SOA-C02 Practice Test 2 — 30 Questions

Question 1

A SysOps administrator needs to automatically deploy a new version of an application to a fleet of Amazon EC2 instances every time changes are pushed to the main branch of a code repository hosted on AWS CodeCommit. Which combination of AWS services should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CodePipeline, AWS CodeBuild, and AWS CodeDeploy.. AWS CodePipeline orchestrates the continuous delivery workflow by detecting changes in the CodeCommit repository, then automatically triggering AWS CodeBuild to compile and package the application, and finally deploying the new version to EC2 instances using AWS CodeDeploy. This combination provides a fully managed, end-to-end CI/CD pipeline that meets the requirement of deploying on every push to the main branch.

Answer

AWS CloudFormation and AWS CodeDeploy.

Answer

Amazon EventBridge and AWS Systems Manager.

Answer

AWS CloudTrail and AWS Lambda.

Question 2

A company requires that all Amazon EC2 instances launched in its AWS account must have termination protection enabled. The SysOps administrator needs to automatically remediate any instance launched without termination protection. The solution should use AWS managed services without custom scripts. Which AWS service should be used?

Accepted Answer

Configure AWS Config with a managed rule 'ec2-termination-protection-check' and set an auto-remediation action using an AWS Systems Manager Automation document that enables termination protection on the instance.. AWS Config's managed rule 'ec2-termination-protection-check' can detect instances without termination protection, and you can attach an auto-remediation action using an AWS Systems Manager Automation document (e.g., AWS-EnableTerminationProtection) to automatically enable termination protection on noncompliant instances. This solution uses only AWS managed services and requires no custom scripts, meeting the company's requirements.

Answer

Use Amazon EC2 Auto Scaling to automatically apply termination protection to all launched instances.

Answer

Enable AWS Trusted Advisor to send notifications when instances lack termination protection, and have administrators manually fix them.

Answer

Create an IAM policy that denies the RunInstances action unless termination protection is enabled.

Question 3

A company wants to enforce that all IAM users in an AWS account must use multi-factor authentication (MFA) to access the AWS Management Console. Which IAM policy effect should be used to deny access if MFA is not present?

Accepted Answer

Deny with a condition that aws:MultiFactorAuthPresent is false. The IAM policy must explicitly deny access when MFA is not present. By using a Deny effect with the condition aws:MultiFactorAuthPresent set to false, any request that does not include MFA authentication is blocked. This is the standard approach to enforce MFA usage, as IAM policies default to an implicit deny, but an explicit Deny overrides any Allow that might otherwise grant access.

Answer

Allow with a condition that aws:MultiFactorAuthPresent is false

Answer

Allow with a condition that aws:MultiFactorAuthPresent is true

Answer

Deny with a condition that aws:MultiFactorAuthPresent is true

Question 4

A company uses Amazon CloudFront to deliver content to a global audience. The origin is an Application Load Balancer in us-east-1. The SysOps administrator wants to reduce costs by minimizing the number of requests that reach the origin server. Which action should the administrator take?

Accepted Answer

Enable CloudFront Origin Shield.. CloudFront Origin Shield acts as an additional caching layer in front of the origin, reducing the load on the origin by consolidating requests from multiple edge locations. This minimizes the number of requests that reach the Application Load Balancer, directly lowering origin request costs and improving cache hit ratio.

Answer

Configure multiple origins for failover.

Answer

Enable CloudFront Web Application Firewall (WAF) integration.

Answer

Increase the cache TTL for CloudFront distributions.

Question 5

A company runs a critical application on a fleet of EC2 instances that process real-time financial transactions. The application requires consistent low latency. The SysOps administrator notices that the application's latency increases periodically due to noisy neighbors. The administrator wants to optimize performance predictability. Which instance type should the administrator choose?

Accepted Answer

Dedicated Instances. Dedicated Instances run on hardware dedicated to a single customer, eliminating the noisy-neighbor problem because no other AWS accounts share the underlying physical host. This provides the performance predictability required for consistent low-latency financial transaction processing.

Answer

Burstable Performance Instances (T3)

Answer

Spot Instances

Answer

Reserved Instances

Question 6

A company runs a batch processing application on Amazon EC2 instances. The application runs for 3 hours every night and can tolerate interruptions. The SysOps administrator needs to minimize compute costs. Which purchasing option should the administrator use?

Accepted Answer

Spot Instances. Spot Instances are ideal for this workload because the application is fault-tolerant (can tolerate interruptions) and runs on a fixed schedule (3 hours nightly). Spot Instances offer significant cost savings (up to 90% compared to On-Demand) by using spare EC2 capacity, and the batch processing can be designed to resume from checkpoints if interrupted.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Instances

Question 7

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an alert if it exceeds 80% for 10 consecutive minutes. The instance is in a VPC with no Internet access. What is the MOST efficient way to meet these requirements?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and an evaluation period of 2.. A CloudWatch alarm with a period of 5 minutes and an evaluation period of 2 means the alarm evaluates two consecutive 5-minute data points, totaling 10 minutes. Since the EC2 instance is in a VPC with no Internet access, CloudWatch metrics are still reported via the CloudWatch service endpoint within the VPC (or via VPC endpoints), so no additional agent or script is needed. This is the most efficient approach as it uses native CloudWatch functionality without requiring any custom scripts or additional software.

Answer

Use AWS Systems Manager to run a script on the instance that checks CPU and sends an SNS notification.

Answer

Enable detailed monitoring on the EC2 instance and create a CloudWatch alarm on the CPUUtilization metric.

Answer

Install the CloudWatch agent on the EC2 instance to collect CPU metrics and create a CloudWatch alarm.

Question 8

A company needs a dedicated private network connection from its on-premises data center to AWS that provides consistent network performance and high bandwidth. The connection must bypass the public internet. Which AWS service should the SysOps administrator use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet entirely. This ensures consistent network performance, low latency, and high bandwidth, which are critical for workloads requiring predictable throughput and a private link.

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Question 9

A company's security policy requires that all new Amazon S3 buckets must have server-side encryption with AWS Key Management Service (SSE-KMS) enabled by default. A SysOps administrator wants to enforce this requirement for all current and future S3 buckets in the account. Which AWS service or feature should be used to automatically apply this configuration?

Accepted Answer

Use AWS Config with the 's3-bucket-server-side-encryption-enabled' managed rule and configure automatic remediation to apply SSE-KMS when a non-compliant bucket is detected.. AWS Config with the 's3-bucket-server-side-encryption-enabled' managed rule can evaluate S3 buckets for compliance with server-side encryption requirements. When a non-compliant bucket is detected, automatic remediation can be configured to apply SSE-KMS using an AWS Systems Manager Automation document, ensuring all current and future buckets meet the security policy without manual intervention.

Answer

Enable S3 default encryption at the account level in the S3 console.

Answer

Create an AWS CloudTrail trail that captures S3 API calls and triggers a Lambda function to enable encryption on any bucket that is created without it.

Answer

Use an AWS Organizations Service Control Policy (SCP) to deny the s3:PutBucketPublicAccessBlock action, forcing users to enable encryption.

Question 10

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The data center has multiple VLANs that need to connect to separate VPCs in AWS. The company wants to maintain isolation between the VPCs while maximizing bandwidth utilization. Which solution should the SysOps administrator recommend?

Accepted Answer

Configure a single Direct Connect connection with multiple private virtual interfaces, each tagged with a different VLAN ID and associated with a different VPC.. A single Direct Connect connection can support multiple private virtual interfaces (VIFs), each tagged with a unique 802.1Q VLAN ID. This allows the on-premises data center to connect to separate VPCs while maintaining traffic isolation via VLAN tagging, and it maximizes bandwidth utilization by sharing the single connection's capacity across all VIFs.

Answer

Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway, then configure route tables to isolate traffic.

Answer

Provision multiple Direct Connect connections, one for each VPC, and use a different VLAN on each connection.

Answer

Establish a single Direct Connect connection and use IPsec VPN tunnels over it to connect to each VPC.

Question 11

A company runs a web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across three Availability Zones. To improve reliability, the company wants to ensure that if an entire Availability Zone fails, the application remains available. Which configuration should be implemented?

Accepted Answer

Configure the Auto Scaling group to launch instances in three Availability Zones.. Configuring the Auto Scaling group to launch instances across three Availability Zones ensures that if one AZ fails, the remaining AZs continue to serve traffic. The Application Load Balancer automatically distributes incoming requests to healthy instances in the surviving AZs, maintaining application availability without manual intervention.

Answer

Remove the load balancer and use Route 53 weighted routing to distribute traffic.

Answer

Launch all instances in a single Availability Zone to reduce latency.

Answer

Use a Network Load Balancer instead of an Application Load Balancer.

Question 12

A SysOps administrator is responsible for an AWS account that hosts a development environment. The environment includes several EC2 instances that are used only during business hours (9 AM to 5 PM) on weekdays. The administrator wants to reduce costs by stopping the instances during off-hours. Which action should the administrator take to automate this process?

Accepted Answer

Use the AWS Instance Scheduler to define a schedule that stops instances at 5 PM and starts them at 9 AM on weekdays.. AWS Instance Scheduler is a solution that automates the starting and stopping of EC2 instances based on a schedule. It uses Lambda functions and DynamoDB to manage schedules, and it can be configured to stop instances at 5 PM and start them at 9 AM on weekdays, reducing costs during off-hours.

Answer

Manually stop the instances at 5 PM and start them at 9 AM each weekday.

Answer

Create an Auto Scaling group with a scheduled scaling action to set desired capacity to 0 during off-hours.

Answer

Set up a CloudWatch alarm that stops instances when CPU utilization is below 1% for 30 minutes.

Question 13

A SysOps administrator is designing a disaster recovery plan for a critical application that runs on EC2 instances in a single region. The RTO is 1 hour, and the RPO is 15 minutes. The application data is stored on an Amazon EBS volume. Which approach meets these requirements at the lowest cost?

Accepted Answer

Take automated EBS snapshots every 15 minutes and copy them to the DR region. Use a pre-configured Amazon Machine Image (AMI) to launch EC2 instances from the latest snapshot.. Automated EBS snapshots taken every 15 minutes meet the RPO of 15 minutes, and copying them to the DR region allows launching EC2 instances from the latest snapshot using a pre-configured AMI, which can achieve an RTO of 1 hour. This approach is the lowest cost as it only incurs snapshot storage and cross-region data transfer costs, without requiring continuous replication infrastructure or additional compute resources.

Answer

Deploy the application across multiple Availability Zones using an Auto Scaling group and an Application Load Balancer.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to an EC2 instance in the DR region.

Answer

Use S3 Cross-Region Replication to replicate the EBS volume data to an S3 bucket in the DR region.

Question 14

A company needs to continuously scan Amazon EC2 instances for software vulnerabilities and unintended network exposure. Which AWS service should be used?

Accepted Answer

Amazon Inspector. Amazon Inspector is the correct service because it is specifically designed to automatically scan Amazon EC2 instances for software vulnerabilities (CVEs) and unintended network exposure (network reachability). It uses a combination of a managed agent (for OS-level assessment) and network configuration analysis to produce a detailed findings report, directly meeting the requirement for continuous scanning.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 15

A company runs a web application on Amazon EC2 instances. The application's traffic pattern is unpredictable, often spiking to 3x normal load for short periods. The SysOps administrator needs to ensure that the application can handle spikes without performance degradation while minimizing costs. Which combination of purchasing options and scaling strategies should the administrator use?

Accepted Answer

Use a mix of Reserved Instances for baseline and On-Demand for spikes, with a target tracking scaling policy.. It combines Reserved Instances for the predictable baseline load, which reduces costs through a significant discount, with On-Demand Instances to handle unpredictable spikes. The target tracking scaling policy automatically adjusts capacity based on a target metric (e.g., average CPU utilization), ensuring performance is maintained during spikes without manual intervention or over-provisioning.

Answer

Use all Spot Instances with a simple scaling policy.

Answer

Use all On-Demand Instances with a scheduled scaling policy.

Answer

Use only Reserved Instances with a manual scaling policy.

Question 16

A company has a production AWS account with multiple IAM users. The security team wants to implement a policy that prevents users from launching EC2 instances without an IAM role that grants access to an S3 bucket containing sensitive data. The policy should also allow users to launch instances with other roles. A SysOps administrator creates an IAM policy that denies ec2:RunInstances if the instance does not have a specific IAM instance profile. However, users are still able to launch instances without any role. What is the most likely reason, and what should be done to fix it?

Accepted Answer

The condition key is incorrect; the policy should use 'ec2:InstanceProfile' condition key with a specific ARN.. The correct condition key for checking an instance's IAM role at launch is 'ec2:InstanceProfile', not 'ec2:InstanceProfileArn'. The 'ec2:InstanceProfile' condition key evaluates the ARN of the instance profile associated with the instance. Using 'ec2:InstanceProfileArn' is not a valid condition key for EC2, so the policy never matches, and the deny effect never applies, allowing users to launch instances without any role.

Answer

The condition key 'ec2:InstanceProfileArn' is misspelled; it should be 'ec2:IamInstanceProfile'.

Answer

The policy should be attached to the user's group instead of the user.

Answer

The policy needs to be applied as a service control policy (SCP) to be effective.

Question 17

An application writes error logs to Amazon CloudWatch Logs. The SysOps administrator needs to monitor for the occurrence of the string 'ERROR' in the logs and trigger an Amazon SNS notification if more than 10 errors occur within a 5-minute window. The administrator also wants to visualize the error count over time. Which approach should be used to meet these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch Logs metric filter to count 'ERROR' entries, then create a CloudWatch alarm on that metric with a period of 5 minutes and a threshold of 10.. CloudWatch Logs metric filters can extract a count of 'ERROR' occurrences from incoming log events and emit a custom metric. A CloudWatch alarm on that metric with a period of 5 minutes and a threshold of 10 directly triggers an SNS notification when the error count exceeds 10 within the window, and the metric itself can be graphed in CloudWatch dashboards for visualization—all with minimal configuration and no custom code.

Answer

Use CloudWatch Logs Insights to run a query every 5 minutes and send notifications via a scheduled AWS Lambda function.

Answer

Create an AWS Lambda function that processes log events in real-time and publishes to Amazon SNS when the error count exceeds 10 in 5 minutes.

Answer

Use Amazon EventBridge to match log events with the pattern 'ERROR' and send them to an SNS topic.

Question 18

A company has an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The company wants to enable path-based routing to send requests to different target groups. Which TWO resources must be created to achieve this?

Accepted Answer

Target group for each backend service. (Target group for each backend service) and Option D (Listener rule with a path pattern condition) are correct. Path-based routing requires creating target groups for each backend service and a listener rule with a path pattern condition to direct requests to the appropriate target group. Option A is incorrect because subnets are needed for the ALB, but they are not specifically required for path-based routing. Option C is incorrect because a Network Load Balancer is not used; the ALB itself handles path-based routing. Option E is incorrect because a security group controls traffic but does not enable path-based routing.

Answer

Subnet for the ALB

Answer

Network Load Balancer (NLB)

Answer

Security group for the ALB

Question 19

A company is using Amazon S3 to store media files. The files are accessed frequently for the first 90 days, then rarely after that. The company wants to optimize storage costs. Which TWO actions should the SysOps administrator take? (Choose two.)

Accepted Answer

Configure a lifecycle policy to delete incomplete multipart uploads after 7 days. Configuring a lifecycle policy to delete incomplete multipart uploads after 7 days prevents orphaned parts from incurring storage costs. Option C is correct because creating a lifecycle policy to transition objects to S3 Standard-IA after 90 days reduces storage costs for infrequently accessed data. Option B is incorrect because S3 Object Lock is used for compliance and retention, not cost optimization. Option D is incorrect because enabling S3 Versioning can increase storage costs by retaining multiple versions of objects. Option E is incorrect because enabling Requester Pays shifts the cost of requests and data transfer to the requester, but does not optimize storage costs for the company.

Answer

Enable S3 Object Lock to prevent deletion

Answer

Enable S3 Versioning to keep multiple versions

Answer

Enable Requester Pays on the bucket

Question 20

A SysOps administrator needs to implement a backup strategy for an Amazon RDS for PostgreSQL database. The database is 500 GB and experiences heavy write traffic. Which solution provides the most cost-effective backup with the least impact on database performance?

Accepted Answer

Enable automated backups with a retention period of 7 days.. Automated backups are enabled by default with minimal performance impact and include transaction logs for point-in-time recovery. Option B is wrong; while using a standby for backups in Multi-AZ can reduce impact, automated backups already have minimal impact and are more cost-effective. Option C is wrong because AWS DMS replication to S3 is not a backup solution and adds complexity and cost. Option D is wrong because manual snapshots cause a brief I/O suspension and are less automated than automated backups.

Answer

Create a Multi-AZ deployment and use the standby for backups.

Answer

Use AWS Database Migration Service to continuously replicate data to an S3 bucket.

Answer

Take manual DB snapshots daily during off-peak hours.