SOA-C02 Practice Test 33 — 15 Questions

Question 1

A company is running a critical application on Amazon EC2 instances. The application performance has degraded over the past week. The SysOps administrator suspects a memory leak. The administrator needs to collect detailed memory usage metrics every minute and store them for 30 days. Which solution is the MOST cost-effective and operationally efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. The CloudWatch agent is specifically designed to collect custom metrics like memory utilization from EC2 instances, which are not available through default or detailed EC2 monitoring. By installing the agent and configuring it to publish memory metrics to CloudWatch every minute, the administrator can meet the requirement for 1-minute granularity and 30-day retention cost-effectively, as CloudWatch retains metric data at 1-minute resolution for 15 days by default, but can be extended to 30 days via a custom metric retention setting.

Answer

Use AWS CloudTrail to log memory usage and store the logs in Amazon S3.

Answer

Enable default EC2 monitoring to collect memory metrics every 5 minutes.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics every 1 minute.

Question 2

A company runs a web application on Amazon EC2 instances in private subnets across multiple Availability Zones. The instances need to download software patches from the internet. The SysOps administrator requires a highly available, fully managed solution for outbound internet connectivity. Which solution should be implemented?

Accepted Answer

Deploy a NAT gateway in each Availability Zone and update the route tables for each private subnet to point to the NAT gateway in the same Availability Zone.. A NAT gateway in each Availability Zone provides highly available outbound internet connectivity for instances in private subnets. By placing a NAT gateway in each AZ and routing private subnet traffic to the NAT gateway in the same AZ, you eliminate a single point of failure and ensure that internet-bound traffic remains within the same AZ for low latency and fault tolerance. This is a fully managed AWS service that handles scaling and failover automatically.

Answer

Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet route tables.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it.

Answer

Set up an AWS Direct Connect connection and route all internet-bound traffic through it.

Question 3

A company wants to receive a notification when the root account is used to perform any action in the AWS account. Which service should be used to monitor this?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. AWS CloudTrail logs all API activity in the account, including root user actions. By creating a CloudTrail trail and sending those logs to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that matches the `RootAccess` event or any API call where `userIdentity.type` is `Root` and trigger a notification via SNS or Lambda. This combination provides real-time monitoring and alerting for root account usage.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 4

An application running on EC2 instances in an Auto Scaling group is experiencing intermittent errors. The errors correlate with periods of high memory usage. The SysOps administrator wants to set up a CloudWatch alarm to scale out when memory usage exceeds 80%. What should the administrator do to enable monitoring of memory usage?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to publish memory metrics.. The CloudWatch agent is required to publish custom memory metrics from EC2 instances because memory utilization is not a standard metric provided by default. By installing and configuring the agent, the administrator can collect memory usage data and create a CloudWatch alarm to trigger Auto Scaling actions when usage exceeds 80%.

Answer

Enable detailed monitoring on the Auto Scaling group.

Answer

Use the default EC2 memory metric provided by CloudWatch.

Answer

Create a Lambda function to pull memory data from the EC2 instances.

Question 5

A company is using AWS CodePipeline to deploy a web application. The security team requires that all code changes be reviewed and approved before deployment to production. Which action should be taken to enforce this requirement?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline before the production deployment stage.. Adding a manual approval action in the CodePipeline pipeline before the production deployment stage enforces a required review and approval gate. This action pauses the pipeline at that point, waiting for an authorized user to manually approve the change before it proceeds to the production stage, directly meeting the security team's requirement.

Answer

Create an IAM policy that denies the codecommit:PutFile action unless the user is in a specific group.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to notify the security team of any deployments.

Answer

Configure a CodeCommit repository to require pull requests for all changes.

Question 6

A company uses Amazon S3 to store critical data. They need to protect against accidental deletion of objects. Which feature should the SysOps Administrator enable?

Accepted Answer

Enable versioning on the bucket.. Enabling S3 Versioning preserves every version of an object, including overwrites and deletes. When versioning is enabled, a DELETE request does not remove the object permanently; instead, it adds a delete marker, allowing the object to be restored by removing the marker. This directly protects against accidental deletion by providing a recoverable history of all object changes.

Answer

Create a lifecycle policy to transition objects to Glacier.

Answer

Configure cross-region replication.

Answer

Enable MFA Delete on the bucket.

Question 7

Which TWO actions can a SysOps administrator take to improve the availability of a web application using an Application Load Balancer (ALB) and EC2 instances? (Choose two.)

Accepted Answer

Configure health checks on the target group. Health checks allow the ALB to automatically detect unhealthy EC2 instances and stop routing traffic to them, which prevents failed requests from reaching users. By configuring health checks on the target group, the ALB can mark instances as unhealthy based on criteria like HTTP response codes or timeout thresholds, and then route traffic only to healthy instances. This directly improves availability by ensuring that requests are not sent to failed or degraded instances.

Answer

Place all instances in a single subnet to reduce latency

Answer

Use larger instance types to handle more traffic

Answer

Increase the deregistration delay (connection draining) timeout

Question 8

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The application needs to authenticate users using an external identity provider (IdP). The SysOps Administrator recommends using Amazon Cognito as an identity broker. Which ALB action should be configured to authenticate users before forwarding requests to the target group?

Accepted Answer

An authenticate action using Amazon Cognito as the user pool.. Amazon Cognito integrates directly with Application Load Balancers via an authenticate action. When you configure an ALB rule with an authenticate action using a Cognito user pool, the ALB handles the OAuth 2.0 / OpenID Connect flow with the external IdP, obtains tokens, and only forwards authenticated requests to the target group. This eliminates the need for custom authentication logic in the application.

Answer

A fixed-response action to return a 401 status code.

Answer

A redirect action to the IdP login page.

Answer

A forward action to the target group.

Question 9

A company is using AWS CodeDeploy to deploy an application to an EC2 instances in an Auto Scaling group. The deployment fails because the instances are not reporting to CodeDeploy. What is the most likely cause?

Accepted Answer

The CodeDeploy agent is not installed on the instances.. The most likely cause is that the CodeDeploy agent is not installed on the instances. The agent is required to communicate with the CodeDeploy service and execute deployments. Option A is incorrect because the security group needs to allow outbound traffic from the instances to CodeDeploy, not inbound. Option B is incorrect because the IAM role is necessary for the instances to access CodeDeploy, but the immediate issue of not reporting is the agent. Option C is incorrect because the application not running is a symptom, not the cause of the reporting failure.

Answer

The security group does not allow inbound traffic from CodeDeploy.

Answer

The instances do not have the correct IAM role to allow CodeDeploy to access them.

Answer

The application is not running on the instances.

Question 10

A company runs a web application on a fleet of Amazon EC2 instances that operate 24/7 with a steady and predictable load. The SysOps administrator wants to minimize compute costs while ensuring the required capacity is always available. Which EC2 purchasing option should the administrator use?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the correct choice because the workload runs 24/7 with steady, predictable load. RIs provide a significant discount (up to 72%) over On-Demand pricing in exchange for a one- or three-year commitment, ensuring cost minimization while guaranteeing capacity availability in the specified Availability Zone.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Dedicated Hosts

Question 11

A company wants to monitor for unauthorized API calls in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, and timestamp of each call. This enables monitoring for unauthorized API activity by analyzing the logs for suspicious patterns or unexpected actions. CloudTrail is specifically designed for auditing API usage, unlike other services that focus on resource configuration or threat detection.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A company has a CloudWatch alarm that monitors the CPU utilization of an EC2 instance. The alarm is set to trigger when CPU utilization exceeds 80% for 5 consecutive minutes. The alarm state is 'INSUFFICIENT_DATA'. What does this mean?

Accepted Answer

The alarm does not have enough data to determine the state.. The INSUFFICIENT_DATA state in CloudWatch indicates that the alarm has not received enough metric data points to evaluate whether the threshold (CPU utilization > 80% for 5 consecutive minutes) has been breached. This typically occurs when the EC2 instance is newly launched, the CloudWatch agent is not reporting, or there are gaps in metric collection due to network issues or instance stops. It does not imply any conclusion about the CPU utilization level itself.

Answer

The CPU utilization is below 80% for 5 minutes.

Answer

The CPU utilization has exceeded 80% for 5 minutes.

Answer

The alarm is missing data points for the past 5 minutes.

Question 13

A company runs a microservices architecture on Amazon ECS with Fargate. They need to ensure that if a task fails, it is automatically restarted. Which configuration is required?

Accepted Answer

Create an ECS service with a desired count and task definition. An ECS service with a desired count and task definition ensures that Fargate tasks are automatically restarted if they fail. The ECS service scheduler monitors the desired count and replaces any stopped or failed tasks to maintain the specified number of running instances, providing built-in resilience without additional infrastructure.

Answer

Configure a CloudWatch alarm to restart the task

Answer

Define tasks using the ECS RunTask API

Answer

Use an Auto Scaling group for the Fargate tasks

Question 14

A SysOps administrator is setting up centralized logging for multiple AWS accounts using CloudWatch Logs. Which TWO actions should the administrator take to ensure that logs from all accounts are aggregated in a single account?

Accepted Answer

In the central account, create a CloudWatch Logs destination and attach a resource policy that grants the source accounts permission to write logs.. A CloudWatch Logs destination in the central account, combined with a resource policy that grants the source accounts permission to write logs, is the standard mechanism for cross-account log aggregation. The destination acts as a target for subscription filters, and the resource policy explicitly allows the source accounts to call the PutLogEvents API against that destination. This setup ensures that log events from source accounts are delivered to the central account without requiring IAM roles or additional infrastructure.

Answer

In the central account, create an IAM role that trusts the source accounts and allows PutLogEvents.

Answer

In the central account, create a log group with the same name as the source accounts' log groups.

Answer

In each source account, create a Kinesis Data Firehose delivery stream that sends logs to the central account's S3 bucket.

Question 15

An application running on EC2 instances sends custom metrics to CloudWatch using the PutMetricData API. The SysOps admin notices that some metrics are missing from the CloudWatch console. What is the most likely cause?

Accepted Answer

The namespace in the PutMetricData call does not match the namespace in the CloudWatch console. Custom metrics in CloudWatch are uniquely identified by the combination of namespace, metric name, and dimensions. If the namespace used in the PutMetricData API call does not match the namespace being viewed in the CloudWatch console, the metrics will not appear under that namespace. CloudWatch does not automatically merge or alias namespaces, so mismatched namespaces cause the data to be stored under a different namespace, making it invisible in the console view.

Answer

The metric data does not include a unit

Answer

The metric data does not include a dimension

Answer

The metric data is being sent with a timestamp older than 14 days