SOA-C02 Practice Test 47 — 15 Questions

Question 1

A SysOps admin is investigating why a CloudWatch alarm did not trigger an SNS notification when a metric breached the threshold. The alarm state is visible in the console as 'ALARM'. What is the most likely reason the notification was not sent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SNS topic's subscription is not confirmed. The most likely reason the notification was not sent is that the SNS topic's subscription is not confirmed. When an SNS topic sends a notification to an endpoint such as email, HTTP, or SMS, the subscription must first be confirmed by the subscriber. If the subscription remains in a 'Pending confirmation' state, SNS will not deliver messages to that endpoint, even if the CloudWatch alarm transitions to the ALARM state and publishes to the topic.

Answer

The alarm name contains special characters

Answer

The alarm's evaluation period is set to 1 minute

Answer

The metric has a resolution of 1 minute

Question 2

A SysOps administrator is designing a highly available web application across multiple AWS regions. The application uses an Application Load Balancer in each region. Which TWO services can be used to route traffic to the closest regional load balancer based on latency?

Accepted Answer

AWS Global Accelerator. Option A (AWS Global Accelerator) is correct because it uses the AWS global network and anycast IP addresses to route user traffic to the optimal regional endpoint based on latency and health, and it can front Application Load Balancers in multiple regions. Option D (Amazon Route 53 latency-based routing) is correct because it returns the regional record whose AWS Region has the lowest measured latency to the requesting resolver, directing users to the closest regional ALB. Option B (geoproximity routing) routes based on geographic location and optional bias, not measured network latency, so it does not meet the stated requirement. Option C (weighted routing) distributes traffic by assigned proportions regardless of latency, so it is not latency-based. Option E (CloudFront with origin groups) is for origin failover within a distribution and does not route to the closest regional load balancer by latency.

Answer

Amazon Route 53 geoproximity routing

Answer

Amazon Route 53 weighted routing

Answer

Amazon CloudFront with origin groups

Question 3

Refer to the exhibit. A SysOps administrator runs the command shown to investigate a CloudWatch alarm named 'HighCPU'. What does the output indicate?

Accepted Answer

The alarm entered the ALARM state and then returned to OK.. The output shows two state transition datapoints: one at timestamp 2021-03-15T10:30:00Z with 'oldState' OK and 'newState' ALARM, and another at 2021-03-15T10:35:00Z with 'oldState' ALARM and 'newState' OK. This sequence confirms the alarm entered the ALARM state and then returned to OK, which is exactly what the describe-alarm-history command reveals when an alarm has experienced a full ALARM-to-OK cycle.

Answer

The alarm was deleted and recreated.

Answer

The alarm is currently in INSUFFICIENT_DATA state.

Answer

The alarm never entered the ALARM state.

Question 4

An administrator uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error: "The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems." The deployment group has a minimum of 2 instances. What should the administrator check first?

Accepted Answer

The deployment logs on the individual EC2 instances.. The error message indicates that too many individual instances failed deployment. The first step is to check the deployment logs on the individual EC2 instances to identify the specific failure reason, such as script errors, missing dependencies, or permissions issues. This provides the most direct insight into why instances are failing.

Answer

The application revision's compatibility with the instance operating system.

Answer

The Auto Scaling group's health check settings.

Answer

The deployment group's deployment configuration settings.

Question 5

A company has an S3 bucket policy as shown. A developer tries to upload an object using the AWS CLI without the --no-verify-ssl flag. What will happen?

Accepted Answer

The upload will succeed because the CLI uses HTTPS by default.. The bucket policy denies requests that do not use secure transport (HTTP) but allows HTTPS requests. The AWS CLI uses HTTPS by default, and since the developer did not use --no-verify-ssl, the request is made over HTTPS. Therefore, the upload succeeds. Option D is correct. Option A is incorrect because the CLI uses HTTPS, not HTTP. Option B is incorrect because the policy does not deny all s3:* actions; it only denies requests over HTTP. Option C is incorrect because the policy requires HTTPS, and the CLI complies, so the upload does not fail.

Answer

The upload will succeed only if the developer uses HTTP.

Answer

The upload will fail because the policy denies all s3:* actions.

Answer

The upload will fail because the policy requires explicit HTTPS.

Question 6

A company uses AWS Elastic Beanstalk for a Java application. The environment uses a custom platform. The SysOps administrator wants to update the environment's configuration to use a larger instance type to handle increased load. What is the correct way to perform this change with minimal downtime?

Accepted Answer

Use the Elastic Beanstalk console to update the instance type and choose a rolling update strategy.. Elastic Beanstalk allows you to update the environment's configuration, such as instance type, via the console or CLI. To minimize downtime, you can choose a rolling update strategy, which updates instances in batches, ensuring that the environment remains available throughout the process. Option B is incorrect because manually SSHing into instances is not a scalable or persistent solution; Elastic Beanstalk manages the instances and changes may not survive environment updates. Option C is incorrect because terminating all instances causes complete downtime until the new instances are launched. Option D is incorrect because while creating a new environment and swapping URLs (blue/green deployment) can achieve zero downtime, it is more complex and resource-intensive than necessary for a simple instance type change, and the question asks for minimal downtime with correct method.

Answer

SSH into each instance and modify the instance type manually.

Answer

Terminate all instances and launch new ones with the larger instance type.

Answer

Create a new environment with the larger instance type and swap the environment URLs.

Question 7

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive data in an S3 bucket. The security team has mandated that all data in transit to the S3 bucket must be encrypted using TLS. The SysOps administrator configured the application to use HTTPS endpoints for S3. However, a security audit reveals that some requests to S3 are still being sent over HTTP. The administrator checks the VPC Flow Logs and sees that the EC2 instances are communicating with the S3 bucket via a VPC endpoint. The company also uses an S3 bucket policy that allows access only from the VPC endpoint. What is the most likely reason that some requests are sent over HTTP?

Accepted Answer

The application is not configured to use HTTPS for all S3 requests.. The VPC endpoint for S3 does not automatically encrypt traffic; encryption is handled at the application level. The application must be configured to use HTTPS for all S3 requests. Even though the administrator configured the application to use HTTPS endpoints, some requests may still be sent over HTTP if the application has fallback logic or uses an SDK that defaults to HTTP in certain cases. Option A is incorrect because the VPC endpoint itself does not encrypt traffic; encryption is an application-layer function. Option B is incorrect because VPC endpoints are not configured for HTTP or HTTPS; they use AWS API calls which can be made over either protocol depending on the client. Option C is incorrect because the S3 bucket policy does not require HTTPS; it only restricts access to the VPC endpoint, not the protocol.

Answer

The VPC endpoint is not encrypting traffic between the instances and the endpoint.

Answer

The VPC endpoint is configured for HTTP instead of HTTPS.

Answer

The S3 bucket policy does not require HTTPS for requests.

Question 8

A company needs to monitor the CPU and memory utilization of its EC2 instances. Which TWO services can be used to collect and visualize these metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the native AWS monitoring service that collects and stores metrics such as CPU utilization and memory utilization from EC2 instances. However, by default, CloudWatch only captures hypervisor-level metrics (like CPU) and not in-guest metrics (like memory utilization). To collect memory utilization, you must install the Amazon CloudWatch Agent on the instance, which sends custom metrics to CloudWatch. Together, CloudWatch and the CloudWatch Agent provide both collection and visualization of CPU and memory metrics.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Systems Manager

Question 9

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM users in any member account can create access keys for themselves. What is the MOST efficient way to enforce this policy across all accounts?

Accepted Answer

Create an SCP that denies the iam:CreateAccessKey action and attach it to the root organizational unit.. A service control policy (SCP) can be applied at the root or to specific OUs to deny IAM actions across all member accounts. Option A is correct because it centrally restricts the action. Option B is wrong because it only works for the master account. Option C is wrong because it requires individual account configuration. Option D is wrong because while AWS Config and Lambda can detect and remediate access key creation, this is a reactive approach and not the most efficient preventive control. SCPs proactively deny the action before it occurs, making them more efficient for enforcing this policy across all accounts.

Answer

Apply an IAM policy to the master account's root user that denies access key creation.

Answer

Enable AWS Trusted Advisor security checks and follow the recommendations.

Answer

Use AWS Config to detect access key creation and automatically delete the keys using a Lambda function.

Question 10

A company uses an IAM policy that allows s3:GetObject for a specific bucket. However, an IAM user is getting an Access Denied error when trying to download an object. The bucket policy also allows s3:GetObject for the user's account. What is the most likely cause?

Accepted Answer

The bucket policy has a Deny statement that applies to the user.. The most likely cause because if the bucket policy has a Deny statement that applies to the user, that explicit denial overrides any allow from the IAM policy or the bucket policy. Option A is incorrect because s3:GetObjectVersion is not required to download the current version; s3:GetObject is sufficient. Option C is incorrect because there is no indication that the object is encrypted with KMS, and even if it were, the error would be different (e.g., 'AccessDenied' due to missing KMS permissions, but the scenario explicitly says Access Denied from S3). Option D is incorrect because SCPs apply to the entire account, but the question states that both IAM and bucket policies allow access, so an SCP denial would be possible, but it is not the most likely cause given the explicit allow statements and the fact that a bucket-level Deny is more direct.

Answer

The IAM policy does not include the s3:GetObjectVersion action.

Answer

The object is encrypted with a customer-managed KMS key, and the user does not have kms:Decrypt permissions.

Answer

The user's account is part of an AWS Organization with an SCP that denies s3:GetObject.

Question 11

An application running on EC2 instances occasionally throws 'Connection refused' errors when connecting to an RDS database. The SysOps administrator needs to determine if the issue is due to database connection limits or network security groups. Which metrics and logs should the administrator examine?

Accepted Answer

Examine the RDS CloudWatch metric DatabaseConnections and analyze VPC Flow Logs for the EC2 instance's network interface.. 'Connection refused' errors typically stem from either the database exhausting its maximum connections or network-level security groups blocking traffic. The RDS CloudWatch metric `DatabaseConnections` directly shows the current number of active connections against the instance's `max_connections` limit, while VPC Flow Logs capture whether packets are being accepted or rejected by security groups or network ACLs, pinpointing network blockages.

Answer

Check CloudWatch RDS CPUUtilization and CloudTrail logs for RDS API calls.

Answer

Review RDS error logs in CloudWatch Logs and check the EC2 instance's system log.

Answer

Look at the EC2 instance's CloudWatch NetworkIn and NetworkOut metrics and RDS FreeableMemory metric.

Question 12

A SysOps administrator notices that an EC2 instance's CPU utilization is consistently above 90% during business hours. The instance is part of an Auto Scaling group with a scaling policy based on average CPU utilization. Despite high utilization, no scaling events are triggered. What is the most likely cause?

Accepted Answer

The scaling policy has a cooldown period that is too long, preventing new scaling activities.. The most likely cause is that the scaling policy has a cooldown period that is too long. After a scaling activity completes, the Auto Scaling group enters a cooldown period that prevents additional scaling activities from being triggered until the cooldown expires. If the cooldown period is set too long (e.g., 600 seconds or more), the group will not launch new instances even if the CloudWatch alarm remains in ALARM state with high CPU utilization, because the scaling policy is blocked from executing.

Answer

The instance type is not supported by the Auto Scaling group's launch configuration.

Answer

The CloudWatch alarm is in the ALARM state but the Auto Scaling group has a suspended process for Add instances.

Answer

The Auto Scaling group's health check type is set to ELB, causing the instance to be marked unhealthy.

Question 13

A company wants to host a static website on AWS with high availability and low latency for global users. Which service should be used to serve the static content?

Accepted Answer

Amazon S3 bucket configured for static website hosting, with Amazon CloudFront.. Amazon S3 static website hosting serves the HTML/CSS/JS objects directly from the bucket, and fronting it with Amazon CloudFront caches content at global edge locations, delivering low latency and high availability. This combination is the canonical AWS pattern for globally distributed static sites because it removes server management and scales automatically.

Answer

AWS Lambda with API Gateway.

Answer

Amazon Route 53 with a simple routing policy.

Answer

EC2 instances behind an Application Load Balancer.

Question 14

Developers are allowed to create IAM roles for their Lambda functions. However, the security team is concerned that developers could create roles with Administrator access, granting Lambda functions more permissions than the developers themselves have. What IAM feature prevents privilege escalation in this scenario?

Accepted Answer

Attach a permission boundary to each developer IAM user that limits them to creating roles with only the permissions they are allowed to grant. Permission boundaries are an IAM feature that allow you to set the maximum permissions that an identity-based policy can grant to a principal. By attaching a permission boundary to each developer IAM user that restricts them to creating roles with only the permissions they are allowed to grant, you prevent the developer from creating a Lambda execution role with AdministratorAccess or any other policy that exceeds the boundary. This directly addresses the privilege escalation concern because the boundary acts as a ceiling on the permissions the developer can delegate to the role.

Answer

Enable IAM Access Analyzer to detect when developers create overly permissive roles

Answer

Require MFA for all IAM API calls so developers must re-authenticate before creating roles

Answer

Enable CloudTrail logging for all IAM API calls and set up a CloudWatch alarm for iam:CreateRole events

Question 15

A company uses AWS CodePipeline to deploy a web application. The pipeline includes a stage that runs a database migration script. The SysOps administrator wants to ensure that if the migration script fails, the entire pipeline stops and the previous version of the application remains deployed. Which pipeline stage configuration should be used to achieve this behavior?

Accepted Answer

Configure the migration step as a sequential action and set the OnFailure to ABORT.. Setting the migration step as a sequential action with OnFailure set to ABORT ensures that if the migration script fails, the pipeline immediately stops and does not proceed to any subsequent stages. This prevents the deployment of a new application version that depends on a failed database migration, thereby keeping the previous version deployed.

Answer

Use a parallel action group for the migration step so other steps continue.

Answer

Configure the migration step as a sequential action and set the OnFailure to ROLLBACK.

Answer

Use a manual approval step after the migration to verify success.