SOA-C02 Practice Test 34 — 15 Questions

Question 1

A company has a fleet of EC2 instances that need to be patched monthly. The SysOps administrator must ensure that the patching process does not affect the availability of the application. Which strategy should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Auto Scaling group with a rolling update strategy.. Using an Auto Scaling group with a rolling update strategy allows the administrator to replace instances in batches, ensuring that a minimum number of instances remain in service throughout the patching process. This maintains application availability by avoiding simultaneous disruption to all instances, which is a key requirement for high-availability architectures.

Answer

Patch one instance at a time manually by stopping and starting.

Answer

Use AWS Systems Manager Patch Manager to patch all instances at once.

Answer

Stop all instances, apply patches, then start them.

Question 2

A SysOps administrator is troubleshooting an issue where an Auto Scaling group is not launching EC2 instances despite having a scaling policy that should trigger when CPU utilization exceeds 80%. The CloudWatch alarm shows that the metric is breaching the threshold, but no instances are launched. What is the most likely cause?

Accepted Answer

The Auto Scaling group has reached its maximum size.. When an Auto Scaling group reaches its maximum size, it cannot launch new instances even if a scaling policy is triggered. The CloudWatch alarm breaching the threshold indicates the scaling condition is met, but the group's capacity limit prevents any new instance launches. This is a common misconfiguration where the max size is set too low relative to the desired or current capacity.

Answer

The scaling policy is incorrectly configured to use a simple scaling policy instead of a step scaling policy.

Answer

The health check grace period is too long.

Answer

The CloudWatch alarm is in insufficient data state.

Question 3

A company runs a critical application on a fleet of EC2 instances in an Auto Scaling group. The application is deployed using a blue/green deployment strategy with AWS CodeDeploy. The green environment fails immediately after deployment, and the deployment is automatically rolled back. However, the rollback also fails because the original blue environment's Auto Scaling group has been scaled down. What should the SysOps administrator do to prevent this issue in future deployments?

Accepted Answer

Set the original environment termination delay to a longer duration in the CodeDeploy deployment group.. Setting the original environment termination delay in the CodeDeploy deployment group ensures that the blue Auto Scaling group instances are not terminated immediately after a successful deployment. This delay keeps the blue environment available during the rollback window, preventing the rollback failure that occurs when the original environment has already been scaled down. The termination delay is a configurable setting in CodeDeploy that holds the old instances for a specified period, allowing a safe fallback if the new environment fails.

Answer

Configure the deployment to automatically delete the green environment after rollback.

Answer

Increase the minimum size of the Auto Scaling group.

Answer

Change the deployment type to in-place.

Question 4

An application running on EC2 instances sends large amounts of data to an S3 bucket. The SysOps administrator wants to reduce data transfer costs while ensuring the traffic stays within AWS. What is the most cost-effective solution?

Accepted Answer

Create a VPC Endpoint for S3 (Gateway type) and use it from the EC2 instances.. A VPC Endpoint for S3 (Gateway type) allows EC2 instances to access S3 over the AWS private network without traversing the public internet, eliminating data transfer costs for traffic within the same region. Since the traffic stays within AWS, this is the most cost-effective solution as it avoids NAT Gateway, Direct Connect, or S3 Transfer Acceleration charges.

Answer

Set up an AWS Direct Connect connection.

Answer

Use S3 Transfer Acceleration.

Answer

Route traffic through a NAT Gateway in a public subnet.

Question 5

A company uses AWS Elastic Beanstalk for a Java web application. The SysOps administrator needs to deploy a new version of the application with zero downtime and minimize the risk of failure. The administrator wants to deploy the new version to a completely new set of instances, test them, and then swap the environment's CNAME to point to the new instances. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option D) is correct because it launches a completely new set of instances in a separate Auto Scaling group, deploys the new application version to them, and then swaps the environment's CNAME to point to the new instances. This ensures zero downtime and minimizes risk by allowing full testing of the new instances before traffic is switched, and if the deployment fails, the original instances remain untouched.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 6

A SysOps administrator is designing a highly available architecture for a web application using an Application Load Balancer and an Auto Scaling group across three Availability Zones. The application must be able to withstand the loss of an entire AZ. Which THREE components are necessary to meet this requirement? (Choose THREE.)

Accepted Answer

Launch EC2 instances in at least two Availability Zones.. Launching EC2 instances in at least two Availability Zones (AZs) ensures that if one AZ fails, the Auto Scaling group can still serve traffic from instances in the remaining AZs. This is a fundamental requirement for high availability, as an Auto Scaling group spanning multiple AZs can automatically replace failed instances in other zones. Without multi-AZ deployment, a single AZ failure would cause complete application downtime.

Answer

Use a single NAT gateway to provide internet access.

Answer

Use a cluster placement group for EC2 instances.

Question 7

A company is using Amazon CloudWatch Logs to centralize logs from multiple EC2 instances. The SysOps administrator needs to ensure that log data is encrypted at rest and in transit. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Encrypt the CloudWatch Logs log group using an AWS KMS customer managed key.. CloudWatch Logs supports encryption at rest using AWS KMS customer managed keys (CMKs). By associating a KMS key with a log group, all log data stored in that log group is encrypted at rest, meeting the encryption-at-rest requirement. Option D is correct because the CloudWatch Logs agent can be configured to use TLS/SSL (port 443) for log delivery, ensuring encryption in transit between the EC2 instances and CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the CloudWatch Logs log group.

Answer

Apply an S3 bucket policy that requires encryption for objects uploaded to the bucket.

Answer

Install an AWS Certificate Manager (ACM) certificate on the EC2 instances.

Question 8

An organization uses AWS CloudFormation to manage infrastructure. They have a stack that includes an Amazon RDS DB instance. The administrator wants to update the DB instance's allocated storage without downtime. The DB instance is currently using gp2 storage. Which action should the administrator take?

Accepted Answer

Modify the storage size in the CloudFormation template and update the stack.. Modifying the allocated storage size in the CloudFormation template and updating the stack triggers a storage modification on the RDS DB instance. For gp2 storage, increasing allocated storage does not require downtime; RDS performs the modification while the instance remains available. This approach aligns with the requirement to avoid downtime and leverages CloudFormation's infrastructure-as-code capabilities.

Answer

Create a read replica with the new storage size and promote it.

Answer

Stop the DB instance, modify the storage, and start it.

Answer

Take a manual snapshot and restore it with the new storage size.

Question 9

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The company security policy requires that credentials are not stored on the instance. What is the most secure way to grant access?

Accepted Answer

Create an IAM role with S3 access permissions and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance via an instance profile allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). These credentials are automatically rotated and never stored on the instance, satisfying the security policy requirement. The EC2 instance retrieves the credentials through the instance metadata service (IMDS), eliminating the need for long-term access keys.

Answer

Generate an access key and secret key for an IAM user, then store them in a configuration file on the instance.

Answer

Create an S3 bucket policy that allows access from the instance's public IP address.

Answer

Define the access keys as environment variables in the user data script when launching the instance.

Question 10

A SysOps administrator wants to receive alerts when the root user performs an action in the AWS account. Which service should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs. AWS CloudTrail captures all API calls made by the root user as events. By sending these events to Amazon CloudWatch Logs, you can create a metric filter that matches root user activity and trigger an alarm via CloudWatch Alarms. This combination enables real-time notification when the root user performs any action.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon CloudWatch Metrics

Answer

AWS Config

Question 11

A SysOps administrator is creating a monitoring solution for a web application that uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The administrator wants to monitor the average request count per minute and the number of healthy hosts. Which TWO CloudWatch metrics should the administrator use? (Choose TWO.)

Accepted Answer

AWS/ApplicationELB HealthyHostCount. AWS/ApplicationELB HealthyHostCount, is correct because it directly reports the number of registered instances that are passing health checks, which is exactly what the administrator needs to monitor the number of healthy hosts behind the ALB. Option E, AWS/ApplicationELB RequestCount, is correct because it tracks the total number of requests handled by the ALB, and by dividing by the time period, the administrator can calculate the average request count per minute.

Answer

AWS/ApplicationELB Latency

Answer

AWS/EC2 CPUUtilization

Answer

AWS/AutoScaling GroupInServiceInstances

Question 12

A company has an S3 bucket that stores critical data. The bucket has versioning enabled. A SysOps administrator accidentally deletes a version of an object. What is the quickest way to recover the deleted version?

Accepted Answer

Copy the deleted version from the bucket's version history.. S3 object versioning maintains a version history for each object, including deleted versions. When a version is deleted, it is not permanently removed; instead, a delete marker is created, and the deleted version remains in the version history. The quickest way to recover it is to copy the deleted version ID from the bucket's version history (e.g., using the AWS CLI `aws s3api copy-object` with the `--version-id` parameter) to restore the object without contacting support or enabling additional features.

Answer

Use the S3 bucket's 'Undelete' feature.

Answer

Enable MFA Delete and then restore the object.

Answer

Contact AWS Support to restore the object.

Question 13

Refer to the exhibit. A SysOps administrator runs the commands shown. Which key(s) have automatic key rotation enabled?

Accepted Answer

Only the first key. The first key has automatic key rotation enabled because the `EnableKeyRotation` API call was made specifically for that key (key ID `1234abcd-12ab-34cd-56ef-1234567890ab`). AWS KMS automatic key rotation is a per-key setting that must be explicitly enabled; it is not enabled by default. The second key (key ID `0987dcba-09fe-87dc-65ba-0987654321fe`) was not subjected to any rotation-enabling command, so it retains the default disabled state.

Answer

Only the second key

Answer

Neither key

Answer

Both keys

Question 14

Which THREE security best practices should be followed when managing IAM users? (Choose three.)

Accepted Answer

Rotate access keys regularly. Rotating access keys regularly limits the window of exposure if a key is compromised. AWS recommends rotating IAM user access keys every 90 days as a security best practice, and this can be enforced using an IAM policy that checks the key's creation date via the `aws:CurrentTime` condition key.

Answer

Attach policies directly to users

Answer

Use the root user for daily administration

Question 15

An administrator needs to be notified when the root user signs in to the AWS Management Console. Which method should be used?

Accepted Answer

Create a CloudWatch Events rule for 'AWS Console Sign-In' events and set the target to an SNS topic.. You can create an Amazon CloudWatch Events rule (now called Amazon EventBridge rule) that matches the 'AWS Console Sign-In' event from AWS CloudTrail. When the root user signs in, this event is generated, and the rule can trigger an SNS topic to send a notification to the administrator. This is the recommended approach for real-time alerting on root user activity.

Answer

Enable CloudTrail Insights to detect root login anomalies.

Answer

Create a CloudWatch alarm on the RootAccountUsage metric.

Answer

Use AWS Config to track IAM password policy changes.