager Patch Manager, combined with a Maintenance Window, provides a fully AWS-native, automated solution for patching EC2 instances on a schedule. The Patch Manager service uses a patch baseline to define which patches are approved (e.g., critical OS patches), and the Maintenance Window triggers the 'AWS-RunPatchBaseline' SSM document at the specified time (Sunday 02:00 UTC) against all targeted instances. This eliminates manual effort and ensures consistent, auditable patching across multiple accounts and instances.

Answer

Create a cron job on each instance that runs 'yum update -y' every Sunday at 2 AM

Answer

Use AWS Config managed rules to detect unpatched instances and send SNS notifications for manual remediation

Answer

Build a CodePipeline that runs weekly, creates new AMIs with the latest patches, and replaces all instances via an Auto Scaling instance refresh

Question 18

A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?

Accepted Answer

Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.. Placing a Network Load Balancer (NLB) in front of the ALB allows Global Accelerator to terminate the TCP connection at the edge, then forward traffic to the NLB. The NLB preserves the original client IP address by default (since it operates at Layer 4 and does not terminate the connection), and the ALB can still read the client IP from the X-Forwarded-For header. This setup meets both the performance requirement (via Global Accelerator's edge routing) and the logging requirement (preserving the original client IP).

Answer

Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.

Answer

Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.

Answer

Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.

Question 19

An EC2 instance runs a database on a 2 TB EBS gp3 volume. After a corruption event, the team must restore from a snapshot. When they detach the corrupted volume, attach a new volume restored from the snapshot, and start the database, performance is 10 to 20 times lower than normal for the first two hours. What causes this behavior, and what feature eliminates it?

Accepted Answer

Enable Fast Snapshot Restore (FSR) on the snapshot in the target Availability Zone before creating the replacement volume. When you create an EBS volume from a snapshot, the volume's data blocks are lazily loaded from Amazon S3 on first access. This causes high latency and low IOPS until all blocks are fetched. Fast Snapshot Restore (FSR) pre-initializes the volume in a specific Availability Zone, eliminating the need for lazy loading and providing full performance immediately.

Answer

Use a Provisioned IOPS (io2) volume type instead of gp3 to get higher IOPS during initialization

Answer

Run a full dd or fio pre-warm pass over the volume after attaching it but before starting the database

Answer

Increase the EBS volume size to 4 TB when restoring from the snapshot to get double the throughput baseline

Question 20

A company's security team notices that an IAM user has been making unauthorized API calls from an IP address outside the company's VPN. The team wants to immediately block all API calls from that specific IP address for all users. Which action should be taken?

Accepted Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.. A service control policy (SCP) attached to the root organizational unit (OU) applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and roles across those accounts. Option A is incorrect because attaching an IAM policy to all users only affects the current account and is not scalable for organization-wide enforcement. Option B is incorrect because IAM policies cannot be attached to an organization root; only SCPs can be applied at that level. Option D is incorrect because SCPs cannot be attached directly to IAM users; they apply to OUs or accounts.

Answer

Create a new IAM policy that denies access from the IP address and attach it to all users.

Answer

Create an IAM policy that denies access from the IP address and attach it to the organization root.

Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the IAM user.