SOA-C02 Practice Test 46 — 15 Questions

Question 1

A SysOps administrator needs to ensure that all traffic to an Amazon S3 bucket is encrypted in transit. Which configuration should be used?

Accepted Answer

Add a bucket policy that denies requests where aws:SecureTransport is false.. A bucket policy that denies requests where the aws:SecureTransport condition key is false enforces encryption in transit at the S3 API layer, rejecting any HTTP (non-TLS) request regardless of client. This is the canonical AWS-documented method for requiring TLS on an S3 bucket.

Answer

Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.

Answer

Create a VPC endpoint for S3 and route all traffic through it.

Answer

Enable default encryption on the S3 bucket.

Question 2

A company hosts a static website on Amazon S3. Users access the website from around the world. The SysOps administrator needs to deliver content with low latency and support HTTPS with a custom domain. Which AWS service should be used?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for global users. It natively supports HTTPS with custom domains via SSL/TLS certificates from AWS Certificate Manager (ACM) and integrates with S3 as an origin. This combination of low-latency delivery and HTTPS termination makes CloudFront the correct choice for this scenario.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 latency-based routing

Answer

S3 Transfer Acceleration

Question 3

A company has an Amazon DynamoDB table that stores historical data. The table is accessed infrequently but when queried requires consistent single-digit millisecond latency. The SysOps administrator wants to minimize storage costs while maintaining the required performance. Which DynamoDB table class should the administrator use?

Accepted Answer

DynamoDB Standard-IA (Infrequent Access). DynamoDB Standard-IA (Infrequent Access) is designed for tables that are accessed less than once per month, offering lower storage costs than DynamoDB Standard while maintaining the same single-digit millisecond latency for queries. Since the table stores historical data with infrequent access but requires consistent performance, Standard-IA minimizes storage costs without sacrificing latency.

Answer

DynamoDB Standard

Answer

DynamoDB On-Demand

Answer

DynamoDB Provisioned

Question 4

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The operations team uses CloudWatch alarms to monitor the application's health. Recently, they noticed that the application's error rate has increased sporadically, but the CPU utilization and memory usage remain normal. The team suspects that the issue is related to a specific HTTP endpoint returning 5xx errors. They want to set up monitoring that will alert them when the error rate exceeds 5% of total requests over a 5-minute period. The application logs are already sent to CloudWatch Logs. Which combination of steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Create a metric filter in CloudWatch Logs to extract error codes and total requests from the application logs. Create two custom metrics: one for error count and one for total requests. Then create a CloudWatch alarm using a math expression that calculates error rate (error count / total requests) and triggers when >0.05 for 5 minutes.. The requirement is to alert when the 5xx error rate exceeds 5% of total requests over a 5-minute window, and the logs are already in CloudWatch Logs. A metric filter extracts the error count and total request count into custom metrics, and a CloudWatch alarm with a math expression (errors/requests) evaluates the ratio against the 0.05 threshold. This is the only option that produces a true percentage-based alarm from the existing log data.

Answer

Enable AWS X-Ray on the application to trace requests and identify error patterns. Create a CloudWatch alarm on the X-Ray error rate metric.

Answer

Install the CloudWatch agent on the EC2 instances to collect application-level metrics. Configure the agent to emit a custom metric for error rate. Then create an alarm on that metric.

Answer

Enable detailed monitoring on the ALB and create a CloudWatch alarm on the HTTPCode_ELB_5XX metric with a threshold of 5% of the request count. Use the ALB's RequestCount metric to compute the percentage.

Question 5

A company wants to securely store secrets such as database credentials and API keys used by applications running on Amazon EC2. Which AWS service should be used to manage and rotate these secrets automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to securely store, manage, and automatically rotate secrets such as database credentials and API keys. It integrates with AWS services like RDS, Redshift, and DocumentDB to provide built-in rotation. This makes it the correct choice for managing and rotating secrets automatically.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 6

A development team uses AWS CloudFormation to deploy infrastructure. They want to update a stack but first need to review how the changes will impact existing resources before applying them. Which CloudFormation feature should they use?

Accepted Answer

Change sets. Change sets allow you to preview how proposed changes to a CloudFormation stack will affect your running resources before you apply them. They generate a summary of the changes (additions, modifications, deletions) based on the new template and parameters, enabling you to assess impact such as resource replacement or updates without executing the changes. This directly addresses the team's requirement to review changes before applying them.

Answer

Stack policies

Answer

Condition functions

Answer

Custom resources

Question 7

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. The SysOps administrator needs to run a script on all instances that have a specific tag (Environment: Production). The script must be executed immediately and only once. Which approach should be used?

Accepted Answer

Use Run Command with a target based on the tag.. Run Command enables you to run commands on EC2 instances immediately and only once, using tags to target specific instances. Option A is incorrect because Patch Manager is designed for applying patches, not running arbitrary scripts. Option B is incorrect because Automation documents are for multi-step workflow orchestration, not simple one-time script execution. Option D is incorrect because State Manager is for recurring configurations or ensuring a desired state over time, not immediate one-time execution.

Answer

Use Patch Manager to apply the script as a patch baseline.

Answer

Create an Automation document and execute it.

Answer

Create a State Manager association with the script.

Question 8

A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?

Accepted Answer

Private subnet route table with a route to the NAT Gateway. Option E is correct because a NAT Gateway must be deployed in a public subnet (with an Elastic IP) so it can route traffic out through the Internet Gateway on behalf of private instances. Option D is correct because the private subnet's route table must have a route (typically 0.0.0.0/0) pointing to that NAT Gateway, which allows instances in the private subnet to initiate outbound traffic for patching while remaining unreachable from the internet. Together, the NAT Gateway in the public subnet and the private route table entry provide one-way outbound internet access. Option A is incorrect because VPC Peering connects two VPCs and does not provide internet access. Option B is incorrect because routing a private subnet directly to an Internet Gateway would make it a public subnet and expose it to inbound internet traffic. Option C is incorrect because an Internet Gateway alone, attached to the VPC, does not give private subnets outbound access without a NAT device and the corresponding route.

Answer

VPC Peering connection

Answer

Private subnet route table with a route to the Internet Gateway

Answer

Internet Gateway attached to the VPC

Question 9

A company is using AWS CloudTrail to log API activity in their account. The security team needs to be alerted when an IAM user creates a new access key. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and targets an SNS topic.. Amazon EventBridge can directly match the `CreateAccessKey` API call from CloudTrail and trigger an SNS topic to send an alert in real time, requiring no custom code or polling. This provides the least operational overhead by using a fully managed, event-driven rule.

Answer

Enable CloudTrail email notifications for management events.

Answer

Configure the IAM user's permissions to require MFA for access key creation.

Answer

Write a Lambda function that periodically scans CloudTrail logs in S3 and sends alerts.

Question 10

A SysOps administrator notices that traffic to an Application Load Balancer (ALB) is being rejected. The ALB has a security group that allows inbound HTTP (80) and HTTPS (443) from 0.0.0.0/0. The target group health checks are failing. What could be the issue?

Accepted Answer

The target instances' security group does not allow inbound traffic from the ALB security group.. For an ALB to route traffic to targets, the targets' security group must allow inbound traffic from the ALB's security group on the target port. Even if the ALB's security group allows inbound HTTP/HTTPS from the internet, the targets will reject traffic if their security group does not permit it. This is a common misconfiguration that causes health checks to fail.

Answer

The ALB security group does not allow outbound traffic to the targets.

Answer

The ALB’s security group is blocking health check traffic from the targets.

Answer

The target instances' security group does not allow inbound HTTP/HTTPS from the internet.

Question 11

A company uses AWS CloudFormation to manage infrastructure. A developer accidentally deletes a resource from the stack template, and the next stack update attempts to delete the resource. The SysOps administrator wants to prevent accidental deletion of critical resources. Which CloudFormation feature should be used?

Accepted Answer

Set a DeletionPolicy attribute to 'Retain' on the resource.. The DeletionPolicy attribute set to 'Retain' on a resource ensures that CloudFormation will preserve the resource even if it is removed from the stack template or the stack itself is deleted. This directly prevents accidental deletion of critical resources during stack updates. It is a resource-level safeguard, not a stack-level one.

Answer

Enable termination protection on the stack.

Answer

Stack policy to deny delete actions.

Answer

Attach an IAM policy that denies cloudformation:DeleteStack.

Question 12

An application running on Amazon ECS with Fargate launch type is experiencing intermittent failures. The tasks are spread across multiple Availability Zones. The SysOps administrator notices that failures occur only when an entire AZ becomes unavailable. What should the administrator do to improve the reliability of the application?

Accepted Answer

Increase the desired task count to ensure sufficient capacity across AZs.. Increasing the desired task count ensures that ECS Fargate tasks are distributed across multiple Availability Zones, providing sufficient capacity to absorb the loss of an entire AZ. When one AZ becomes unavailable, the remaining tasks in other AZs continue to serve traffic, improving application reliability. This approach leverages the multi-AZ architecture already in place by ensuring enough tasks are running to handle the load even after an AZ failure.

Answer

Use multiple subnets in the same AZ.

Answer

Use a cluster placement group.

Answer

Attach an Amazon EFS filesystem to all tasks.

Question 13

A company uses AWS Organizations with SCPs to restrict member accounts. The security team wants to prevent all users in the 'Developers' OU from deleting S3 buckets, except for the root user of the management account. How should this be implemented?

Accepted Answer

Attach an SCP that denies s3:DeleteBucket to the Developers OU. The management account root is not affected by SCPs.. SCPs applied to an OU restrict what member accounts can do, but they do not affect the management account. The management account root user is not constrained by SCPs, so attaching a deny s3:DeleteBucket SCP to the Developers OU prevents users in that OU from deleting buckets while leaving the management account root unaffected. This matches the requirement exactly.

Answer

Create an IAM policy that denies s3:DeleteBucket and attach it to all IAM users. The root user is not affected by IAM policies.

Answer

Attach an SCP that denies s3:DeleteBucket except when called by root user.

Answer

Attach an SCP that denies s3:DeleteBucket to the Developers OU. The root user in member accounts is not affected.

Question 14

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls code from an Amazon S3 bucket. The company wants to automatically trigger the pipeline when a new object is uploaded to the S3 bucket. How should this be configured?

Accepted Answer

Configure a CloudWatch Events rule that matches S3 object creation events and triggers the pipeline.. Configuring a CloudWatch Events (now Amazon EventBridge) rule that matches S3 object creation events and triggers the pipeline is the correct approach. EventBridge can directly target CodePipeline as a target, enabling automatic pipeline execution when a new object is uploaded to the S3 bucket. This is the native, serverless integration for event-driven pipelines.

Answer

Use an AWS Lambda function to poll the S3 bucket and start the pipeline.

Answer

Configure the S3 bucket to send events to an Amazon SNS topic that triggers the pipeline.

Answer

Configure the S3 bucket to send events to an Amazon SQS queue that triggers the pipeline.

Question 15

A SysOps administrator is reviewing the monthly AWS bill and notices a significant cost for data transfer from EC2 to the internet. The EC2 instances are in a VPC and serve content to users. Which action would MOST effectively reduce data transfer costs?

Accepted Answer

Use Amazon CloudFront as a content delivery network (CDN).. Using Amazon CloudFront as a CDN caches content at edge locations closer to users, reducing the amount of data transferred directly from EC2 instances to the internet. This lowers data transfer out (DTO) costs because CloudFront has lower data transfer rates and can also cache content, reducing the load on EC2. The question specifies data transfer from EC2 to the internet, so offloading to CloudFront is the most effective cost reduction.

Answer

Use VPC endpoints to connect to S3 and DynamoDB.

Answer

Move the EC2 instances to a different AWS Region with lower data transfer rates.

Answer

Use a NAT Gateway to route traffic through a single IP.