SOA-C02 Practice Test 45 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with automated backups enabled. The stack is deleted and then recreated. The administrator wants to restore data from the backup of the original DB instance. How can this be achieved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data cannot be restored because automated backups are deleted when the DB instance is deleted.. When an RDS DB instance is deleted, its automated backups are deleted along with it — they are tied to the instance's lifecycle and are not retained independently. Because the CloudFormation stack deletion removed the original DB instance, the automated backups no longer exist, so there is nothing to restore from. Unless a manual snapshot was taken beforehand, the data is unrecoverable.

Answer

Restore from the latest automated backup stored in S3.

Answer

Restore from the automated backup snapshot that is retained after deletion.

Answer

Use the RDS recycle bin to recover the deleted DB instance.

Question 2

A SysOps administrator notices that an Amazon CloudWatch Logs log group is growing rapidly and suspects that an EC2 instance is sending sensitive data to the logs. What is the most effective way to detect and redact sensitive data in real-time?

Accepted Answer

Create a CloudWatch Logs subscription filter that invokes a Lambda function for redaction.. CloudWatch Logs subscription filters can invoke a Lambda function in real-time as log events are ingested. This allows the Lambda function to inspect, detect, and redact sensitive data (e.g., credit card numbers or passwords) before the logs are stored in the log group, meeting the requirement for real-time detection and redaction.

Answer

Use CloudWatch Logs Insights to query and mask sensitive data.

Answer

Enable S3 event notifications to trigger a Lambda function for redaction.

Answer

Send logs to Amazon Kinesis Data Firehose and use Lambda for redaction.

Question 3

A SysOps administrator needs to monitor memory utilization on an Amazon EC2 instance. Memory metrics are not available by default in Amazon CloudWatch for EC2 instances. Which action should the administrator take to collect memory utilization metrics?

Accepted Answer

Install the CloudWatch agent on the EC2 instance. The CloudWatch agent is the correct solution because it can collect custom metrics, including memory utilization, from EC2 instances. Unlike the default hypervisor-level metrics (CPU, network, disk), memory metrics require an in-guest agent to read the operating system's memory counters and publish them to CloudWatch.

Answer

Enable detailed monitoring on the EC2 instance

Answer

Use an AWS Lambda function to query the EC2 instance for memory metrics

Answer

Use Amazon Inspector to collect memory metrics

Question 4

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with automated backups enabled. The stack is deleted and then recreated. The administrator wants to restore data from the backup of the original DB instance. How can this be achieved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config is the correct service because it can track changes to S3 bucket policies, evaluate them against desired configurations, and trigger notifications or remediation. AWS CloudTrail logs API calls that modify bucket policies but does not monitor the policy state itself. Amazon CloudWatch is used for monitoring metrics and logs, not for tracking configuration changes. AWS Trusted Advisor provides best practice recommendations and does not monitor bucket policies.

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 5

A SysOps administrator needs to ensure that all traffic between an on-premises data center and the AWS VPC is encrypted and goes over the internet. Which AWS service should be used?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel between an on-premises data center and an AWS VPC using IPsec (IKEv1/IKEv2) over the public internet. This meets the requirement for encryption and internet-based connectivity, as the VPN traffic traverses the internet but is secured by IPsec tunnels.

Answer

VPC Peering

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 6

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The SysOps administrator needs to restrict access to the ALB so that it only accepts requests from CloudFront. Which solution should the administrator implement?

Accepted Answer

Configure CloudFront to add a custom HTTP header to requests, and configure the ALB to only forward requests that contain that header. It uses a shared secret mechanism: CloudFront is configured to add a custom HTTP header (e.g., X-Origin-Verify) to all requests, and the ALB's listener rule is configured to only forward requests that contain that specific header value. This ensures that only requests originating from your CloudFront distribution reach the ALB, as the header is not present in direct client requests. This approach is recommended by AWS for restricting ALB access to CloudFront when the origin is an ALB, because CloudFront does not support Origin Access Identity (OAI) with ALB origins.

Answer

Replace the ALB with a Network Load Balancer and use a VPC endpoint

Answer

Create an origin access identity (OAI) and attach it to the CloudFront distribution

Answer

Add a security group rule to the ALB that allows traffic only from the CloudFront IP ranges

Question 7

A SysOps administrator is designing a disaster recovery plan for a critical application hosted on AWS. The application runs on EC2 instances with data stored in an RDS MySQL database. The RPO must be less than 15 minutes, and the RTO must be less than 1 hour. Which solution meets these requirements?

Accepted Answer

Use an RDS Multi-AZ DB Cluster deployment.. An RDS Multi-AZ DB Cluster deployment provides synchronous replication across three Availability Zones and automatic failover, enabling an RTO of typically under 1 minute and an RPO of effectively zero (no data loss). This meets the strict RPO (<15 minutes) and RTO (<1 hour) requirements without relying on cross-Region replication or manual recovery steps.

Answer

Take daily snapshots of the RDS instance and copy them to another Region.

Answer

Use an RDS DB instance with a Multi-AZ standby and a cross-Region Read Replica.

Answer

Use a single-AZ RDS instance with automated backups and point-in-time recovery.

Question 8

A SysOps administrator is implementing an automated backup solution for Amazon RDS databases. The solution must support point-in-time recovery and cross-region disaster recovery. Which TWO AWS services or features should be used?

Accepted Answer

Automated backups with a retention period.. Option C (Automated backups with a retention period) is correct because RDS automated backups capture daily snapshots plus transaction logs, enabling point-in-time recovery (PITR) to any second within the retention window (up to 35 days), which directly satisfies the PITR requirement. Option E (Automated cross-region snapshot copy) is correct because configuring RDS to automatically copy snapshots to a target region provides the cross-region disaster recovery capability, allowing restoration of the database in another region if the primary region fails. Together, C and E cover both stated requirements: PITR via automated backups and DR via cross-region snapshot replication. Option A (Manual DB snapshots) is not suitable because manual snapshots do not support point-in-time recovery and must be triggered manually, so they cannot form an automated PITR solution. Option B (Cross-region read replicas) provides read scaling and can be promoted, but it is not a backup mechanism and does not deliver point-in-time recovery. Option D (Amazon S3 lifecycle policies) manages object storage transitions/expiration and has no role in RDS backup or recovery.

Answer

Manual DB snapshots.

Answer

Cross-region read replicas.

Answer

Amazon S3 lifecycle policies.

Question 9

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Accepted Answer

Use AWS WAF with rate-based rules. AWS WAF with rate-based rules (option A) is correct because it can inspect incoming HTTP/HTTPS requests at the application layer and automatically block or throttle source IPs that exceed a defined request threshold, which directly mitigates application-layer (Layer 7) DDoS floods against resources like an ALB or CloudFront. AWS Shield Advanced (option B) is correct because it provides enhanced, always-on detection and automatic inline mitigation for Layer 3/4 (and Layer 7 with WAF integration) DDoS attacks, plus access to the AWS DDoS Response Team and cost protection for scaling charges incurred during an attack. The other options are not the intended answers: network ACLs with deny rules (C) and restrictive security groups (D) are stateful/stateless traffic filters that can block known bad ports or sources but cannot detect or absorb volumetric or application-layer DDoS patterns, and VPC Flow Logs (E) only capture IP traffic metadata for monitoring and forensics—they do not block or mitigate attacks.

Answer

Apply network ACLs with deny rules

Answer

Use restrictive security groups

Answer

Enable VPC Flow Logs

Question 10

A SysOps administrator manages a fleet of 50 EC2 instances running a batch processing application. The instances are launched via an Auto Scaling group with a dynamic scaling policy based on CPU utilization. The company recently switched to a new workload that is memory-intensive, causing frequent scale-out events. The administrator notices that the CPU utilization remains below 40%, but memory usage is consistently above 80%. The scaling policy does not trigger appropriately, leading to performance degradation. The administrator must optimize the solution to respond to memory pressure without incurring unnecessary costs. Which action should the administrator take?

Accepted Answer

Create a custom CloudWatch metric for memory utilization and configure a target tracking scaling policy using that metric.. It directly addresses the memory bottleneck by creating a custom CloudWatch metric for memory utilization and using a target tracking scaling policy. This allows the Auto Scaling group to automatically adjust capacity based on actual memory pressure, which is the real performance issue. Option B (manual scaling) is not automated and may lead to over-provisioning or under-provisioning. Option C (step scaling with CPU) does not solve the memory problem, and a wider cooldown would only delay scaling. Option D (changing instance type) is a reactive measure that does not provide dynamic scaling and may increase costs without eliminating the need for scaling policies.

Answer

Increase the minimum size of the Auto Scaling group to 10 instances and use manual scaling for peak times.

Answer

Change the dynamic scaling policy to a step scaling policy based on CPU utilization with a wider cooldown period.

Answer

Replace the current instance type with a memory-optimized instance type such as r5.large.

Question 11

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

Accepted Answer

Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.. AWS CodePipeline provides a 'Release change' button in the console that manually triggers the pipeline to run from the source stage using the latest commit. This allows the developer to rerun the pipeline without making a new commit. The pipeline will fetch the latest source revision and proceed through the stages.

Answer

Create a new commit with an empty message to trigger the pipeline.

Answer

Wait for the pipeline to automatically retry after the failure.

Answer

Re-upload the same artifact to the source S3 bucket to trigger the pipeline.

Question 12

A SysOps administrator is designing a solution to manage secrets (e.g., database credentials) for a multi-tier application running on EC2 instances. The solution must rotate secrets automatically and provide fine-grained access control. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (C) is correct because it is the service purpose-built for storing and automatically rotating secrets such as database credentials, using built-in rotation via Lambda functions and native integration with services like RDS, Redshift, and DocumentDB. IAM roles for EC2 (E) is correct because attaching an IAM role to the EC2 instances provides temporary credentials through the instance metadata service (IMDS), enabling fine-grained, least-privilege access control via IAM policies that scope which secrets each instance can retrieve, eliminating hard-coded credentials. AWS KMS (A) is not selected because it is an encryption key management service used to encrypt data and secrets, but it does not itself store or rotate secrets. AWS CloudHSM (B) is not selected because it provides dedicated hardware security modules for key operations and compliance use cases, not secret lifecycle management or rotation. AWS Systems Manager Parameter Store (D) is not selected because, although it can store parameters and SecureString values, it lacks native automatic secret rotation, which the scenario explicitly requires.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 13

A company uses Amazon Route 53 as its DNS service. They have a domain example.com with an alias record pointing to an Application Load Balancer (ALB). Recently, they updated the ALB's DNS name, but the Route 53 record was not updated. Users are still being directed to the old ALB, which has been decommissioned. The SysOps administrator updates the alias record to point to the new ALB DNS name. However, users still experience errors for several hours. What is the most likely reason?

Accepted Answer

The TTL on the DNS record is set too high, causing client-side caching. Alias records in Route 53 are not subject to TTL-based caching for the alias target resolution itself, but the DNS query response from the resolver to the client still includes a TTL value. When the TTL is set too high, clients and intermediate resolvers cache the old DNS response (pointing to the decommissioned ALB) for the duration of that TTL, causing continued errors even after the Route 53 record is updated. The alias record update propagates instantly within Route 53's authoritative infrastructure, but cached records at clients and recursive resolvers must expire before users reach the new ALB.

Answer

Route 53 requires time to propagate changes globally

Answer

The alias record was not saved correctly

Answer

The domain is using DNSSEC, which delays updates

Question 14

A company wants to audit all AWS account activity for compliance. Which THREE AWS services should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (E) is the foundational service for auditing AWS account activity because it records API calls and management events across the account, delivering the raw audit trail needed for compliance. Amazon CloudWatch Logs (A) is correct because CloudTrail can deliver its event logs to a CloudWatch Logs log group, where they can be retained, searched with metric filters, and alerted on for compliance monitoring. AWS Config (B) is correct because it continuously records resource configuration changes and evaluates them against compliance rules, complementing CloudTrail's activity records with configuration history and drift detection. AWS Trusted Advisor (C) is not part of an activity-auditing pipeline; it only provides best-practice checks and recommendations. Amazon GuardDuty (D) is a threat-detection service that analyzes logs for malicious behavior, not a primary audit or compliance-recording service.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 15

A SysOps administrator needs to create a VPC with both public and private subnets. The public subnet will host a NAT gateway and a bastion host. The private subnet will host application servers that need outbound internet access for updates. Which routing configuration should the administrator implement?

Accepted Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> NAT Gateway.. The public subnet needs a route to the Internet Gateway so the NAT gateway and bastion host are reachable from the internet. The private subnet needs a route to the NAT gateway (which itself lives in the public subnet) so application servers can initiate outbound internet traffic without being directly reachable inbound.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway via the NAT Gateway.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.

Answer

Public subnet route table: 0.0.0.0/0 -> NAT Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.