SOA-C02 Practice Test 32 — 15 Questions

Question 1

A company runs a critical application on a single Amazon EC2 instance. The SysOps administrator needs to ensure that if the instance fails, a new instance is automatically provisioned in a different Availability Zone. Which configuration should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Auto Scaling group with the instance in multiple Availability Zones. An Auto Scaling group (ASG) can be configured with a minimum, desired, and maximum size of 1, spanning multiple Availability Zones (AZs). When the EC2 instance fails, the ASG health check replacement mechanism automatically terminates the unhealthy instance and launches a new one in a different AZ, ensuring the application remains available across AZ boundaries without manual intervention.

Answer

Create a placement group and launch the instance in it

Answer

Place the instance behind an Elastic Load Balancer

Answer

Configure an Amazon Route 53 health check with failover routing

Question 2

A SysOps administrator is troubleshooting an issue where an EC2 instance's CloudWatch agent is not sending memory metrics. The agent is installed and configured to collect memory metrics. The IAM role attached to the instance has the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "cloudwatch:PutMetricData",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "cloudwatch:ListMetrics",
      "Resource": "*"
    }
  ]
}

What is the most likely reason the memory metrics are not appearing?

Accepted Answer

The IAM role is missing the ssm:GetParameter permission.. The IAM policy includes cloudwatch:PutMetricData and cloudwatch:ListMetrics, but if the CloudWatch agent retrieves its memory metrics configuration from Systems Manager Parameter Store (a common setup), the instance requires the ssm:GetParameter permission. Without this permission, the agent cannot fetch the configuration, and memory metrics will not be sent. Therefore, option C correctly identifies the missing IAM permission.

Answer

The CloudWatch agent requires the SSM Agent to be installed.

Answer

The CloudWatch agent must be configured to send metrics to CloudWatch Logs first.

Answer

Detailed monitoring must be enabled on the EC2 instance.

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. Users report slow load times. The SysOps team notices that all traffic goes to a single availability zone. Which action should be taken to improve performance and reliability?

Accepted Answer

Configure the ALB to use subnets in at least two Availability Zones. The correct action is to configure the ALB to use subnets in at least two Availability Zones. An ALB is a regional service that requires subnets in multiple AZs to distribute incoming traffic across healthy targets in those zones. When all traffic goes to a single AZ, it indicates the ALB is only attached to one subnet, creating a single point of failure and limiting the pool of EC2 instances that can serve traffic, which directly causes slow load times and reduced reliability.

Answer

Add more EC2 instances in the same Availability Zone

Answer

Replace the ALB with a Network Load Balancer (NLB)

Answer

Enable cross-zone load balancing on the ALB

Question 4

Which TWO AWS services can be used to improve the security of a VPC? (Choose TWO.)

Accepted Answer

Security Groups. Security Groups (A) act as a virtual firewall for instances, controlling inbound and outbound traffic at the instance level based on allow rules only. Network ACLs (D) provide a stateless firewall layer at the subnet level, supporting both allow and deny rules, and are evaluated in numeric order. Together, they offer defense-in-depth for VPC traffic filtering.

Answer

Internet Gateway

Answer

Route Tables

Answer

VPC Peering

Question 5

A company has multiple VPCs in the same AWS Region that need to communicate with each other. The SysOps administrator wants to avoid the complexity of a full mesh of VPC peering connections. Which AWS service should the administrator use to connect all VPCs with a central hub?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub that allows you to connect multiple VPCs and on-premises networks through a single gateway, eliminating the need for a full mesh of VPC peering connections. It uses a star topology where each VPC attaches to the Transit Gateway, and routing is managed via route tables, simplifying network management and scaling.

Answer

AWS Direct Connect

Answer

VPC peering

Answer

AWS PrivateLink

Question 6

A company runs a stateful web application on a single EC2 instance. To improve reliability, the company wants to implement a highly available architecture. What should the SysOps administrator do?

Accepted Answer

Refactor the application to store session state externally (e.g., ElastiCache), then deploy it across multiple AZs with an Application Load Balancer.. It addresses the core challenge of making a stateful web application highly available. By storing session state externally in ElastiCache, the application becomes stateless from a networking perspective, allowing any EC2 instance to handle any request. Deploying these instances across multiple Availability Zones (AZs) behind an Application Load Balancer (ALB) provides fault tolerance and automatic traffic distribution, eliminating the single point of failure.

Answer

Migrate the application to a larger instance type.

Answer

Create a standby EC2 instance and use an Elastic IP to fail over manually.

Answer

Use Route 53 health checks to route traffic to a secondary instance if the primary fails.

Question 7

A company uses an Amazon DynamoDB table with provisioned capacity. The average write usage is 500 write capacity units (WCU) but regularly spikes to 2,000 WCU during business hours. The SysOps administrator wants to reduce costs without affecting performance during the spikes. Which solution should the administrator implement?

Accepted Answer

Enable DynamoDB auto scaling. DynamoDB auto scaling allows the table to automatically adjust its provisioned write capacity between a minimum and maximum range based on actual traffic. By setting the minimum WCU to cover the average usage (500) and the maximum to handle the spikes (2,000), the administrator pays only for the baseline capacity most of the time, while the service scales up during spikes without manual intervention or over-provisioning.

Answer

Switch to DynamoDB on-demand capacity mode

Answer

Purchase reserved capacity for 2,000 WCU

Answer

Use DynamoDB Time to Live (TTL) to delete old items

Question 8

A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to access an Amazon S3 bucket in the same AWS Region. The SysOps administrator wants to ensure the traffic does not traverse the internet. Which solution should be implemented?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet. It uses AWS's internal network, routing traffic through a prefix list in the route table, ensuring data stays within the AWS backbone. This meets the requirement of no internet traversal while providing secure, low-latency access to S3.

Answer

Deploy a NAT Gateway in the public subnet and add a route to the private subnet's route table.

Answer

Attach an Internet Gateway to the VPC and add a default route in the private subnet's route table.

Answer

Set up an AWS Direct Connect connection to the S3 bucket.

Question 9

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application stores session data in an in-memory cache on the EC2 instances. During an instance refresh, users lose their session data. Which action should be taken to improve reliability without major application changes?

Accepted Answer

Move session state to Amazon ElastiCache for Redis.. Amazon ElastiCache for Redis provides a fully managed, external, and highly available in-memory data store that can be used to persist session state outside of the EC2 instances. By moving session data to Redis, the session state survives instance refreshes, terminations, or scaling events without requiring any changes to the application's session management logic beyond pointing to the Redis endpoint. This decouples session state from the compute layer, ensuring reliability and data durability during Auto Scaling lifecycle events.

Answer

Use ElastiCache for Memcached with auto-discovery.

Answer

Increase the minimum size of the Auto Scaling group.

Answer

Enable sticky sessions (session affinity) on the ALB target group.

Question 10

A company has a production RDS for MySQL database. The SysOps administrator receives an alert that the database instance is running out of storage. The company requires high availability and minimal downtime during any modifications. What should the administrator do?

Accepted Answer

Modify the RDS instance to increase the allocated storage. Since the instance is Multi-AZ, the modification will be applied with minimal downtime.. Modifying the allocated storage on a Multi-AZ RDS for MySQL instance can be done with minimal downtime. When you modify storage settings, Amazon RDS performs the update in the background, and for Multi-AZ deployments, the modification is applied to the standby first, then a failover occurs to minimize any interruption. This approach satisfies the high availability requirement and keeps downtime to a few seconds or less.

Answer

Add a read replica and use it for read traffic to reduce load on the primary.

Answer

Create a CloudWatch alarm to notify when storage is low, then manually clean up old data.

Answer

Create a new RDS instance with larger storage and migrate the data using AWS Database Migration Service.

Question 11

A company has a production Amazon RDS for MySQL DB instance in a single Availability Zone. The SysOps administrator needs to improve database availability to ensure automatic failover in the event of a database failure or an Availability Zone outage. Which configuration should the administrator enable?

Accepted Answer

Enable Multi-AZ deployment. Enabling a Multi-AZ deployment for Amazon RDS for MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a database failure or an AZ outage, Amazon RDS automatically fails over to the standby replica, typically within 60–120 seconds, without requiring manual intervention. This configuration meets the requirement for automatic failover and improved availability.

Answer

Create a read replica in another Availability Zone

Answer

Enable automated backups

Answer

Change the DB instance to a larger instance class

Question 12

A company stores infrequently accessed data in S3 Standard. They want to reduce storage costs without compromising immediate accessibility. What is the MOST cost-effective solution?

Accepted Answer

Use S3 Standard-IA storage class.. The most cost-effective solution is to use S3 Standard-IA (Option B). S3 Standard-IA is designed for infrequently accessed data that requires immediate access; it offers lower storage costs than S3 Standard while maintaining low latency and high throughput. Option A (S3 Glacier Flexible Retrieval) has even lower storage cost but retrieval times of minutes to hours, which does not meet the requirement of immediate accessibility. Option C (S3 Intelligent-Tiering) automatically moves data between tiers to optimize costs, but it includes monitoring and automation charges that may not be cost-effective for data that is consistently infrequently accessed; also, it does not guarantee lower cost than Standard-IA for this pattern. Option D (create a lifecycle policy to delete after 30 days) would lose data permanently and is not a storage class; it also does not address cost savings for long-term storage.

Answer

Use S3 Glacier Flexible Retrieval.

Answer

Move data to S3 Intelligent-Tiering.

Answer

Create a lifecycle policy to delete objects after 30 days.

Question 13

A company runs a batch processing job every night on Amazon EC2 instances. The job takes exactly 2 hours to complete and can be interrupted and resumed later. The SysOps administrator wants to minimize compute costs. Which purchasing option should be used?

Accepted Answer

Spot Instances. Spot Instances are the correct choice because the batch job is fault-tolerant (can be interrupted and resumed) and runs for a fixed 2-hour window nightly. Spot Instances offer up to 90% cost savings compared to On-Demand, and with the ability to handle interruptions via checkpointing, they minimize compute costs without requiring a long-term commitment.

Answer

Reserved Instances

Answer

On-Demand Instances

Answer

Dedicated Instances

Question 14

A company's security policy requires that all IAM users must authenticate with multi-factor authentication (MFA) before they can perform any actions on Amazon EC2 instances. The SysOps administrator needs to enforce this requirement using IAM policies. Which IAM policy condition key should the administrator use in the policy?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key allows the administrator to enforce MFA authentication by checking whether the user authenticated with a valid MFA device before allowing the action. When set to `true`, the policy denies access to EC2 actions unless the user has completed MFA. This directly satisfies the security policy requirement.

Answer

aws:SourceIp

Answer

iam:PassedToService

Answer

ec2:SourceInstanceARN

Question 15

Refer to the exhibit. The command returns no events for RunInstances during the specified time period. The administrator knows that instances were launched during that time. What is the most likely cause?

Accepted Answer

CloudTrail is not configured to log management events.. CloudTrail can be configured to log either management events, data events, or both. If only data events are logged, management events such as RunInstances will not appear in the CloudTrail event history. The command `aws cloudtrail lookup-events` queries the CloudTrail event history, which only contains events that CloudTrail is configured to record. Since the administrator knows instances were launched but no events are returned, the most likely cause is that CloudTrail is not configured to log management events.

Answer

CloudTrail logs are being delivered to an S3 bucket, not to CloudWatch Logs.

Answer

The command is run in the wrong AWS Region.

Answer

The IAM user does not have permission to view CloudTrail events.