SOA-C02 Practice Test 41 — 15 Questions

Question 1

A company has an Amazon CloudFront distribution that delivers static content from an Amazon S3 bucket. The SysOps administrator needs to ensure that the content can only be accessed through CloudFront and not directly from the S3 bucket URL. The solution should use AWS managed services with minimal configuration. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI).. Configuring the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI) ensures that only CloudFront can retrieve objects from the S3 bucket. The OAI is a special CloudFront user that authenticates requests to S3, and the bucket policy explicitly grants GetObject access only to that principal, blocking any direct S3 URL access. This uses AWS managed services (CloudFront and S3) with minimal configuration—no custom code or additional infrastructure.

Answer

Make the S3 bucket private and use pre-signed URLs for CloudFront.

Answer

Use AWS WAF on CloudFront to block direct access to S3 by checking the Referer header.

Answer

Create a VPC endpoint for S3 and restrict access to the bucket from the CloudFront IP addresses.

Question 2

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot into the correct order.

Accepted Answer

Select the snapshot, then configure instance details, then configure security and parameters, then initiate restore.. Restoration starts by selecting the snapshot, then configuring instance details, security, and parameters, then initiating the restore.

Answer

Select the snapshot, then configure security and parameters, then configure instance details, then initiate restore.

Answer

Configure instance details, then select the snapshot, then configure security and parameters, then initiate restore.

Answer

Select the snapshot, then initiate restore, then configure instance details, then configure security and parameters.

Question 3

A company runs a stateful web application on a single Amazon EC2 instance. The SysOps administrator needs to implement a high availability architecture that can tolerate an Availability Zone (AZ) failure. The application stores session state in memory and also writes critical data to an Amazon EBS volume. The administrator wants to use an Auto Scaling group and an Application Load Balancer (ALB). Which combination of steps is required to make the application highly available?

Accepted Answer

Migrate session state to Amazon ElastiCache for Redis, store critical data in Amazon EFS, create an Auto Scaling group across multiple AZs, and place it behind an ALB.. It addresses both the stateless requirement for horizontal scaling and the persistence of critical data across AZ failures. Migrating session state to ElastiCache for Redis removes the dependency on local instance memory, allowing any instance to handle any request. Storing critical data on Amazon EFS provides a shared, NFS-based file system that is accessible from all instances across multiple AZs, unlike EBS which is tied to a single AZ. Combining these with a multi-AZ Auto Scaling group and an ALB ensures the application can survive an entire AZ outage.

Answer

Create an Auto Scaling group that spans at least two Availability Zones, attach the existing EBS volume to the new instances, and use an ALB to distribute traffic.

Answer

Place the EC2 instance in an Auto Scaling group with a minimum and maximum of 1 in the same AZ, and attach an Elastic IP to the instance.

Answer

Use an ALB with the existing single instance as the target, and enable cross-zone load balancing.

Question 4

Drag and drop the steps to troubleshoot high CPU usage on an Amazon EC2 instance into the correct order.

Accepted Answer

Check CloudWatch metrics, then Connect to instance, then Identify high CPU process, then Analyze process behavior, then Take corrective action. The correct order for troubleshooting high CPU usage on an EC2 instance starts with checking CloudWatch metrics to confirm the issue and gain initial insights. Next, connect to the instance using SSH or Systems Manager to access the operating system. Then, identify the process causing high CPU using tools like top or ps. After identification, analyze the process to understand its behavior, such as checking logs or memory usage. Finally, take corrective action, which may include stopping, killing, or optimizing the process, or scaling the instance up. This sequence ensures efficient and accurate troubleshooting.

Answer

Connect to instance, then Check CloudWatch metrics, then Identify high CPU process, then Analyze process behavior, then Take corrective action

Answer

Check CloudWatch metrics, then Identify high CPU process, then Connect to instance, then Analyze process behavior, then Take corrective action

Answer

Check CloudWatch metrics, then Connect to instance, then Analyze process behavior, then Identify high CPU process, then Take corrective action

Question 5

An EC2 instance runs a Java application. The operations team wants to monitor heap memory utilization in CloudWatch and set alarms when it exceeds 85 percent. EC2 does not natively publish memory metrics to CloudWatch. What is the simplest way to get this metric into CloudWatch?

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect mem_used_percent; publish JVM heap metrics from the application using PutMetricData. The CloudWatch agent can collect custom metrics like memory utilization from the EC2 instance, and the Java application can directly publish JVM heap metrics to CloudWatch using the PutMetricData API. This combination provides the simplest and most direct way to monitor heap memory utilization and set alarms at the 85% threshold, as EC2 does not natively expose memory metrics.

Answer

Enable detailed monitoring on the EC2 instance to increase metric resolution to 1-minute intervals

Answer

Configure a CloudWatch Logs metric filter on the application log stream to count lines containing 'OutOfMemoryError'

Answer

Use AWS Systems Manager Inventory to collect memory data and sync it to CloudWatch

Question 6

A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. The company's SysOps administrator wants to ensure that traffic from the VPC destined for the on-premises network uses the Direct Connect connection instead of the internet. Which configuration should be used?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW). A virtual private gateway (VGW) is the AWS-side endpoint for an AWS Direct Connect connection when using a private virtual interface. By adding a route in the VPC route table that points the on-premises network CIDR to the VGW, all traffic destined for the on-premises network is forced over the Direct Connect link, bypassing the internet. This ensures private, low-latency, and consistent connectivity as required.

Answer

Add a route in the VPC route table pointing to the on-premises network via a NAT gateway

Answer

Add a route in the VPC route table pointing to the on-premises network via an internet gateway

Answer

Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection

Question 7

A company wants to implement a disaster recovery solution for its on-premises database using AWS. The solution must have an RPO of less than 1 hour and an RTO of less than 4 hours. Which THREE steps should the SysOps administrator take? (Choose THREE.)

Accepted Answer

Set up a cross-Region read replica for the RDS instance.. A cross-Region read replica for an RDS instance provides asynchronous replication to a secondary Region. After promoting the replica, the RTO can be under 4 hours, and the RPO is typically less than 1 hour. Option B is correct by launching an EC2 instance with the same database software and configuring continuous replication (e.g., log shipping or mirroring) from the on-premises database. This allows failover to the EC2 instance within the RPO and RTO targets. Option C is correct as AWS DMS can perform ongoing replication from the on-premises database to an RDS instance, meeting the RPO requirement with minimal data loss. Together, these steps form a multi-layered DR strategy: DMS for continuous replication, EC2 as a standby, and a cross-Region replica for regional resilience.

Answer

Use AWS DataSync to sync the database files to Amazon S3.

Answer

Configure the RDS instance with Multi-AZ.

Question 8

A company uses AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The SysOps administrator needs to implement a deployment strategy that ensures zero downtime by creating a new set of instances alongside the current ones, then gradually shifting traffic to the new instances after they pass health checks. If a problem is detected, traffic can be instantly redirected back to the original instances. Which deployment configuration should the administrator use?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct choice because it creates a completely new set of instances (green environment) alongside the existing ones (blue environment), shifts traffic gradually to the new instances after health checks pass, and allows instant rollback by redirecting traffic back to the original instances. AWS CodeDeploy supports this strategy natively with a blue/green deployment configuration, ensuring zero downtime during the transition.

Answer

Rolling update

Answer

All at once deployment

Answer

Canary deployment

Question 9

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application reads data from an Amazon RDS for MySQL database. During peak hours, the database CPU utilization is consistently high, and the application experiences increased latency. The SysOps administrator observes that 90% of database queries are read-only. Which combination of actions will both improve performance and optimize costs?

Accepted Answer

Implement a read replica for the RDS instance and modify the application to route read queries to the read replica. Implementing a read replica offloads read-heavy (90%) queries from the primary RDS instance, reducing CPU utilization and latency. Modifying the application to route read queries to the replica distributes the workload, improving performance while avoiding costly vertical scaling. This optimizes costs by using a smaller primary instance and paying only for the replica's resources.

Answer

Enable Multi-AZ for the RDS instance and scale up the instance size

Answer

Enable Amazon RDS Performance Insights and increase the storage allocation

Answer

Implement Amazon ElastiCache for Memcached in front of the database and migrate read-heavy queries to cache

Question 10

A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?

Accepted Answer

Review and modify the IAM group policy to include ec2:TerminateInstances action. Since the user's permissions come from an IAM group policy, the missing ec2:TerminateInstances action must be added to that group policy — that's the source of the user's effective permissions. Modifying the group policy grants the permission to all members consistently and follows AWS best practice of managing permissions at the group level.

Answer

Attach a managed policy that includes ec2:TerminateInstances directly to the user

Answer

Add the user to a different IAM group that has the required permissions

Answer

Check the user's permissions boundary for any restrictions

Question 11

Drag and drop the steps to set up an Amazon S3 bucket policy to grant cross-account access into the correct order.

Accepted Answer

Identify the bucket and account, then write the policy with correct principal and actions, then save the policy, then test access.. Identify the bucket and account, write the policy with correct principal and actions, save, and test.

Answer

Write the policy with correct principal and actions, then identify the bucket and account, then save the policy, then test access.

Answer

Identify the bucket and account, then write the policy with correct principal and actions, then test access, then save the policy.

Answer

Identify the bucket and account, then save the policy, then write the policy with correct principal and actions, then test access.

Question 12

A company runs a stateless web application on Amazon EC2 instances in an Auto Scaling group across two Availability Zones. The SysOps administrator needs to ensure that the application can tolerate a failure of an entire Availability Zone. Which configuration is required?

Accepted Answer

Use an Application Load Balancer (ALB) that spans both Availability Zones with health checks enabled.. An Application Load Balancer (ALB) that spans both Availability Zones with health checks enabled distributes incoming traffic across EC2 instances in multiple AZs. If an entire AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZ, ensuring the stateless web application remains available. Health checks detect instance or AZ failure and remove unhealthy targets from the load balancer's target group, which is essential for fault tolerance.

Answer

Enable termination protection on all Amazon EC2 instances.

Answer

Place the Amazon EC2 instances in a cluster placement group.

Answer

Associate an Elastic IP address with the primary instance.

Question 13

A company has an Amazon VPC with public and private subnets across two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an Amazon S3 bucket to upload and download files. The SysOps administrator must ensure that traffic to S3 does not traverse the internet and minimizes data transfer costs. Which solution should the administrator implement?

Accepted Answer

Create an S3 VPC Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.. An S3 VPC Gateway Endpoint provides a private, cost-effective connection to S3 from within the VPC without traversing the internet. By associating the endpoint with the route tables of the private subnets, traffic destined for S3 is routed directly through AWS's internal network, avoiding data transfer costs and internet egress charges.

Answer

Create an S3 VPC Interface Endpoint in the VPC and associate it with the security groups of the private subnets.

Answer

Set up a NAT Gateway in the public subnets and add a route to the private subnets' route tables pointing to the NAT Gateway for S3 traffic.

Answer

Use AWS PrivateLink with an S3 endpoint service hosted in a different VPC.

Question 14

A company has an on-premises data center connected to AWS via an AWS Direct Connect private virtual interface (VIF). The SysOps administrator needs to ensure that all traffic between the on-premises network and Amazon S3 in the same AWS Region stays within the AWS network and does not traverse the internet. Which solution should the administrator implement?

Accepted Answer

Use a Direct Connect gateway and a private VIF with VPC endpoints for S3. A private VIF with VPC endpoints for S3 (Gateway Endpoints) ensures that traffic from on-premises to S3 stays within the AWS network. The private VIF provides connectivity to the VPC, and the Gateway Endpoint routes S3 traffic through the AWS backbone without traversing the internet. This combination meets the requirement of keeping traffic within the AWS network.

Answer

Use a Direct Connect gateway and a public VIF with a route to S3 prefix lists

Answer

Use a VPN connection over Direct Connect to access S3

Answer

Use a Transit Gateway with a private VIF and route S3 traffic through a NAT instance

Question 15

A company runs a critical MySQL database on an Amazon RDS DB instance in a single Availability Zone. The SysOps administrator needs to implement a disaster recovery solution with a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour, while minimizing costs. Which solution meets these requirements?

Accepted Answer

Enable cross-Region automated backups to another Region. Cross-Region automated backups replicate transaction logs to another AWS Region with a typical lag of a few minutes, enabling point-in-time recovery (PITR) that can meet an RPO of 5 minutes. When a disaster occurs, you can restore the automated backup to a new DB instance in the destination Region, and the RTO depends on the restore time, which can be under 1 hour for a properly sized instance. This solution minimizes costs by avoiding the continuous compute and storage overhead of a standby replica or read replica.

Answer

Enable Multi-AZ deployment with a synchronous standby replica in another Availability Zone

Answer

Create a cross-Region read replica and promote it to a standalone DB instance during a disaster

Answer

Take daily automated snapshots and copy them to another Region manually