SOA-C02 Practice Test 31 — 15 Questions

Question 1

An organization uses AWS CloudFormation to manage its infrastructure. The SysOps administrator is implementing a change management process that requires all stack updates to be reviewed and approved before execution. The administrator wants to use CloudFormation change sets to preview changes. Which THREE steps are necessary to implement this process? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the change set in the CloudFormation console.. To implement a review-and-approval process using CloudFormation change sets, the necessary steps are: create a change set from the updated template (E), review the change set in the CloudFormation console (C), and execute the change set after approval (D). Option A is incorrect because the 'Detect Drift' feature is used to check if the actual stack resources have drifted from the template, not to preview changes. Option B is incorrect because updating the stack directly bypasses the review process, which defeats the purpose of change management.

Answer

Use the 'Detect Drift' feature to compare the stack with the new template.

Answer

Update the stack directly using the updated template.

Question 2

An application running on EC2 instances sends custom metrics to CloudWatch using the PutMetricData API. The metrics are not appearing in the CloudWatch console. The IAM role attached to the instances has the following policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "cloudwatch:PutMetricData", "Resource": "*" } ] }. What is the most likely cause?

Accepted Answer

The metric data is being sent to a different AWS region.. The most likely cause is that the metric data is being sent to a different AWS region than the one displayed in the CloudWatch console. The PutMetricData API call includes a regional endpoint, and if the EC2 instance is configured to send metrics to a region other than the one you are viewing, the metrics will not appear. The IAM policy correctly allows the action, so authentication is not the issue.

Answer

The metric timestamp is older than 14 days.

Answer

The metric namespace must start with 'AWS/'.

Answer

The IAM policy does not allow the 'cloudwatch:PutMetricData' action.

Question 3

A SysOps administrator is troubleshooting an EC2 instance that is unresponsive. The administrator can SSH into the instance but finds that the CloudWatch agent is not sending custom metrics. The CloudWatch agent configuration file is at '/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json'. What should the administrator check first?

Accepted Answer

Verify that the IAM role attached to the EC2 instance has the CloudWatchAgentServerPolicy.. The correct first check is to verify the IAM role attached to the EC2 instance has the CloudWatchAgentServerPolicy. The CloudWatch agent uses the instance's IAM role to obtain credentials for publishing metrics to CloudWatch. Without this policy, the agent will fail to send custom metrics even if it is running correctly and the instance has network connectivity.

Answer

Ensure that the IAM user has permissions to access CloudWatch.

Answer

Check if the security group allows outbound traffic on port 443.

Answer

Run 'sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status' to check the agent status.

Question 4

A SysOps administrator needs to design a VPC with public and private subnets for a web application. Which TWO components are required to allow instances in the private subnet to access the internet?

Accepted Answer

NAT gateway in a public subnet. A NAT gateway in a public subnet is required because it allows instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The NAT gateway must be placed in a public subnet with an Internet Gateway (IGW) route to translate private IPs to the gateway's Elastic IP. Without the NAT gateway, private instances have no path to the internet.

Answer

VPC endpoint for S3

Answer

Internet gateway attached to the VPC

Answer

Virtual private gateway

Question 5

A SysOps administrator is troubleshooting an application that intermittently fails to connect to an RDS database. The error logs show 'Too many connections'. What CloudWatch metric should the administrator monitor to proactively detect this issue?

Accepted Answer

DatabaseConnections. The 'Too many connections' error indicates that the RDS database has reached its maximum allowed number of simultaneous client connections. The DatabaseConnections CloudWatch metric tracks the current number of connections to the DB instance, so monitoring this metric allows the administrator to set an alarm when connections approach the instance's max_connections limit, enabling proactive scaling or connection management before errors occur.

Answer

CPUUtilization

Answer

NetworkThroughput

Answer

FreeableMemory

Question 6

Refer to the exhibit. A SysOps administrator runs the describe-target-health command and sees that an EC2 instance in the target group is unhealthy with a timeout error. What is the most likely cause?

Accepted Answer

The instance's security group does not allow traffic from the ALB on the health check port. The health check is timing out, which indicates that the instance is not responding to health check requests on port 80. The security group must allow inbound traffic from the ALB on the health check port. Option A is wrong because the target group is configured with port 80, which matches. Option C is wrong because the route table is less likely to cause a timeout; it would cause unreachability. Option D is wrong because the instance is in a public subnet? Not necessarily; but the health check timeout is most often a security group issue.

Answer

The target group is configured with an incorrect port

Answer

The instance is in a private subnet without a NAT gateway

Answer

The instance does not have a route to the internet

Question 7

A company has a VPC with a public subnet and a private subnet. An Amazon EC2 instance in the private subnet needs to download security patches from the internet, but the instance must not be directly accessible from the internet. The SysOps administrator configured a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The instance's security group allows all outbound traffic. However, the instance still cannot reach the internet. What is the most likely missing configuration?

Accepted Answer

Add a route in the public subnet's route table that directs 0.0.0.0/0 traffic to an internet gateway. The NAT gateway is in the public subnet, but for it to route traffic to the internet, the public subnet must have a route table entry that directs 0.0.0.0/0 traffic to an internet gateway (IGW). Without this route, the NAT gateway cannot forward outbound traffic to the IGW, so the private instance's traffic is dropped. Option C correctly identifies this missing route.

Answer

Attach an Elastic IP to the NAT gateway

Answer

Enable DNS resolution in the VPC

Answer

Modify the network ACL of the private subnet to allow inbound ephemeral ports from the NAT gateway's private IP

Question 8

A company runs a critical application on Amazon EC2 instances. The application uses an NFS file system stored on an Amazon EFS file system. The SysOps administrator must ensure that the file system is highly available and can withstand an Availability Zone failure. The file system must be accessible from all Availability Zones in the region. Which configuration is required to meet these requirements?

Accepted Answer

Configure the EFS file system for Standard storage class and mount it using the regional DNS name.. The EFS Standard storage class replicates data across multiple Availability Zones (AZs) within a region, providing high availability and resilience against an AZ failure. Mounting the file system using the regional DNS name ensures that clients in any AZ can reach the file system via the nearest mount target, as the regional DNS name resolves to the mount target IP addresses in the local AZ. This configuration meets the requirement for the file system to be accessible from all AZs in the region while withstanding an AZ outage.

Answer

Configure the EFS file system for One Zone storage class and mount it using the file system ID.

Answer

Configure EFS to use provisioned throughput and mount it using a mount target IP address.

Answer

Enable EFS lifecycle management to move files to Infrequent Access storage class.

Question 9

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS DB instance and receive an alarm when CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the native AWS monitoring service that can track RDS DB instance metrics, such as CPU utilization, and trigger alarms based on thresholds and time periods. In this scenario, you would create a CloudWatch alarm on the `CPUUtilization` metric for the specific DB instance, with a threshold of 80% and a period of 5 consecutive minutes (e.g., 5 datapoints of 1-minute periods).

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 10

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to maintain user session state. Which configuration ensures session stickiness with minimal performance impact?

Accepted Answer

Enable sticky sessions on the Application Load Balancer using a load balancer-generated cookie.. Enabling sticky sessions on an Application Load Balancer (ALB) using a load balancer-generated cookie (AWSALB) binds a user's session to a specific target instance with minimal overhead. The ALB inserts the cookie in the response, and subsequent requests from the same client are routed to the same instance without requiring application-level session replication or external storage, thus preserving performance.

Answer

Use Amazon CloudFront with origin stickiness enabled.

Answer

Use a Network Load Balancer (NLB) with target group stickiness.

Answer

Store session state in Amazon DynamoDB and have each instance read from DynamoDB.

Question 11

A SysOps administrator needs to ensure that all traffic to an Application Load Balancer (ALB) uses encryption. How can this be enforced?

Accepted Answer

Create a listener that redirects HTTP requests (port 80) to HTTPS (port 443).. An Application Load Balancer can be configured with a listener rule that redirects incoming HTTP (port 80) requests to HTTPS (port 443). This ensures that all traffic to the ALB is encrypted in transit, as any unencrypted HTTP request is automatically redirected to the secure HTTPS protocol. The redirect action is a native ALB feature and does not require additional services or complex configurations.

Answer

Configure the security group to allow only HTTPS traffic (port 443).

Answer

Use AWS WAF to block HTTP requests.

Answer

Configure the ALB to use a custom SSL certificate.

Question 12

A company has an application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application logs show intermittent 503 errors. The ALB access logs show that the errors occur when the target response time exceeds 30 seconds. Which configuration change should the SysOps administrator make to reduce the number of 503 errors without affecting the application's behavior?

Accepted Answer

Increase the idle timeout setting on the ALB. The 503 errors occur when the target response time exceeds 30 seconds, which matches the default idle timeout of the Application Load Balancer. By increasing the idle timeout setting on the ALB to a value higher than the application's maximum expected response time (e.g., 60 or 120 seconds), the ALB will wait longer before closing the connection, preventing premature 503 errors while the backend is still processing the request.

Answer

Increase the deregistration delay on the target group

Answer

Enable cross-zone load balancing on the ALB

Answer

Decrease the health check interval on the target group

Question 13

A company uses Amazon CloudWatch to monitor its AWS resources. The operations team needs to receive email notifications when the root user performs any action in the AWS account. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs metric filter, and Amazon SNS.. AWS CloudTrail logs all API activity, including root user actions. By sending these logs to CloudWatch Logs, you can create a metric filter that matches root user events (e.g., `userIdentity.type = "Root"`). When the metric filter triggers a CloudWatch alarm, it publishes a notification to an SNS topic, which sends an email to subscribers. This combination ensures real-time notification of root user actions.

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS).

Answer

AWS Trusted Advisor and Amazon Simple Email Service (SES).

Answer

AWS Config, Amazon CloudWatch Events, and Amazon SNS.

Question 14

A team uses AWS CodeDeploy with a deployment configuration of CodeDeployDefault.OneAtATime to deploy a web application to an Auto Scaling group. Instances are behind an Application Load Balancer. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment.' What is the most likely cause?

Accepted Answer

The health check grace period on the Auto Scaling group is too short.. The deployment fails because the health check grace period on the Auto Scaling group is too short. When CodeDeploy deploys one instance at a time (CodeDeployDefault.OneAtATime), the instance is taken out of service, updated, and then returned to the load balancer. If the grace period expires before the instance passes its health checks, the Auto Scaling group marks it as unhealthy and terminates it, causing the deployment to fail with 'too many individual instances failed.'

Answer

The target group deregistration delay is too long.

Answer

The CodeDeploy agent is not installed on the instances.

Answer

The deployment group is configured to skip the ELB health check.

Question 15

A company runs an application on Amazon EC2 instances in private subnets of a VPC. The application needs to upload files to an Amazon S3 bucket in the same AWS Region. The SysOps administrator wants to ensure that traffic to S3 does not traverse the internet and minimizes data transfer costs. Which solution should the administrator implement?

Accepted Answer

Create an S3 Gateway Endpoint and add a route in the private subnet route table pointing to it.. An S3 Gateway Endpoint is the correct solution because it provides private connectivity from a VPC to S3 without traversing the internet, using AWS's internal network. By adding a route in the private subnet's route table pointing to the gateway endpoint, traffic to S3 stays within the AWS backbone, minimizing data transfer costs (no NAT gateway charges) and avoiding internet egress fees.

Answer

Create a NAT gateway in a public subnet and route private subnet traffic to it.

Answer

Create an S3 Interface Endpoint and assign a security group.

Answer

Use AWS PrivateLink to connect to S3.