SOA-C02 Practice Test 4 — 10 Questions

Question 1

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 2

A company runs a production web application on a single Amazon EC2 instance. The application experiences a predictable and steady workload 24/7. The SysOps administrator wants to minimize compute costs for this instance while ensuring it remains available during the expected workload. Which EC2 purchasing option should the administrator use?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the most cost-effective option for a predictable, steady-state workload running 24/7. By committing to a 1- or 3-year term, you receive a significant discount (up to 72%) compared to On-Demand pricing, while still ensuring the instance remains available for the expected workload. This matches the requirement to minimize compute costs without sacrificing availability.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 3

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 4

A company wants to receive alerts when its AWS costs exceed a certain threshold. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets and receive alerts when actual or forecasted costs exceed a defined threshold. It directly supports cost-based alerting with actions such as sending an SNS notification or applying an IAM policy to restrict resources when the budget limit is breached.

Answer

Amazon CloudWatch

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 5

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

Accepted Answer

Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.. A KMS key policy can use the 'aws:SourceVpc' condition key to restrict usage of the key to requests originating from a specific VPC. Option A is incorrect because S3 bucket policies cannot directly restrict KMS key usage; they can only control access to S3 objects. Option C is incorrect because IAM policies can include conditions based on source VPC for certain services, but for KMS actions, the condition must be in the key policy itself, not an IAM policy. Option D is incorrect because network ACLs operate at the subnet level and control network traffic, not API calls to KMS; they cannot restrict access to the KMS service.

Answer

Add a condition in the S3 bucket policy to allow only requests from the VPC.

Answer

Use an IAM policy with a condition that requires the request to come from the VPC.

Answer

Configure a network ACL that blocks all traffic to KMS except from the VPC.

Question 6

A company is using Amazon S3 to store historical data. The data is accessed frequently for the first 30 days, then accessed infrequently for the next 90 days, and after 120 days it is rarely accessed but must be retained for 7 years for compliance. Which S3 lifecycle policy provides the LOWEST cost while meeting these requirements?

Accepted Answer

Standard for 30 days, then transition to Standard-IA for 90 days, then to Glacier Deep Archive.. It aligns the storage class transitions precisely with the access patterns: Standard for frequent access (first 30 days), Standard-IA for infrequent access (next 90 days), and Glacier Deep Archive for long-term retention (after 120 days). This minimizes cost by avoiding paying for premium storage when data is rarely accessed, while still meeting the 7-year compliance requirement at the lowest possible storage cost.

Answer

Standard for 30 days, then transition to One Zone-IA for 90 days, then to Glacier Deep Archive.

Answer

Standard for 120 days, then transition to Glacier Deep Archive.

Answer

Standard for 30 days, then transition to Glacier for the remaining life.

Question 7

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

Accepted Answer

AWS Config with a custom rule and AWS Lambda. AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Answer

AWS CloudTrail and Amazon CloudWatch Events

Answer

AWS Service Catalog and AWS Organizations

Answer

Amazon Inspector and AWS Systems Manager

Question 8

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

Accepted Answer

Perform a rolling update based on health.. A rolling update based on health (Option D) is the correct method to minimize downtime when updating an instance type in Elastic Beanstalk. This approach updates instances in batches, replacing them with the new instance type only after the previous batch passes health checks, ensuring application availability throughout the process. Elastic Beanstalk's rolling update with health-based batching terminates and launches instances incrementally, avoiding full environment disruption.

Answer

Terminate all instances and let the Auto Scaling group launch new ones.

Answer

Perform an immutable update.

Answer

Clone the environment with the new configuration and swap URLs.

Question 9

A SysOps administrator is investigating a cost increase in a production AWS account. They notice that an EC2 instance with a Reservation has been running continuously for months. The instance type is m5.large in us-east-1. The administrator sees that the instance is using a Standard Reserved Instance (RI) that was purchased 6 months ago for a 1-year term. However, the current utilization shows that the instance is only used for 4 hours per day. What should the administrator do to optimize costs without affecting availability?

Accepted Answer

Modify the existing RI to a smaller instance size (e.g., m5.large to m5.xlarge? no, smaller: e.g., t3.medium) and use Auto Scaling with a schedule to start/stop the instance during business hours.. By modifying the existing Standard RI to a smaller instance size (e.g., within the same family or by converting to a Convertible RI to allow family changes), the administrator can better match the actual low utilization pattern. Additionally, using Auto Scaling with a scheduled scaling policy to start and stop the instance during business hours ensures availability during needed times and reduces waste. Option A is incorrect because stopping the instance does not stop the RI charges; Reserved Instance benefits are applied only to running instances, so the RI would be wasted during off-hours. Option B is incorrect because selling the RI on the Reserved Instance Marketplace typically incurs a loss of the upfront payment and does not directly address the over-provisioning issue. Option D is incorrect because converting to a larger instance family would increase compute capacity per hour, leading to higher costs and even more waste given the low utilization.

Answer

Stop the instance during off-hours using Instance Scheduler, but keep the RI as-is.

Answer

Sell the current RI on the Reserved Instance Marketplace and purchase a new Convertible RI for a smaller instance type.

Answer

Convert the RI to a Convertible RI and exchange it for a larger instance family to get more compute per hour.

Question 10

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. The first thing to check when private instances cannot reach an external service is the route table for the private subnet. The private subnet must have a route 0.0.0.0/0 pointing to the NAT Gateway to route internet-bound traffic through it. Option B is incorrect because the NAT Gateway must have an Elastic IP to be reachable from the internet, but the issue described is outbound access from private instances; the NAT Gateway's Elastic IP is necessary but not the first check. Option C is incorrect because security groups for NAT Gateways are not used; NAT Gateways do not have security groups; instead, network ACLs on the subnets control traffic. Option D is incorrect because the internet gateway must be attached to the VPC for the NAT Gateway to work, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.