SOA-C02 Practice Test 3 — 30 Questions

Question 1

A company is designing a highly available web application on AWS. The application runs on EC2 instances behind an Application Load Balancer. Which configuration ensures that the application remains available if an entire AWS Availability Zone fails?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Launch EC2 instances in at least two different Availability Zones.. Deploying EC2 instances in at least two different Availability Zones (AZs) ensures that if one AZ fails, the Application Load Balancer (ALB) can route traffic to healthy instances in the remaining AZ(s). ALBs are regional constructs that automatically distribute traffic across registered targets in multiple AZs, and they perform health checks to detect and route away from failed AZs. This design meets the high availability requirement by eliminating the AZ as a single point of failure.

Answer

Deploy EC2 instances in multiple subnets of the same Availability Zone.

Answer

Use a larger EC2 instance type to handle the load.

Answer

Use EC2 instances in multiple AWS Regions.

Question 2

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all new S3 buckets created in any account have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes the x-amz-server-side-encryption header with a valid encryption algorithm.. Service Control Policies (SCPs) in AWS Organizations allow central governance to deny actions across all accounts. An SCP can deny the s3:CreateBucket action unless the request includes the server-side-encryption header, thus enforcing encryption on new buckets. Option B is incorrect because IAM roles per account lack centralized enforcement and cannot prevent users with their own permissions from creating buckets without encryption. Option C is incorrect because AWS Config rules are detective, not preventive; they can only detect and optionally remediate after the bucket is created, not block the creation. Option D is incorrect because using CloudTrail and CloudWatch Events with a Lambda function is a reactive approach—it can delete a non-compliant bucket after creation, but does not enforce encryption at the time of creation. The requirement is to enforce the policy, making a preventive SCP the correct solution.

Answer

Create an IAM role in each member account with a policy that denies s3:CreateBucket without encryption, and require all users to assume that role.

Answer

Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' to detect non-compliant buckets and automatically remediate.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers a Lambda function to delete any bucket created without encryption.

Question 3

A company uses AWS CloudFormation to deploy a three-tier web application. The template includes an Amazon RDS DB instance. The SysOps administrator needs to ensure that the database password is not exposed in the template or in the stack outputs. The password should be stored securely and rotated automatically every 90 days. Which solution should the administrator use?

Accepted Answer

Use AWS Secrets Manager to store the password and reference it using the dynamic reference {{resolve:secretsmanager:secretId:secretString:password}} in the CloudFormation template. Enable automatic rotation.. AWS Secrets Manager is designed to securely store secrets like database passwords, supports automatic rotation (including a 90-day schedule), and can be referenced in CloudFormation templates using the dynamic reference {{resolve:secretsmanager:secretId:secretString:password}}. This ensures the password is never exposed in the template or stack outputs, and rotation is handled automatically without manual intervention.

Answer

Store the password as a plaintext parameter in the CloudFormation template and mark it as NoEcho.

Answer

Use AWS Systems Manager Parameter Store to store the password as a SecureString and reference it using the dynamic reference {{resolve:ssm-secure:password}} in the template.

Answer

Hardcode the password in a userdata script that is passed to the EC2 instances.

Question 4

A SysOps administrator receives a notification that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group. What is the immediate impact on the application?

Accepted Answer

The Auto Scaling group will launch a new instance to replace the failed one, potentially causing temporary downtime.. When an EC2 instance fails a status check, the Auto Scaling group detects the failure and initiates a replacement by launching a new instance. However, the failed instance is not immediately terminated; it may remain in a stopped or impaired state until the replacement is fully in service, which can cause temporary downtime for the application if the instance was actively handling traffic.

Answer

The instance is still accessible and serving traffic.

Answer

The instance is immediately terminated.

Answer

The instance is automatically stopped and started.

Question 5

A company runs a web application on EC2 instances in an Auto Scaling group. The application is behind an Application Load Balancer. The company wants to ensure that the application can handle a sudden spike in traffic without downtime. What should the SysOps administrator do?

Accepted Answer

Configure a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy based on average CPU utilization allows the Auto Scaling group to automatically adjust capacity in response to real-time demand spikes. This dynamic scaling approach maintains a target metric (e.g., 50% CPU) by adding or removing instances, ensuring the application can handle sudden traffic bursts without downtime.

Answer

Use a scheduled scaling policy to add instances during business hours.

Answer

Reduce the number of Availability Zones to lower latency.

Answer

Manually increase the desired capacity of the Auto Scaling group when traffic increases.

Question 6

A SysOps Administrator is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. After the peering connection is accepted, instances in VPC-A cannot ping instances in VPC-B. Both VPCs have non-overlapping CIDR blocks. What is the MOST likely cause?

Accepted Answer

The route tables in both VPCs do not have routes to the peer VPC CIDR.. The most likely cause is that the route tables in both VPCs do not have routes to the peer VPC CIDR. Even after a VPC peering connection is accepted, traffic cannot flow between the VPCs unless explicit routes are added to each VPC's route table pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, instances in VPC-A have no path to reach instances in VPC-B, so ping fails.

Answer

VPC peering does not support cross-account connections.

Answer

The CIDR blocks overlap, causing routing conflicts.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Question 7

A company uses Amazon S3 to store critical data. The SysOps administrator needs to protect against accidental deletion of objects. Which combination of actions should the administrator take? (Choose the best answer.)

Accepted Answer

Enable S3 Versioning and MFA Delete on the bucket.. Enabling S3 Versioning preserves all versions of an object, allowing recovery from accidental deletion or overwrite. MFA Delete adds an additional authentication layer, requiring multi-factor authentication to permanently delete object versions or suspend versioning, thus preventing unauthorized or accidental deletions.

Answer

Apply a bucket policy that denies s3:DeleteObject for all principals.

Answer

Set a lifecycle policy to expire objects after 30 days.

Answer

Configure cross-Region replication to a different bucket.

Question 8

A company is using AWS Organizations with multiple accounts. The security team wants to prevent any IAM user from creating access keys for themselves across all accounts. What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that denies iam:CreateAccessKey to all accounts in the organization.. Service control policies (SCPs) are the most effective way to enforce a guardrail across all accounts in an AWS Organization because they allow you to centrally deny or restrict permissions at the root, OU, or account level, overriding any IAM policies attached to users or roles. By applying an SCP that denies iam:CreateAccessKey, the security team ensures that no IAM user in any account within the organization can create access keys, regardless of their individual IAM policies. This approach is scalable and cannot be bypassed by account administrators, making it the correct choice for organization-wide enforcement.

Answer

Attach an IAM policy to the root user that denies iam:CreateAccessKey.

Answer

Configure an IAM password policy that requires strong passwords.

Answer

Use AWS CloudTrail to monitor and alert on CreateAccessKey events.

Question 9

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The Auto Scaling group uses a dynamic scaling policy based on average CPU utilization. During a traffic spike, new instances are launched but take 5 minutes to become healthy. Users experience errors during this time. Which solution would reduce the time to serve traffic from new instances?

Accepted Answer

Use a launch template with a pre-provisioned AMI.. A pre-provisioned AMI eliminates the need for software installation and configuration at launch time, reducing the time for new EC2 instances to become healthy. By baking the application and dependencies into the AMI, instances can start serving traffic almost immediately after booting, rather than waiting for user data scripts or configuration management tools to complete.

Answer

Add a lifecycle hook to delay instance termination.

Answer

Increase the cooldown period for the scaling policy.

Answer

Use a larger instance type.

Question 10

A company runs a production web application on a single Amazon EC2 instance. The application experiences a predictable and steady workload 24/7. The SysOps administrator wants to minimize compute costs for this instance while ensuring it remains available during the expected workload. Which EC2 purchasing option should the administrator use?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the most cost-effective option for a predictable, steady-state workload running 24/7. By committing to a 1- or 3-year term, you receive a significant discount (up to 72%) compared to On-Demand pricing, while still ensuring the instance remains available for the expected workload. This matches the requirement to minimize compute costs without sacrificing availability.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 11

An organization has a requirement to automatically scale its web application based on a custom metric that measures the number of active user sessions stored in Amazon ElastiCache. The metric is published to CloudWatch every minute. The Auto Scaling group currently uses a simple scaling policy based on CPU utilization. What is the most effective way to implement scaling based on this custom metric?

Accepted Answer

Create a target tracking scaling policy that uses the custom metric as a target.. Target tracking scaling policies are purpose-built for metric-driven scaling: you specify a target value for a custom CloudWatch metric (e.g., active sessions per instance) and Auto Scaling automatically creates and manages the required CloudWatch alarms and scaling adjustments. This is the most effective approach because it continuously adjusts capacity to keep the metric at target, requires no manual alarm or step definition, and works with any metric published to CloudWatch, including custom ElastiCache session metrics.

Answer

Create a step scaling policy that adjusts capacity based on the magnitude of the metric breach.

Answer

Create a scheduled scaling policy that increases capacity during peak hours.

Answer

Create a simple scaling policy that adds instances when the custom metric exceeds a threshold and removes when below.

Question 12

A company is running a stateful web application on a single EC2 instance in a public subnet. The instance stores user sessions locally. The company wants to improve availability without rewriting the application. Which design should they use?

Accepted Answer

Deploy an Application Load Balancer across multiple AZs, move session storage to ElastiCache, and use an Auto Scaling group.. It addresses the core issue of stateful sessions without rewriting the application. By moving session storage to ElastiCache (a centralized, external data store), the application becomes stateless from the instance's perspective, allowing an Auto Scaling group across multiple Availability Zones (AZs) and an Application Load Balancer (ALB) to distribute traffic seamlessly. This design improves availability by enabling horizontal scaling and fault tolerance, as any instance can handle any request since sessions are stored externally.

Answer

Create a second EC2 instance in a different AZ and use Route 53 with health checks.

Answer

Use an Auto Scaling group across multiple AZs but keep sessions on instance.

Answer

Use an Application Load Balancer with sticky sessions and an Auto Scaling group in a single AZ.

Question 13

An organization wants to centrally manage access to multiple AWS accounts in an AWS Organizations setup. Which AWS service should the SysOps administrator use to define and enforce fine-grained permissions across accounts?

Accepted Answer

IAM roles with cross-account trust policies. IAM roles with cross-account trust policies allow a SysOps administrator to define fine-grained permissions centrally in a single AWS account (the management or security account) and then grant access to users or services in other accounts by assuming the role. This approach uses AWS Security Token Service (STS) to issue temporary credentials, enabling precise control over actions and resources across accounts without duplicating IAM users or policies.

Answer

AWS Config rules

Answer

Service control policies (SCPs)

Answer

AWS Single Sign-On (SSO)

Question 14

A SysOps administrator needs to monitor network traffic to and from an EC2 instance for troubleshooting. Which AWS feature captures IP traffic information at the VPC level?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces within a VPC, including source/destination IPs, ports, protocols, and packet accept/reject decisions. This feature operates at the VPC level and is specifically designed for network traffic monitoring and troubleshooting, making it the correct choice for capturing IP traffic information to and from an EC2 instance.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

A SysOps administrator needs to provide temporary, limited-privilege credentials to an application running on an EC2 instance. The application needs to access an S3 bucket. What is the most secure way to grant these credentials?

Accepted Answer

Attach an IAM role with the necessary permissions to the EC2 instance.. Attaching an IAM role to an EC2 instance is the most secure method because it leverages the AWS Security Token Service (STS) to automatically rotate temporary credentials. The instance retrieves these credentials via the instance metadata service (IMDS), eliminating the need to hardcode, store, or manually manage long-term access keys. This approach follows the principle of least privilege and ensures credentials are automatically rotated and revoked when the role is detached.

Answer

Use a Lambda function to generate temporary credentials from an IAM user.

Answer

Store the AWS access keys in an S3 bucket and have the application download them at startup.

Answer

Create an IAM user with programmatic access and store the access keys in the application's environment variables.

Question 16

A CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED. Which two actions are appropriate next steps? (Choose 2.)

Accepted Answer

Review stack events to identify the resource that blocked rollback.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED, the stack events provide detailed error messages for each resource that failed during rollback. Reviewing these events is essential to identify the specific resource that blocked the rollback, such as a resource that could not be deleted or updated due to permissions, dependencies, or configuration issues. This diagnosis is the first step before attempting a continue-update-rollback operation.

Answer

Delete the CloudFormation service role from IAM.

Answer

Rename the stack to force rollback completion.

Question 17

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 18

A company uses Amazon CloudFront to deliver its static website hosted on Amazon S3. The security team notices that users are able to access the S3 bucket directly via the S3 endpoint, bypassing CloudFront. What should be done to ensure that content is only accessible through CloudFront?

Accepted Answer

Create an origin access identity (OAI) and update the S3 bucket policy to grant access only to the OAI. An Origin Access Identity (OAI) is a special CloudFront user that can be associated with a CloudFront distribution. By updating the S3 bucket policy to grant read access only to that OAI's canonical user ID, the bucket becomes inaccessible via direct S3 endpoints, while CloudFront can still fetch and serve the content. This enforces that all traffic must go through CloudFront.

Answer

Use AWS WAF to block requests that do not include the CloudFront distribution's domain name

Answer

Create an AWS Lambda@Edge function to validate headers

Answer

Use S3 Block Public Access to prevent all public access

Question 19

A company is running a critical application on Amazon RDS for MySQL. The database is experiencing high read traffic, causing performance issues. The SysOps administrator needs to improve read performance while keeping costs low. Which solution should the administrator choose?

Accepted Answer

Add one or more Read Replicas in the same Region. Adding one or more Read Replicas in the same Region offloads read traffic from the primary RDS instance by directing SELECT queries to the replicas, which are asynchronous copies of the primary. This directly addresses high read traffic without incurring the cost of a larger instance or the complexity of caching, making it the most cost-effective solution for read scaling.

Answer

Enable Multi-AZ deployment

Answer

Increase the DB instance class to a larger size

Answer

Use Amazon ElastiCache to cache read results

Question 20

A SysOps administrator is troubleshooting an issue where an Amazon RDS DB instance's storage space is running out. The administrator has enabled CloudWatch alarms for FreeStorageSpace, but the alarm did not trigger before the storage was exhausted. What is the most likely reason?

Accepted Answer

The alarm's evaluation period was too long and the storage filled up faster than the alarm could trigger.. CloudWatch alarms evaluate metrics based on a specified evaluation period (e.g., 5 minutes). If the storage fills up faster than the alarm's evaluation period, the alarm may not have enough data points to trigger before the storage is exhausted. This is a common issue when the rate of storage consumption exceeds the alarm's evaluation frequency.

Answer

The FreeStorageSpace metric is not available for the selected DB instance class.

Answer

The alarm was configured to use a static threshold but the metric is not emitted during storage operations.

Answer

The alarm was monitoring the wrong metric, such as 'Storage' instead of 'FreeStorageSpace'.