SOA-C02 Practice Test 35 — 15 Questions

Question 1

A SysOps administrator is investigating a security incident where an unauthorized user accessed an S3 bucket. Which TWO AWS services can the administrator use to collect and analyze the relevant logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records API calls made to S3, including who made the request, the source IP address, and the time of the action. This allows the administrator to trace the unauthorized access to a specific IAM user or role and identify the exact API operations performed, such as GetObject or PutObject.

Answer

AWS WAF logs

Answer

Amazon VPC Flow Logs

Answer

Amazon Route 53 resolver logs

Question 2

A company uses AWS CloudTrail to log all API calls. The security team requires that all logs be encrypted at rest and stored in an S3 bucket that blocks public access. The SysOps administrator configures the bucket with default encryption (SSE-S3) and a bucket policy that denies all actions unless the request includes the x-amz-server-side-encryption header with value AES256. However, CloudTrail delivery fails. What is the MOST likely cause?

Accepted Answer

The bucket policy requires the x-amz-server-side-encryption header, but CloudTrail does not include this header. CloudTrail does not include the x-amz-server-side-encryption header when delivering log files to S3. The bucket policy requires this header for all PutObject requests, so CloudTrail's PUT requests are denied, causing delivery to fail. SSE-S3 encryption is applied automatically by S3 when default encryption is enabled, but the policy condition overrides that by requiring the header explicitly.

Answer

CloudTrail does not support SSE-S3 encryption

Answer

The bucket policy does not grant CloudTrail the s3:PutObject permission

Answer

The bucket has default encryption enabled, which conflicts with CloudTrail's encryption

Question 3

A company uses Amazon CloudFront to deliver static content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which solution should be used?

Accepted Answer

Configure an origin access control (OAC) and update the S3 bucket policy to allow CloudFront access.. Origin Access Control (OAC) is the recommended method to restrict S3 bucket access exclusively to CloudFront. OAC uses a CloudFront-owned service principal to sign requests, and the S3 bucket policy must explicitly grant the `s3:GetObject` action to that principal, ensuring no direct S3 access from other sources.

Answer

Use pre-signed URLs for all objects.

Answer

Use an S3 bucket policy that allows access from any AWS service.

Answer

Generate CloudFront key pairs and configure signed URLs.

Question 4

A company is designing a disaster recovery strategy for its AWS environment. The primary Region is us-east-1, and the secondary Region is us-west-2. The application uses Amazon RDS for MySQL, Amazon S3 for static assets, and EC2 instances in an Auto Scaling group. The RTO is 30 minutes, and the RPO is 15 minutes. Which TWO actions should the SysOps administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure a cross-Region read replica for the RDS instance in us-west-2.. A cross-Region read replica in us-west-2 can be promoted to a primary instance in under 30 minutes, and with binary log (binlog) replication it can achieve an RPO of 15 minutes or less. This allows the RDS database to be recovered with minimal data loss in the secondary Region, meeting both the RTO and RPO targets.

Answer

Deploy a single RDS instance in us-west-2 as a standby.

Answer

Create AMI backups of EC2 instances every hour and copy to us-west-2.

Answer

Take daily EBS snapshots and copy them to us-west-2.

Question 5

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified if a stack creation fails. Which method is the most efficient way to achieve this?

Accepted Answer

Specify an SNS topic ARN in the 'NotificationARNs' parameter of the stack.. CloudFormation natively supports specifying an Amazon SNS topic ARN in the 'NotificationARNs' parameter of the stack. When a stack creation fails, CloudFormation automatically publishes a notification to the SNS topic, which can then deliver the message via email, SMS, or other protocols without any custom polling or additional services.

Answer

Use Amazon Simple Email Service (SES) to send emails on stack failure.

Answer

Create a Lambda function that polls the CloudFormation API for stack status changes.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' events.

Question 6

A SysOps administrator is automating the deployment of a web application using AWS CloudFormation. The application requires an Application Load Balancer (ALB) and an Auto Scaling group. The administrator wants to ensure that the Auto Scaling group registers instances with the ALB automatically. Which of the following are required? (Choose TWO.)

Accepted Answer

A launch template or launch configuration that defines the AMI and instance type.. A launch template or launch configuration is required because it defines the AMI, instance type, and other configuration details that the Auto Scaling group uses to launch EC2 instances. Without it, the Auto Scaling group cannot provision instances to register with the ALB.

Answer

A health check grace period set in the Auto Scaling group.

Answer

A security group that allows traffic from the ALB.

Answer

An Application Load Balancer created in the same stack.

Question 7

A SysOps administrator is designing a highly available architecture for a web application using an Application Load Balancer (ALB) with EC2 instances in an Auto Scaling group. Which TWO configurations are required to ensure high availability? (Choose TWO.)

Accepted Answer

Configure the ALB with health checks for the target group. Health checks allow the ALB to monitor the status of each EC2 instance in the target group. If an instance fails health checks, the ALB automatically stops routing traffic to it, preventing user requests from reaching a failed instance. This is essential for maintaining application availability and is a core feature of the ALB's high-availability design.

Answer

Launch all EC2 instances in a single Availability Zone to reduce latency

Answer

Use t2.micro instances to reduce cost

Answer

Disable health checks to reduce load on the ALB

Question 8

Which TWO steps should a SysOps administrator take to ensure data durability for an Amazon S3 bucket that stores critical documents? (Choose two.)

Accepted Answer

Enable S3 Versioning.. S3 Versioning (B) protects against accidental deletion and overwrites by preserving every version of an object, including deletions as delete markers. This ensures data durability by allowing recovery of previous versions. Cross-Region Replication (E) provides durability by asynchronously replicating objects to a different AWS region, protecting against region-wide failures.

Answer

Enable default encryption with SSE-S3.

Answer

Use S3 Transfer Acceleration.

Answer

Enable MFA Delete.

Question 9

A company runs a stateless web application on EC2 instances in an Auto Scaling group. To improve reliability during a traffic spike, which THREE actions should the SysOps administrator take? (Choose three.)

Accepted Answer

Configure a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy based on average CPU utilization allows the Auto Scaling group to automatically adjust the number of EC2 instances in response to traffic spikes. This policy maintains the target metric (e.g., 50% CPU) by adding or removing instances, ensuring the application remains responsive without manual intervention. It is a key mechanism for improving reliability under variable load.

Answer

Enable detailed monitoring for EC2 instances.

Answer

Use a larger instance type to handle more traffic per instance.

Question 10

Which THREE AWS features can be used to improve the performance of an Amazon DynamoDB table that is experiencing high read latency? (Choose THREE.)

Accepted Answer

Enable DynamoDB Accelerator (DAX).. DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache that can reduce DynamoDB response times from milliseconds to microseconds. By caching frequently read items, DAX offloads read requests from the underlying table, directly addressing high read latency without requiring additional read capacity units or table modifications.

Answer

Enable Auto Scaling for read capacity.

Answer

Use Time to Live (TTL) to delete old items.

Question 11

A SysOps administrator wants to be alerted when the root user of the AWS account signs in. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including root user sign-ins, as `RootLogin` events in the management events trail. Option D is correct because Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches these CloudTrail log events and triggers a notification action, such as sending an SNS alert, when the root user signs in.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 12

Which TWO actions should a SysOps admin take to troubleshoot an Amazon RDS instance that is experiencing high CPU utilization? (Choose 2.)

Accepted Answer

Enable Enhanced Monitoring to view OS-level metrics. Enhanced Monitoring provides OS-level metrics (e.g., CPU, memory, disk I/O) for the RDS instance, which helps identify resource contention at the operating system level. This granularity is essential for diagnosing high CPU utilization that may be caused by OS processes (e.g., backup, patching) rather than database queries alone.

Answer

Enable Multi-AZ to distribute the load

Answer

Delete the slow query log to free up CPU

Answer

Increase the instance size to reduce CPU utilization

Question 13

A SysOps team is using CloudWatch to monitor CPU utilization of EC2 instances. They want to receive a notification when average CPU exceeds 80% for 5 consecutive minutes. Which combination of services should they use?

Accepted Answer

CloudWatch Metrics, CloudWatch Alarm, and Amazon SNS. CloudWatch Metrics collects the CPU utilization data from EC2 instances, a CloudWatch Alarm evaluates whether the average CPU exceeds 80% for 5 consecutive minutes (using a period of 300 seconds and 5 datapoints), and Amazon SNS publishes the notification to subscribers (e.g., email, SMS) when the alarm state transitions to ALARM. This combination directly fulfills the requirement without unnecessary services.

Answer

CloudWatch Metrics, CloudWatch Alarm, and AWS Lambda

Answer

AWS Config, CloudWatch Alarm, and Amazon SNS

Answer

CloudWatch Logs, CloudWatch Alarm, and AWS Lambda

Question 14

A SysOps administrator wants to monitor the CPU utilization of an Amazon RDS instance and receive an alert if it exceeds 90% for 5 consecutive minutes. Which TWO AWS services are required to set up this monitoring? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch is the service that collects and stores metrics such as CPU utilization from RDS instances. Amazon CloudWatch Alarms allow you to set a threshold (e.g., CPU > 90%) and evaluate it over a specified period (e.g., 5 consecutive minutes) to trigger an action, such as sending a notification via SNS.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Answer

Amazon RDS Enhanced Monitoring

Question 15

An organization uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. A SysOps administrator needs to be alerted when a canary run fails. Which THREE steps are required to set up this alerting?

Accepted Answer

Configure a CloudWatch alarm on the canary's `SuccessPercent` metric.. CloudWatch Synthetics canaries automatically publish a `SuccessPercent` metric to CloudWatch. By configuring a CloudWatch alarm on this metric (e.g., when `SuccessPercent` drops below 100), the administrator can trigger an alert whenever a canary run fails. This is the standard method for monitoring canary health without needing custom metrics.

Answer

Create a custom CloudWatch metric for canary failures.

Answer

Enable detailed monitoring on the canary.