SOA-C02 Practice Test 36 — 15 Questions

Question 1

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which configuration ensures that traffic is distributed evenly across all healthy targets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable cross-zone load balancing on the ALB. Cross-zone load balancing enables the ALB to distribute incoming traffic evenly across all healthy targets in all enabled Availability Zones, rather than sending traffic only to targets within the same zone as the requesting client. By default, ALBs distribute traffic equally across zones first, then round-robin within each zone, which can lead to uneven load if target counts differ per zone. Enabling cross-zone load balancing overrides this behavior, ensuring each healthy target receives an equal share of requests regardless of its zone.

Answer

Configure sticky sessions (session affinity) on the target group

Answer

Use a Network Load Balancer with path-based routing

Answer

Enable connection draining on the target group

Question 2

A SysOps administrator is monitoring an Amazon ECS cluster running Fargate tasks. The administrator wants to receive a notification when any task fails to start due to insufficient memory. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Configure the CloudWatch Events rule to send notifications to an SNS topic.. Amazon CloudWatch Events (now Events) can trigger an SNS notification when a specific ECS task state change occurs. Option C is correct because you can create a CloudWatch Events rule that matches ECS task state changes with a reason of 'RESOURCE:MEMORY', which indicates the task failed to start due to insufficient memory. Together, these actions ensure you receive a notification when a Fargate task fails to start due to memory constraints.

Answer

Enable AWS CloudTrail and create a metric filter for RunTask API calls.

Answer

Create a CloudWatch alarm on the ECS cluster's CPUUtilization metric.

Answer

Enable CloudWatch Logs for the ECS cluster and filter for error messages.

Question 3

A SysOps administrator is troubleshooting DNS resolution issues for a custom domain used by an Application Load Balancer. Which TWO steps should the administrator take to diagnose the issue? (Choose two.)

Accepted Answer

Verify that the Route 53 alias record points to the ALB's DNS name. A Route 53 alias record must point to the ALB's DNS name (e.g., my-alb-1234567890.us-east-1.elb.amazonaws.com) to properly route traffic to the load balancer. If the alias record is misconfigured or points to an incorrect resource, DNS resolution will fail or resolve to an unintended IP, causing the custom domain not to work.

Answer

Ensure the VPC's CIDR block does not overlap with the ALB's IP range

Answer

Verify that the ALB's security group allows inbound traffic on port 443

Answer

Check the health status of the ALB's target group

Question 4

A SysOps administrator needs to reduce costs for an Amazon RDS for MySQL DB instance that is used for development. The instance is only needed during business hours (9 AM to 5 PM) on weekdays. Which solution is the MOST cost-effective while maintaining the ability to start and stop the instance on a schedule?

Accepted Answer

Use AWS Instance Scheduler to stop and start the RDS instance on a schedule.. AWS Instance Scheduler is a fully managed solution designed specifically to start and stop RDS instances on a defined schedule, such as weekdays from 9 AM to 5 PM. This eliminates compute costs during non-business hours while preserving the instance's storage and configuration, making it the most cost-effective and reliable approach for a development environment.

Answer

Create a read replica and promote it when needed.

Answer

Purchase a reserved instance for the DB instance.

Answer

Use a Lambda function to stop the instance at 5 PM and start it at 9 AM on weekdays.

Question 5

An application running on an EC2 instance writes logs to a local file. The operations team needs to monitor these logs in near real-time for troubleshooting. Which solution provides the most efficient way to stream these logs to CloudWatch Logs?

Accepted Answer

Install the CloudWatch Logs agent on the instance and configure it to tail the log file.. The CloudWatch Logs agent (or the newer unified CloudWatch agent) is designed specifically to tail log files from EC2 instances and stream them to CloudWatch Logs in near real-time. This provides the most efficient solution because it continuously monitors the file for new entries and sends them with minimal latency, without requiring periodic uploads or complex event-driven pipelines.

Answer

Use the AWS CLI to periodically upload the log file using the put-log-events command.

Answer

Install the Amazon Kinesis Agent on the instance and configure it to send logs to CloudWatch Logs.

Answer

Configure the application to write logs to an S3 bucket and use S3 Event Notifications to trigger a Lambda function that puts logs to CloudWatch.

Question 6

A SysOps administrator needs to reduce costs for a fleet of EC2 instances that run a stateless web application. The instances are currently On-Demand. The workload runs 24/7 for the next 12 months. Which pricing model provides the greatest cost savings?

Accepted Answer

Purchase Standard Reserved Instances for a 1-year term.. Standard Reserved Instances (RIs) for a 1-year term provide a significant discount (up to 40%) over On-Demand pricing for workloads that run continuously 24/7. Since this stateless web application runs constantly for the next 12 months, Standard RIs offer the greatest cost savings among the options, as they are designed for steady-state usage and do not require flexibility in instance family or operating system.

Answer

Use Dedicated Hosts.

Answer

Use Spot Instances.

Answer

Purchase Convertible Reserved Instances for a 1-year term.

Question 7

An application running on EC2 instances stores session data in an attached EBS volume. The company wants to ensure session data is not lost if an instance fails. Which solution should the administrator implement?

Accepted Answer

Move session storage to Amazon ElastiCache for Redis with replication.. Amazon ElastiCache for Redis with replication provides a highly available, in-memory data store that persists session data independently of EC2 instances. If an instance fails, the session data remains intact in the replicated Redis cluster, ensuring zero data loss and seamless failover. This decouples session state from ephemeral compute resources, aligning with the reliability and business continuity requirements.

Answer

Use EBS Multi-Attach to attach the volume to multiple instances.

Answer

Take frequent EBS snapshots of the volume.

Answer

Use a larger EC2 instance type with more memory.

Question 8

Which THREE AWS services can be used to monitor and optimize costs? (Choose THREE.)

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor provides cost optimization recommendations by analyzing your AWS environment and identifying idle resources, underutilized instances, and reserved instance opportunities. It offers specific checks like 'Low Utilization Amazon EC2 Instances' and 'Idle Load Balancers' that directly help reduce spending.

Answer

AWS Shield

Answer

AWS CloudFormation

Question 9

A company has an S3 bucket that stores sensitive data. The security team requires that all access to the bucket be encrypted in transit. Which TWO actions should be taken to enforce this requirement? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm for any HTTP access. Enabling AWS CloudTrail to log all S3 API calls and setting up a CloudWatch alarm for any HTTP access allows the security team to detect and alert on any access that is not encrypted in transit (i.e., HTTP instead of HTTPS). This provides monitoring and incident response capability to enforce the encryption-in-transit requirement.

Answer

Enable default encryption (SSE-S3) on the bucket

Answer

Enable S3 Transfer Acceleration

Answer

Use S3 VPC endpoints

Question 10

Refer to the exhibit. A SysOps administrator creates a CloudFormation stack with the template shown. After 30 days, what happens to noncurrent versions of objects in the bucket?

Accepted Answer

They are permanently deleted.. The CloudFormation template configures an S3 bucket with a lifecycle rule that sets 'NoncurrentVersionExpirationInDays' to 30. This rule permanently deletes noncurrent versions of objects after 30 days, as S3 lifecycle policies for noncurrent versions do not transition to other storage classes unless explicitly specified with a separate transition action. After 30 days, the noncurrent versions are removed from the bucket entirely.

Answer

They are moved to Amazon S3 Glacier.

Answer

They become the current version.

Answer

They are moved to Amazon S3 Standard-Infrequent Access.

Question 11

A company runs a production database on Amazon RDS for MySQL with Multi-AZ enabled. During a recent Availability Zone outage, the database experienced a failover. After the failover, the application team notices that the database endpoint in the connection string no longer works. What is the most likely cause?

Accepted Answer

The application is using the IP address of the database instance instead of the DNS endpoint.. When Multi-AZ failover occurs, RDS updates the DNS CNAME record to point to the new primary instance in a different Availability Zone. If the application uses the IP address directly instead of the DNS endpoint, it will continue to resolve to the old (now failed) instance's IP, which is no longer accessible. The DNS endpoint is the only stable reference that automatically follows the failover.

Answer

The DB instance identifier changed after the failover.

Answer

The security group for the RDS instance was modified during the failover.

Answer

The DNS CNAME record for the RDS endpoint was manually changed.

Question 12

A company has deployed a global web application using AWS CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is in a single AWS region. Users in different geographic regions report high latency, and some users are unable to access the application. The SysOps administrator verifies that the CloudFront distribution is configured correctly and that the ALB is healthy. The administrator also confirms that the ALB's security group allows traffic from the CloudFront IP ranges. What is the most likely cause of the issue?

Accepted Answer

The ALB is overwhelmed by the number of concurrent connections from CloudFront. The ALB in a single region can become overwhelmed by the high volume of concurrent connections from CloudFront's global edge locations, even though the security group allows traffic from CloudFront IP ranges. This can cause high latency and access failures for users in different regions. Option B is incorrect because CloudFront caching typically reduces the load on the origin by serving cached content at edge locations. Option C is incorrect because CloudFront distributions support HTTP and HTTPS protocols, not TCP/UDP, and the protocol used does not explain the regional latency issue. Option D is incorrect because the SSL/TLS certificate on the ALB must be trusted by CloudFront for HTTPS connections, but this would not cause intermittent access issues across regions if the distribution is configured correctly.

Answer

CloudFront is not caching content, causing all requests to go to the origin

Answer

The CloudFront distribution is using TCP instead of HTTP, causing higher latency

Answer

The SSL/TLS certificate on the ALB is not trusted by CloudFront

Question 13

Refer to the exhibit. A SysOps administrator ran the describe-stack-events command for a CloudFormation stack named 'my-stack'. The stack creation failed with 'Resource creation cancelled'. What is the most likely reason?

Accepted Answer

The nested stack creation timed out and was cancelled.. When a CloudFormation stack creation fails with 'Resource creation cancelled', it typically indicates that a nested stack creation was cancelled due to a timeout. CloudFormation sets a default timeout of 60 minutes for stack creation; if a nested stack does not complete within that period, the parent stack cancels the nested stack creation and reports this error. This is distinct from manual cancellation, which would show a different status.

Answer

The stack creation was manually cancelled by the administrator.

Answer

The IAM role for the stack does not have sufficient permissions.

Answer

The nested stack creation failed due to an invalid template.

Question 14

A company runs a production database on Amazon RDS for PostgreSQL. The SysOps administrator wants to improve query performance for a read-heavy application without increasing costs significantly. Which THREE actions should the administrator take? (Choose three.)

Accepted Answer

Optimize slow queries by reviewing the slow query log. Reviewing the slow query log in RDS for PostgreSQL allows the administrator to identify and optimize poorly performing queries, which directly improves query performance without incurring additional infrastructure costs. This is a standard performance tuning practice that targets the root cause of read-heavy application slowdowns.

Answer

Enable Multi-AZ deployment

Answer

Increase the allocated storage size

Question 15

A SysOps administrator needs to create a custom Amazon CloudWatch metric to track the number of active user sessions from application logs. The administrator wants to publish this metric to CloudWatch and set an alarm when the count exceeds a threshold. Which solution should be used?

Accepted Answer

Use a CloudWatch Logs Metric Filter on the log group.. CloudWatch Logs Metric Filters allow you to define a filter pattern that matches specific log events (e.g., 'User session started') and convert them into a custom metric. The metric is automatically published to CloudWatch, where you can set an alarm on the count of matching log entries. This is the standard, cost-effective approach for extracting metrics from application logs without modifying the application code.

Answer

Use CloudWatch Contributor Insights to extract the metric from logs.

Answer

Use CloudWatch Synthetics Canary to simulate user sessions and publish metrics.

Answer

Use CloudWatch Embedded Metric Format to have the application publish metrics directly.