SOA-C02 Practice Test 38 — 15 Questions

Question 1

An application runs on c5.xlarge EC2 instances 24 hours a day, 7 days a week in us-east-1. The workload is stable and will not change instance type for at least 12 months. The team wants to reduce compute costs by 30 to 40 percent compared to On-Demand pricing. Which purchasing option achieves this with the lowest financial risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Purchase a 1-year Standard Reserved Instance for c5.xlarge in us-east-1 with All Upfront or Partial Upfront payment. A 1-year Standard Reserved Instance (RI) with All Upfront or Partial Upfront payment offers a 30-40% discount over On-Demand pricing for a stable, always-on workload. This option provides the lowest financial risk because it commits to a fixed instance type and region for only one year, matching the workload's stable nature without the flexibility premium of Convertible RIs or the interruption risk of Spot Instances.

Answer

Use Spot Instances with an interruption tolerance of 5 minutes for the workload

Answer

Enable EC2 Auto Scaling with a target tracking policy to scale down to zero instances during off-peak hours

Answer

Purchase a 3-year Convertible Reserved Instance to maximize the discount percentage

Question 2

A company uses AWS CloudFormation to deploy a multi-tier application. The template uses nested stacks. One of the nested stacks creates an Auto Scaling group. The administrator wants to update the Auto Scaling group's launch configuration to use a new AMI ID. The AMI ID is stored in AWS Systems Manager Parameter Store. The administrator wants to ensure that the stack update automatically uses the latest AMI ID value from Parameter Store. What should the administrator do?

Accepted Answer

Use a CloudFormation dynamic reference to the parameter store in the template.. CloudFormation dynamic references for Systems Manager Parameter Store (using the `{{resolve:ssm:/parameter-name}}` syntax) automatically resolve the latest parameter value at stack creation or update time. This ensures that the launch configuration always uses the current AMI ID from Parameter Store without manual intervention or hardcoding.

Answer

Use a CloudFormation mapping to map the AMI ID.

Answer

Use a custom resource to call Systems Manager to retrieve the AMI ID.

Answer

Use a CloudFormation parameter with a default value that matches the AMI ID.

Question 3

A SysOps Administrator needs to automate the deployment of a three-tier web application on AWS. The application consists of a web tier, application tier, and database tier. The administrator wants to use AWS CloudFormation to provision the infrastructure. Which TWO resources should be included in the CloudFormation template to ensure the application is highly available across multiple Availability Zones?

Accepted Answer

Auto Scaling group. Option A (Auto Scaling group) is correct because it distributes EC2 instances across multiple Availability Zones within a region and automatically replaces unhealthy instances, providing high availability and elasticity for the web and application tiers. Option E (Application Load Balancer) is correct because it is a regional, multi-AZ load balancer that routes traffic to healthy targets in multiple Availability Zones, which is essential for a highly available three-tier architecture. Option B (NAT Gateway) only provides outbound internet access for private subnets and does not by itself deliver multi-AZ high availability. Option C (Amazon S3 bucket) is object storage and is not the mechanism for achieving multi-AZ compute availability. Option D (Amazon Route 53 hosted zone) provides DNS resolution and can support failover routing, but it is not the resource that ensures the application's tiers are highly available across Availability Zones.

Answer

NAT Gateway

Answer

Amazon S3 bucket

Answer

Amazon Route 53 hosted zone

Question 4

A company is using AWS KMS to encrypt data at rest. Which TWO actions can be taken to audit the usage of a customer managed key?

Accepted Answer

Enable AWS CloudTrail to log KMS API calls.. AWS CloudTrail captures all KMS API calls (e.g., Encrypt, Decrypt, GenerateDataKey) as events, providing a complete audit trail of who used the key, when, and from which source. By enabling CloudTrail, you can review these logs to audit customer managed key usage. This is the primary method for auditing KMS key operations.

Answer

Enable Amazon S3 server access logs to track KMS operations.

Answer

Use IAM Access Analyzer to review KMS key policies.

Answer

Use AWS Config rules to monitor KMS key usage.

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket to store logs. The instance currently has no internet access. The SysOps administrator has created a VPC endpoint for S3 (gateway type) and attached it to the VPC. The instance still cannot reach S3. What additional step is required?

Accepted Answer

Add a route in the private subnet's route table pointing to the S3 endpoint. After creating a gateway VPC endpoint for S3, you must add a route in the subnet's route table that points S3 traffic (using the prefix list pl-xxxxxxxx for S3) to the endpoint. Without this route, the private subnet has no path to the endpoint, so the instance cannot reach S3. The gateway endpoint is not automatically added to route tables; it must be explicitly associated.

Answer

Attach an Internet Gateway to the VPC and add a route to it

Answer

Add a security group rule to allow outbound HTTPS traffic to S3

Answer

Modify the endpoint policy to allow all S3 actions

Question 6

A company wants to monitor the performance of its EC2 instances and receive alerts when CPU utilization exceeds 80% for 10 minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch can monitor CPU utilization metrics for EC2 instances and trigger alarms when a threshold (e.g., 80% for 10 minutes) is exceeded. Option B (AWS CloudTrail) is wrong because it records API activity, not performance metrics. Option C (AWS Config) is wrong because it evaluates resource configurations, not performance. Option D (VPC Flow Logs) is wrong because it captures network traffic information, not CPU usage.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

VPC Flow Logs

Question 7

A company is using Amazon Route 53 with a private hosted zone for internal DNS resolution within a VPC. The VPC is connected to an on-premises network via a VPN. On-premises resources cannot resolve DNS names in the private hosted zone. Which TWO actions should be taken to resolve this issue? (Choose two.)

Accepted Answer

Enable DNS resolution and DNS hostnames for the VPC.. To allow on-premises resources to resolve DNS names in a private hosted zone, you need to create a Route 53 inbound resolver endpoint in the VPC (option E). This endpoint allows DNS queries from on-premises to be forwarded to Route 53. Additionally, you must enable DNS resolution and DNS hostnames for the VPC (option C) to ensure that the VPC's DNS settings support internal resolution. Option A is incorrect because route propagation affects network routing, not DNS resolution. Option B is incorrect because private hosted zones cannot be associated with on-premises networks directly. Option D is incorrect because a public hosted zone is used for public DNS and does not resolve private DNS queries.

Answer

Configure route propagation from the VPN to the VPC's route table.

Answer

Associate the private hosted zone with the on-premises network.

Answer

Create a public hosted zone with the same name and associate it with the VPC.

Question 8

A SysOps administrator notices that traffic from an Application Load Balancer to targets is failing intermittently. The targets are EC2 instances in an Auto Scaling group. The health check settings on the target group are: ping path '/health', healthy threshold 2, unhealthy threshold 2, timeout 5 seconds, interval 30 seconds. Which change would most likely improve the stability of the health checks?

Accepted Answer

Increase the unhealthy threshold to 5.. Increasing the unhealthy threshold reduces flapping; currently 2 consecutive failures mark an instance unhealthy, which may be too sensitive. Option A is wrong because a longer interval would delay detection. Option B is wrong because a shorter timeout may cause false positives. Option C is wrong because decreasing healthy threshold increases sensitivity.

Answer

Increase the interval to 60 seconds.

Answer

Decrease the healthy threshold to 1.

Answer

Decrease the timeout to 2 seconds.

Question 9

An organization needs to encrypt data in transit between an Amazon EC2 instance and an Application Load Balancer (ALB). Which THREE actions should be taken?

Accepted Answer

Ensure the EC2 instance has a valid SSL/TLS certificate installed.. Encrypting data in transit between an EC2 instance and an Application Load Balancer requires the EC2 instance to present a valid SSL/TLS certificate. This allows the ALB to establish a secure HTTPS connection with the instance over the backend (target group) port, ensuring that traffic between the ALB and the instance is encrypted using TLS.

Answer

Enable encryption at rest on the EC2 instance's EBS volumes.

Answer

Configure the security group to allow only encrypted traffic.

Question 10

A company runs a production application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application uses an RDS for PostgreSQL database. The SysOps administrator has configured a read replica in a different AWS Region for disaster recovery. During a disaster, the primary region becomes unavailable. The administrator promotes the read replica to a standalone instance. After promoting, the application fails to connect to the new database because the endpoint changed. The administrator needs to minimize downtime. What should the administrator do to handle the endpoint change automatically?

Accepted Answer

Use Amazon Route 53 with a weighted alias record that points to the primary database endpoint, and configure a health check to fail over to the secondary endpoint.. By using Amazon Route 53 with a weighted alias record that points to the primary database endpoint and configuring a health check, the administrator can automate DNS failover. When the primary region becomes unavailable, the health check fails, and Route 53 automatically routes traffic to the secondary record that points to the promoted read replica's endpoint. This minimizes downtime. Option A is wrong because Elastic IP addresses cannot be assigned to RDS instances; they are used for EC2 instances. Option C is wrong because manually updating application configuration files would increase downtime and is not automatic. Option D is wrong because an RDS proxy does not automatically update the endpoint after a disaster recovery promotion; it still requires the endpoint to be changed in the application configuration.

Answer

Assign an Elastic IP address to the RDS instance.

Answer

Update the application configuration files to point to the new endpoint.

Answer

Use an RDS proxy and configure it to automatically failover to the promoted replica.

Question 11

A SysOps administrator is investigating a security incident where an unauthorized key pair was created. The CloudTrail lookup command output is shown. The administrator wants to find the source IP address of the 'admin' user who created the key pair. Which field in the 'CloudTrailEvent' JSON should the administrator examine?

Accepted Answer

sourceIPAddress. The source IP address of the API call is recorded in the 'sourceIPAddress' field within the CloudTrail event JSON. Therefore, option C is correct. Option A (requestParameters) contains the parameters of the request, not the IP. Option B (userIdentity) contains information about the user identity, not the IP. Option D (eventTime) is the timestamp.

Answer

requestParameters

Answer

userIdentity

Answer

eventTime

Question 12

A company uses AWS Shield Advanced to protect against DDoS attacks. Which of the following are benefits of AWS Shield Advanced? (Choose TWO.)

Accepted Answer

24/7 access to the DDoS Response Team (DRT). AWS Shield Advanced provides enhanced DDoS protection for resources like EC2, ELB, CloudFront, and Route 53 (option E), and includes 24/7 access to the DDoS Response Team (DRT) (option A). Option B is incorrect because Shield Advanced is not free; it has a monthly cost. Option C is incorrect because integration with AWS WAF is not a direct benefit of Shield Advanced; WAF is a separate service that can be used alongside Shield but is not a benefit of Shield Advanced itself. Option D is incorrect because automatic scaling is not a direct benefit of Shield Advanced; it is handled by other AWS services like Auto Scaling.

Answer

Free for all AWS accounts

Answer

Integration with AWS WAF to create custom rules

Answer

Automatic scaling of resources during an attack

Question 13

A company has a VPC with multiple subnets. An EC2 instance in a public subnet needs to communicate with an RDS database in a private subnet. The RDS security group allows inbound traffic from the EC2 instance's security group. However, the EC2 instance cannot connect. What is the most likely cause?

Accepted Answer

The VPC does not have DNS resolution enabled, so the RDS endpoint cannot be resolved.. The RDS database is in a private subnet and its endpoint is a DNS name. If DNS resolution is disabled on the VPC, the EC2 instance cannot resolve the RDS endpoint's hostname to an IP address, preventing the TCP connection from being established even though security group rules are correctly configured.

Answer

The network ACL for the private subnet blocks inbound traffic from the public subnet.

Answer

The security group of the RDS database does not allow outbound traffic.

Answer

The EC2 instance does not have a public IP address.

Question 14

A company wants to provide low-latency access to static content (images, CSS) for global users. The content is stored in an S3 bucket. Which service should be used to cache content at edge locations?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (e.g., images, CSS) at edge locations worldwide, providing low-latency access to global users. It integrates directly with S3 as an origin, allowing you to serve content from edge caches while reducing load on the S3 bucket. This makes CloudFront the correct choice for caching static content at edge locations.

Answer

Amazon ElastiCache

Answer

S3 Transfer Acceleration

Answer

AWS Global Accelerator

Question 15

A SysOps Administrator is configuring VPC Flow Logs to monitor network traffic. Which THREE pieces of information are included in VPC Flow Log records?

Accepted Answer

Protocol number. VPC Flow Logs capture metadata about network traffic, including source IP address (C), destination IP address (E), and protocol number (B). They do not include HTTP status codes (A) or DNS query names (D), as those are application-layer details beyond the scope of network flows.

Answer

HTTP status code

Answer

DNS query name