SOA-C02 Practice Test 37 — 15 Questions

Question 1

Which TWO of the following are features of Amazon Route 53? (Select TWO.)

Accepted Answer

Health checking of resources. Amazon Route 53 is a DNS web service that provides domain name resolution, domain registration, and health checking of resources. Health checking monitors the availability and performance of endpoints (e.g., web servers) via HTTP/HTTPS/TCP requests, and can automatically failover DNS responses to healthy resources, ensuring high availability.

Answer

SSL/TLS termination

Answer

SSL certificate management

Answer

Content caching at edge locations

Question 2

A company runs a production workload on a fleet of EC2 instances in an Auto Scaling group (ASG). The ASG spans three Availability Zones. To avoid regional failure, the company wants to replicate the infrastructure in a second AWS Region and be able to fail over within 30 minutes. The application state is stored in an RDS MySQL database. What is the MOST cost-effective and reliable solution?

Accepted Answer

Create a cross-Region read replica of the RDS database. In the secondary Region, deploy a duplicate ASG and ALB. In a disaster, promote the read replica to a standalone instance and update Route 53 DNS.. It provides a cost-effective and reliable disaster recovery solution that meets the 30-minute failover requirement. A cross-Region read replica of RDS MySQL allows you to maintain an up-to-date copy of the database in the secondary Region with minimal cost (only paying for the replica instance and data transfer). In a disaster, you can promote the read replica to a standalone instance in minutes, and with a pre-deployed ASG and ALG in the secondary Region, you can update Route 53 DNS to redirect traffic, achieving failover within the required timeframe.

Answer

Use an Application Load Balancer with cross-Region load balancing to distribute traffic to both Regions.

Answer

Use RDS Multi-AZ in both Regions and configure synchronous replication between them.

Answer

Take daily snapshots of the RDS database and copy them to the secondary Region. In the event of a failure, restore the latest snapshot.

Question 3

A company runs a stateless web application on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application experiences increased latency during peak hours. The SysOps administrator needs to improve the application's performance and reliability. Which action should be taken?

Accepted Answer

Increase the maximum instance count in the Auto Scaling group.. Increasing the maximum instance count allows the Auto Scaling group to launch more EC2 instances during peak hours, distributing the load across more resources and reducing latency. This directly improves both performance (by handling more requests) and reliability (by maintaining capacity under increased demand).

Answer

Use larger EC2 instance types instead of smaller ones.

Answer

Reduce the Auto Scaling group's cooldown period to scale out faster.

Answer

Change the scaling metric from CPU utilization to memory utilization.

Question 4

A company has a VPC with public and private subnets. An Application Load Balancer (ALB) is deployed in the public subnets, and an Auto Scaling group of web servers is deployed in the private subnets. The web servers need to frequently make HTTPS requests to an external API. The API provider requires that all requests originate from a consistent set of static IP addresses for whitelisting. The SysOps administrator must ensure that outbound traffic from the web servers has static source IP addresses. Which solution should be implemented?

Accepted Answer

Deploy a NAT gateway in a public subnet with an Elastic IP and route outbound traffic from the private subnets through the NAT gateway.. A NAT gateway placed in a public subnet with an Elastic IP provides a consistent, static source IP for all outbound traffic from instances in private subnets. The web servers route their outbound HTTPS requests through the NAT gateway, which performs source NAT (SNAT) using the Elastic IP, satisfying the API provider's whitelisting requirement. This design keeps the web servers in private subnets for security while ensuring a fixed public IP for outbound traffic.

Answer

Place the web servers in public subnets and assign each instance an Elastic IP address.

Answer

Create a VPC endpoint for the external API service.

Answer

Use AWS Global Accelerator to provide static IP addresses for outbound traffic.

Question 5

Match each AWS support plan to its key feature.

Accepted Answer

Basic: Access to AWS Support Community and forums. Basic provides community access, Developer provides business hours email, Business provides 24/7 support with 1-hour response, and Enterprise adds a TAM and faster response. Common confusions include swapping Business and Enterprise features.

Answer

Enterprise: 24/7 phone, email, and chat with 1-hour response to impaired production systems

Answer

Developer: 15-minute response to business-critical systems and a Technical Account Manager

Question 6

Refer to the exhibit. A SysOps administrator runs the command to find 'CreateKeyPair' events in January 2023 but gets an empty list. The administrator knows that key pairs were created during that time. What is the most likely reason?

Accepted Answer

The events occurred in a different AWS region.. The `aws cloudtrail lookup-events` command returns events only from the region specified in the AWS CLI configuration (or the `--region` parameter). If the administrator did not specify a region, the command defaults to the region set in the CLI profile. Since `CreateKeyPair` events are regional (each key pair is created in a specific region), the empty result indicates the events occurred in a different AWS region than the one queried.

Answer

The start and end times are outside the 90-day retention period.

Answer

CloudTrail is not enabled in the account.

Answer

The IAM user does not have 'cloudtrail:LookupEvents' permission.

Question 7

A company stores application logs in Amazon S3. The logs are rarely accessed after the first 30 days, but must be retained for 7 years for compliance. The SysOps administrator wants to minimize storage costs while ensuring logs are available for retrieval within 12 hours if needed. Which S3 lifecycle configuration is the most cost-effective?

Accepted Answer

S3 Standard for 30 days, then transition to S3 Glacier Deep Archive. It transitions logs from S3 Standard (for frequent access during the first 30 days) to S3 Glacier Deep Archive, which offers the lowest storage cost for long-term retention. Since logs must be retained for 7 years and only need retrieval within 12 hours, Glacier Deep Archive's 12-hour standard retrieval time meets the requirement while minimizing costs.

Answer

S3 Standard for 30 days, then transition to S3 Glacier (Flexible Retrieval)

Answer

Use S3 Intelligent-Tiering from the start

Answer

S3 Standard for 30 days, then transition to S3 One Zone-IA

Question 8

A company's security policy requires that all Amazon EC2 instances must have a specific tag 'Environment' with a value of either 'Production' or 'Development'. The SysOps administrator needs to detect any instance that is missing this tag or has an invalid value, and automatically email the operations team. Which AWS service should be used to achieve this with the least operational overhead?

Accepted Answer

AWS Config with the 'required-tags' managed rule and Amazon SNS. AWS Config's 'required-tags' managed rule continuously evaluates EC2 instances against the specified tag key and allowed values, triggering an SNS notification when non-compliant resources are detected. This provides automated detection and alerting with minimal operational overhead, as it requires no custom code or infrastructure management.

Answer

Amazon CloudWatch Events with an EC2 instance state change rule and AWS Lambda

Answer

AWS Trusted Advisor with a custom check

Answer

Amazon Inspector with a network assessment

Question 9

A company uses S3 to store critical data. They need to ensure that data can be recovered in the event of accidental deletion or overwriting by users. Which combination of actions should they take?

Accepted Answer

Enable S3 Versioning and MFA Delete.. Enabling S3 Versioning preserves all versions of an object, allowing recovery from accidental deletion or overwriting. MFA Delete adds an extra layer of protection by requiring multi-factor authentication to permanently delete object versions or suspend versioning, preventing unauthorized or accidental permanent data loss.

Answer

Enable S3 Cross-Region Replication and S3 Transfer Acceleration.

Answer

Enable S3 Versioning and S3 Transfer Acceleration.

Answer

Enable S3 Server Access Logging and S3 Object Lock.

Question 10

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. The Auto Scaling group has 4 instances. What should the SysOps administrator check first?

Accepted Answer

Check the Auto Scaling group's health check type and ensure it is set to ELB.. The error message indicates that too few healthy instances are available for deployment. In an Auto Scaling group integrated with CodeDeploy, the health check type must be set to ELB to allow CodeDeploy to use Elastic Load Balancing health checks to determine instance health. If the health check type is set to EC2 (default), CodeDeploy may consider instances healthy even when they are not passing ELB health checks, causing the deployment to fail due to insufficient healthy instances.

Answer

Review the deployment configuration to ensure it allows enough time for deployment.

Answer

Verify that the AppSpec file includes the correct hooks.

Answer

Check the IAM role for CodeDeploy to ensure it has sufficient permissions.

Question 11

A company has a CloudWatch dashboard that displays metrics for several EC2 instances. The SysOps administrator wants to share the dashboard with external stakeholders who do not have AWS accounts. Which actions should the administrator take? (Select TWO.)

Accepted Answer

Use the CloudWatch dashboard sharing feature to make the dashboard public.. Option A is correct because CloudWatch dashboards support a built-in sharing feature that lets you share a dashboard publicly with anyone, including people who do not have AWS accounts, by configuring the dashboard's share settings. Option D is correct because after enabling sharing, CloudWatch generates a shareable URL that can be sent to external stakeholders so they can view the dashboard without signing in to AWS. Options B, C, and E are not appropriate: building a custom EC2 web application is unnecessary and overly complex, creating IAM users requires stakeholders to have AWS accounts and credentials, and exporting to QuickSight is not a supported CloudWatch dashboard sharing mechanism for anonymous external viewers.

Answer

Create a web application that reads CloudWatch metrics and host it on EC2.

Answer

Create IAM users for each stakeholder and assign appropriate permissions.

Answer

Export the dashboard to Amazon QuickSight and share it via email.

Question 12

A SysOps administrator needs to monitor the CPU and memory utilization of an EC2 instance running a legacy application that cannot be modified. Which TWO methods can be used to collect this information? (Choose TWO.)

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect memory metrics.. The CloudWatch agent can be installed on an EC2 instance to collect custom metrics, including memory utilization, which is not available by default from the hypervisor. The agent sends these metrics to CloudWatch using the PutMetricData API, enabling monitoring of in-guest resources like memory and disk.

Answer

Enable detailed monitoring on the instance to get memory metrics.

Answer

Use the EC2 hypervisor metrics available from CloudWatch.

Answer

Use AWS Systems Manager Inventory to collect memory utilization.

Question 13

An organization needs to back up an Amazon EFS file system daily and retain backups for 30 days. Which AWS service provides a managed backup solution for EFS?

Accepted Answer

AWS Backup. AWS Backup is the correct answer because it is a fully managed, policy-based backup service that supports Amazon EFS natively. It allows you to define backup plans with daily schedules and retention rules (e.g., 30 days) without needing to manage any backup infrastructure or scripts. AWS Backup handles the lifecycle of backups, including incremental backups and automatic deletion of expired recovery points.

Answer

Amazon Data Lifecycle Manager (DLM)

Answer

EFS replication to another region

Answer

S3 Lifecycle policies

Question 14

A company runs a web application on Amazon EC2 instances in a single Availability Zone. The SysOps administrator wants to increase the availability of the application so that it can survive an Availability Zone failure. Which action is the most effective?

Accepted Answer

Launch EC2 instances in two different Availability Zones and place them behind an Application Load Balancer.. Deploying EC2 instances across two different Availability Zones and placing them behind an Application Load Balancer (ALB) provides fault isolation. If one AZ fails, the ALB automatically routes traffic to the healthy instances in the other AZ, ensuring the application remains available. This architecture directly addresses the goal of surviving an AZ failure by eliminating the single point of failure at the AZ level.

Answer

Deploy an additional EC2 instance in the same Availability Zone.

Answer

Enable termination protection on all EC2 instances.

Answer

Use an Amazon RDS Multi-AZ deployment for the database tier.

Question 15

A company wants to ensure that its Amazon RDS database can withstand the loss of an entire Availability Zone. Which feature should the SysOps administrator enable?

Accepted Answer

Enable Multi-AZ deployment.. Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, ensuring database availability without manual intervention. This is the only option that directly protects against an entire AZ loss by maintaining a hot standby in a separate AZ.

Answer

Enable automated backups with a retention period of 35 days.

Answer

Take manual snapshots and copy them to another Region.

Answer

Create a read replica in a different Availability Zone.