SOA-C02 Practice Test 39 — 15 Questions

Question 1

A company is designing a disaster recovery plan for its on-premises database. They need to replicate the database to AWS with low latency. Which AWS service should they use?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication.. AWS DMS with ongoing replication (change data capture, CDC) is the correct choice because it can continuously replicate changes from an on-premises database to a target database in AWS with low latency, supporting heterogeneous and homogeneous migrations. This meets the requirement for a disaster recovery plan that keeps the AWS copy nearly synchronized with the on-premises source.

Answer

Amazon S3 with Cross-Region Replication.

Answer

AWS Storage Gateway with volume gateway.

Answer

AWS Direct Connect to establish a dedicated network connection.

Question 2

A company is running a web application on EC2 instances behind an Application Load Balancer. They want to ensure that if an entire Availability Zone fails, the application remains available. Which configuration should they implement?

Accepted Answer

Configure the Auto Scaling group to launch instances in multiple Availability Zones.. To ensure application availability during an entire Availability Zone (AZ) failure, the Auto Scaling group must be configured to launch EC2 instances across multiple AZs. This distributes the workload so that if one AZ becomes unavailable, the remaining AZs continue serving traffic. The Application Load Balancer (ALB) automatically routes requests only to healthy instances in the surviving AZs, maintaining application uptime.

Answer

Use an RDS Multi-AZ deployment for the application.

Answer

Use a larger EC2 instance type.

Answer

Enable detailed monitoring on the EC2 instances.

Question 3

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an email notification when the metric exceeds 90% for 5 consecutive minutes. The solution should use the least operational overhead. Which combination of AWS services should be used?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric and configure the alarm to send a notification to an Amazon SNS topic with email subscriptions.. A CloudWatch alarm directly monitors the CPUUtilization metric for an EC2 instance and can be configured to evaluate whether the metric exceeds 90% for 5 consecutive minutes (e.g., 5 evaluation periods of 1 minute each). The alarm then publishes to an Amazon SNS topic, which sends email notifications to subscribed endpoints, requiring no additional infrastructure or code, thus minimizing operational overhead.

Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to check the CPUUtilization metric and send an email via Amazon SES.

Answer

Configure the EC2 instance to publish CPU logs to Amazon CloudWatch Logs, then create a metric filter to detect high CPU and trigger an SNS notification.

Answer

Use AWS CloudTrail to monitor EC2 CPU metrics and send notifications to an Amazon SQS queue.

Question 4

A SysOps administrator is designing a disaster recovery strategy for a critical application that runs on EC2 instances. The application data is stored on EBS volumes. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 1 hour. Which solution meets these requirements MOST cost-effectively?

Accepted Answer

Take EBS snapshots every 15 minutes and copy them to another Region using cross-region snapshot copy.. Taking EBS snapshots every 15 minutes and using cross-region snapshot copy meets the 15-minute RPO and 1-hour RTO while being the most cost-effective. EBS snapshots are incremental, storing only changed blocks, which minimizes storage costs compared to full AMIs. Cross-region snapshot copy ensures data is available in another Region for recovery within the RTO.

Answer

Use AWS CloudEndure to continuously replicate the EC2 instances to another Region.

Answer

Use AWS Backup to back up the application data to Amazon S3 every 15 minutes.

Answer

Take hourly AMIs of the instances and copy them to another Region.

Question 5

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a deployment stage that uses AWS CloudFormation to deploy infrastructure. The company wants to add a manual approval step before the CloudFormation deployment. How should this be configured?

Accepted Answer

Add a manual approval action in the pipeline before the CloudFormation deployment stage.. AWS CodePipeline natively supports a manual approval action that pauses the pipeline until a designated approver reviews and approves or rejects the action. Placing this action in the pipeline immediately before the CloudFormation deployment stage is the correct, built-in way to add a manual gate.

Answer

Add a CloudFormation change set action before the deployment.

Answer

Configure an Amazon SNS topic to send a notification and require a confirmation.

Answer

Use an AWS Lambda function to send an email and wait for a response.

Question 6

A company runs 200 EC2 Linux instances across three accounts. The security team requires that critical OS patches are applied automatically every Sunday at 2 AM UTC. Currently patches are applied manually and inconsistently. What is the recommended AWS-native solution?

Accepted Answer

Configure a Patch Manager patch baseline and maintenance window scheduled for Sunday 02:00 UTC; associate the Run Patch Baseline task with all EC2 instance targets. AWS Systems Manager Patch Manager, combined with a Maintenance Window, provides a fully AWS-native, automated solution for patching EC2 instances on a schedule. The Patch Manager service uses a patch baseline to define which patches are approved (e.g., critical OS patches), and the Maintenance Window triggers the 'AWS-RunPatchBaseline' SSM document at the specified time (Sunday 02:00 UTC) against all targeted instances. This eliminates manual effort and ensures consistent, auditable patching across multiple accounts and instances.

Answer

Create a cron job on each instance that runs 'yum update -y' every Sunday at 2 AM

Answer

Use AWS Config managed rules to detect unpatched instances and send SNS notifications for manual remediation

Answer

Build a CodePipeline that runs weekly, creates new AMIs with the latest patches, and replaces all instances via an Auto Scaling instance refresh

Question 7

A company runs a web application on EC2 instances with Elastic Load Balancing. They notice that costs are higher than expected. What is the MOST cost-effective way to optimize costs while maintaining high availability?

Accepted Answer

Use a combination of Reserved Instances for baseline traffic and On-Demand for spikes.. Reserved Instances provide a significant discount (up to ~72% versus On-Demand) in exchange for a one- or three-year commitment, making them ideal for the predictable baseline load. On-Demand instances then absorb traffic spikes without a long-term commitment, so the workload stays highly available while the blended cost is minimized. This hybrid model is the standard AWS cost-optimization pattern for steady-state web tiers behind an ELB.

Answer

Use Spot Instances for all traffic.

Answer

Use On-Demand instances for all traffic.

Answer

Reduce the number of instances to one.

Question 8

A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?

Accepted Answer

Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.. Placing a Network Load Balancer (NLB) in front of the ALB allows Global Accelerator to terminate the TCP connection at the edge, then forward traffic to the NLB. The NLB preserves the original client IP address by default (since it operates at Layer 4 and does not terminate the connection), and the ALB can still read the client IP from the X-Forwarded-For header. This setup meets both the performance requirement (via Global Accelerator's edge routing) and the logging requirement (preserving the original client IP).

Answer

Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.

Answer

Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.

Answer

Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.

Question 9

An EC2 instance runs a database on a 2 TB EBS gp3 volume. After a corruption event, the team must restore from a snapshot. When they detach the corrupted volume, attach a new volume restored from the snapshot, and start the database, performance is 10 to 20 times lower than normal for the first two hours. What causes this behavior, and what feature eliminates it?

Accepted Answer

Enable Fast Snapshot Restore (FSR) on the snapshot in the target Availability Zone before creating the replacement volume. When you create an EBS volume from a snapshot, the volume's data blocks are lazily loaded from Amazon S3 on first access. This causes high latency and low IOPS until all blocks are fetched. Fast Snapshot Restore (FSR) pre-initializes the volume in a specific Availability Zone, eliminating the need for lazy loading and providing full performance immediately.

Answer

Use a Provisioned IOPS (io2) volume type instead of gp3 to get higher IOPS during initialization

Answer

Run a full dd or fio pre-warm pass over the volume after attaching it but before starting the database

Answer

Increase the EBS volume size to 4 TB when restoring from the snapshot to get double the throughput baseline

Question 10

Drag and drop the steps to troubleshoot an unhealthy target in an Application Load Balancer target group into the correct order.

Accepted Answer

Verify security group rules allow traffic from the ALB, then verify health check settings (path, port, protocol), then check instance status and application health, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.. Troubleshooting starts with security group rules, then health check configuration, then instance and application status, then logs, and finally replacement if needed.

Answer

Verify health check settings (path, port, protocol), then verify security group rules, then check instance status and application health, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.

Answer

Check instance status and application health, then verify security group rules, then verify health check settings, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.

Answer

Review ALB access logs and CloudWatch metrics, then verify security group rules, then verify health check settings, then check instance status and application health, then replace the target instance if necessary.

Question 11

Drag and drop the steps to configure a VPC peering connection between two VPCs into the correct order.

Accepted Answer

Step 1: Create the peering request, Step 2: Accept the peering request, Step 3: Update route tables in both VPCs, Step 4: Adjust security groups.. First create the peering request, then accept it, then update route tables in both VPCs, and finally adjust security groups.

Answer

Step 1: Create the peering request, Step 2: Update route tables in both VPCs, Step 3: Accept the peering request, Step 4: Adjust security groups.

Answer

Step 1: Accept the peering request, Step 2: Create the peering request, Step 3: Update route tables in both VPCs, Step 4: Adjust security groups.

Answer

Step 1: Update route tables in both VPCs, Step 2: Create the peering request, Step 3: Accept the peering request, Step 4: Adjust security groups.

Question 12

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda. It uses Amazon CloudWatch alarms to monitor CPU utilization metrics and trigger an SNS topic, which then invokes an AWS Lambda function. The Lambda function can execute the logic to stop the EC2 instance when the alarm state indicates CPU utilization above 90% for 30 minutes, providing automated cost control without manual intervention.

Answer

Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation

Answer

Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions

Answer

AWS CloudTrail + Amazon EventBridge + AWS CodePipeline

Question 13

Drag and drop the steps to enable AWS CloudTrail logging for a specific S3 bucket into the correct order.

Accepted Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.. First create a log bucket with proper policy, then create the trail and configure it to log events for the target bucket.

Answer

Step 2: Create a CloudTrail trail.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.

Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 2: Create a CloudTrail trail.

Answer

Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.

Question 14

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning. AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Answer

Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning

Answer

Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action

Answer

Use AWS Service Catalog to enforce versioning on all buckets provisioned through it

Question 15

A media company stores millions of video files in S3. Some files are accessed heavily after upload (when new) and rarely afterward; others are accessed unpredictably across months. The team cannot predict which files will be accessed and when. They want to minimize storage costs without risking retrieval latency penalties or per-object retrieval fees. Which storage class is appropriate?

Accepted Answer

Use S3 Intelligent-Tiering so objects automatically move between Frequent and Infrequent Access tiers based on access patterns, with no retrieval fees. S3 Intelligent-Tiering is the correct choice because it automatically moves objects between Frequent Access and Infrequent Access tiers based on changing access patterns, with no retrieval fees and no performance impact (millisecond latency). This matches the unpredictable access pattern described, as the service monitors access at the object level and adjusts storage tier without manual lifecycle rules or retrieval costs.

Answer

Use S3 Standard-IA and configure a lifecycle policy to move objects back to Standard after every access

Answer

Use S3 Glacier Instant Retrieval for all objects because it offers the lowest storage cost with millisecond retrieval

Answer

Use S3 Standard for all objects because it has no retrieval fees and provides the best availability