SOA-C02 Practice Test 44 — 15 Questions

Question 1

A SysOps administrator is setting up Amazon Route 53 for a domain that will be used for a web application. The application requires failover to a backup data center in another region if the primary becomes unhealthy. The administrator creates a failover routing policy with two records (primary and secondary) associated with health checks. After testing, the failover does not occur when the primary endpoint fails. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The health check is configured to monitor the secondary endpoint instead of the primary. Failover routing relies on health checks to determine the health of the primary endpoint. If the health check is mistakenly configured to monitor the secondary endpoint, it will not assess the primary's health. Consequently, Route 53 will not trigger a failover to the secondary when the primary fails. Option A is incorrect because alias records are not required for failover; they are only needed for AWS resources. Option B is incorrect because the registrar's nameservers do not affect Route 53's failover logic once the domain is delegated. Option D is incorrect because while a high TTL can delay propagation, it does not prevent failover from occurring; failover depends on health check status, not TTL.

Answer

The primary record is not an alias record

Answer

The domain registrar's nameservers are not pointing to Route 53

Answer

The TTL on the primary record is set too high

Question 2

A company runs a production Amazon RDS for MySQL DB instance in a single Availability Zone. The SysOps administrator needs to improve database availability to ensure automatic failover if the primary instance fails. Which configuration should the administrator enable?

Accepted Answer

Enable Multi-AZ deployment on the DB instance.. Enabling Multi-AZ deployment on the DB instance automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary instance fails, Amazon RDS automatically fails over to the standby, providing high availability without manual intervention. This is the native AWS solution for automatic failover for RDS MySQL.

Answer

Create a Read Replica in another Availability Zone and promote it on failure.

Answer

Take hourly snapshots and automate restoration in another AZ.

Answer

Use Amazon RDS Proxy to manage connection failover.

Question 3

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an Amazon RDS DB instance with a custom DB parameter group. The error message states: 'The following resource(s) failed to create: [DBParameterGroup].' The administrator checks the CloudFormation template and sees that the DBParameterGroup resource has a property 'Parameters' with a list of parameters. What is the MOST likely reason for the failure?

Accepted Answer

The parameter group is configured with parameters that are not compatible with the DB engine version.. Custom DB parameter groups must be configured with parameters that are compatible with the DB engine and version specified for the RDS instance. If the parameter group includes parameters that are not supported by the chosen engine version, the stack creation will fail with an error for the DBParameterGroup resource. In this case, the most likely cause is that one or more parameters in the 'Parameters' list are incompatible with the DB engine version. Option B is correct. Option A is incorrect because parameter group names can contain letters, numbers, and hyphens; they are not restricted. Option C is incorrect because the DB subnet group is not related to parameter group creation failure. Option D is incorrect because RDS does not require a VPC endpoint to create a parameter group.

Answer

The parameter group name contains invalid characters.

Answer

The DB subnet group specified for the DB instance does not exist.

Answer

The VPC does not have an RDS VPC endpoint enabled.

Question 4

A company runs a critical application on EC2 instances in an Auto Scaling group. The application stores state information locally on the instance. The SysOps administrator needs to ensure that if an instance fails, the state is not lost. What should the administrator do?

Accepted Answer

Move the state data to an external data store such as ElastiCache or RDS.. State stored locally on an EC2 instance is ephemeral and lost if the instance fails or is terminated. The most reliable solution is to externalize state to a durable, shared data store such as ElastiCache (for session state) or RDS (for relational state). This decouples the application from the instance lifecycle and allows any instance in the Auto Scaling group to serve requests.

Answer

Attach an EBS volume and set the 'DeleteOnTermination' flag to false.

Answer

Use instance store volumes for the state data.

Answer

Use Amazon SQS to store the state data.

Question 5

A company has a VPC with public and private subnets. An Application Load Balancer (ALB) is in the public subnets, and Amazon EC2 instances are in the private subnets. The SysOps administrator needs to allow the EC2 instances to access an Amazon S3 bucket in the same AWS Region without traversing the internet. Which solution should the administrator implement?

Accepted Answer

A VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 buckets privately using AWS's internal network, without traversing the internet. This endpoint uses prefix lists and route table entries to direct S3 traffic through the AWS backbone, ensuring low latency and no data transfer costs.

Answer

A NAT Gateway

Answer

An Internet Gateway

Answer

VPC Peering

Question 6

Which AWS service can be used to create a private, dedicated connection between an on-premises data center and AWS?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. It offers more consistent network performance, lower latency, and reduced bandwidth costs compared to internet-based connections. This makes it the correct choice for a private, dedicated connection.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 7

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses sticky sessions (session affinity) based on cookies. Recently, the SysOps team noticed that user sessions are being lost intermittently, causing users to be logged out. The team checks the ALB configuration and finds that the stickiness is enabled with a cookie name 'AWSALB' and duration of 1 hour. The application also sets its own cookie. What is the most likely cause of session loss?

Accepted Answer

The application's session cookie has a shorter expiration than the ALB's stickiness duration. The most likely cause is that the application's session cookie expires before the ALB's stickiness cookie, causing the user to be logged out even though the ALB still routes to the same instance. The ALB stickiness duration is 1 hour, but if the application cookie has a shorter lifespan, the session ends prematurely. This is a common misconfiguration when application and load balancer session timeouts are not aligned.

Answer

The ALB's health check interval is too short, causing instances to be marked unhealthy

Answer

The application cookie is overwriting the ALB's stickiness cookie

Answer

Cross-zone load balancing is disabled on the ALB

Question 8

A company requires that all Amazon S3 buckets in its AWS account must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to detect any bucket that does not have KMS encryption enabled and automatically remediate it by enabling encryption. Which AWS service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously monitor S3 bucket configurations against a desired encryption state using managed rules like 's3-bucket-server-side-encryption-enabled' or custom Lambda rules. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-KMS encryption, enforcing compliance without manual intervention.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 9

Drag and drop the steps to configure an Amazon Route 53 failover routing policy into the correct order.

Accepted Answer

Create health checks, then create primary failover record, then create secondary failover record, then test failover.. Create health checks first, then create primary and secondary records with failover types, then test.

Answer

Create primary failover record, then create health checks, then create secondary failover record, then test failover.

Answer

Create health checks, then create secondary failover record, then create primary failover record, then test failover.

Answer

Create health checks, then create primary failover record, then test failover, then create secondary failover record.

Question 10

A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon EC2 instance. The administrator wants to update the instance type from t3.medium to t3.large without recreating the instance. The instance type change is supported as a simple update in CloudFormation. Which stack update method should the administrator use to apply this change with the least disruption?

Accepted Answer

Directly update the stack by modifying the template and submitting the update via the AWS Management Console, AWS CLI, or API.. Changing an EC2 instance type from t3.medium to t3.large is a supported simple update in CloudFormation, meaning the resource can be updated in-place without replacement. By directly updating the stack via the AWS Management Console, AWS CLI, or API, the administrator applies the change immediately with minimal disruption, as CloudFormation will stop the instance, modify the instance type, and restart it. This method avoids the overhead of creating a change set or deleting and recreating the stack, which would cause unnecessary downtime or complexity.

Answer

Create a change set to review the changes, then execute the change set.

Answer

Apply a stack policy to the EC2 instance to allow the update, then update the stack.

Answer

Delete the existing stack and create a new stack with the updated instance type.

Question 11

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB terminates SSL/TLS and forwards traffic to the instances over HTTP. The SysOps administrator needs to capture the original client IP address in the instance logs. How should the administrator configure this?

Accepted Answer

Enable the X-Forwarded-For header on the ALB.. When an Application Load Balancer terminates SSL/TLS and forwards traffic to EC2 instances over HTTP, the original client IP address is preserved by the ALB in the X-Forwarded-For header. By enabling this header on the ALB, the SysOps administrator ensures that the web server or application can log the true client IP, which is essential for analytics, security, and troubleshooting.

Answer

Enable stickiness on the ALB target group.

Answer

Configure the ALB to use Proxy Protocol v2.

Answer

Enable access logs on the ALB and store them in Amazon S3.

Question 12

A company runs a production Amazon RDS for PostgreSQL DB instance. The SysOps administrator needs to ensure that in the event of a database failure, there is automatic failover to a standby instance in another Availability Zone with minimal downtime. Which deployment configuration should the administrator enable?

Accepted Answer

Multi-AZ deployment. A Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a database failure or an Availability Zone outage, Amazon RDS automatically fails over to the standby, typically within 60-120 seconds, without requiring manual intervention. This ensures high availability and minimal downtime for the production PostgreSQL DB instance.

Answer

Read Replicas

Answer

Automated backups with point-in-time recovery

Answer

Amazon RDS Proxy

Question 13

Match each AWS storage service to its description.

Accepted Answer

Amazon S3: Object storage for internet-scale data.. Amazon S3 is object storage, EBS is block storage, EFS is file storage, and Glacier is archival. Common confusions include mixing S3 and EBS definitions.

Answer

Amazon S3: Block-level storage for EC2 instances.

Answer

Amazon EBS: Object storage for internet-scale data.

Question 14

Refer to the exhibit. A VPC Gateway Endpoint for S3 is created and associated with route table rtb-11111111. However, an EC2 instance in a subnet that uses route table rtb-22222222 cannot access S3. What is the most likely cause?

Accepted Answer

The subnet's route table (rtb-22222222) does not have a route to the VPC endpoint.. A VPC Gateway Endpoint for S3 is associated with specific route tables, and only subnets using those route tables can reach S3 through the endpoint. Since the endpoint is associated with rtb-11111111 but the EC2 instance's subnet uses rtb-22222222, that subnet has no route to the endpoint and traffic cannot reach S3 via the gateway endpoint. The fix is to associate the endpoint with rtb-22222222 as well.

Answer

The VPC endpoint is not in the 'available' state.

Answer

The endpoint policy does not allow the s3:GetObject action.

Answer

The VPC endpoint is in a different region from the S3 bucket.

Question 15

An application writes logs to an S3 bucket. The logs are accessed frequently for the first 30 days, then rarely after that, but must be retained for 7 years. Which THREE steps should be taken to optimize cost? (Choose three.)

Accepted Answer

Use an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 90 days.. S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival data, making it ideal for logs that are rarely accessed after 90 days. An S3 Lifecycle policy automates the transition from a higher-cost class (e.g., Standard-IA) to Glacier Deep Archive, reducing storage costs while retaining the data for the required 7-year period.

Answer

Delete logs older than 30 days.

Answer

Use S3 Intelligent-Tiering to automatically optimize costs.