SOA-C02 Practice Test 48 — 15 Questions

Question 1

A SysOps administrator notices that a Lambda function is timing out after 30 seconds. The function processes large files from S3. How can the administrator improve performance while minimizing cost?

Accepted Answer

Increase the memory allocation of the Lambda function.. Increasing the memory allocation of the Lambda function also proportionally increases the allocated CPU power, which directly reduces the execution time for CPU-bound tasks like processing large files. This often resolves timeout issues without incurring additional cost per invocation, as the cost is a product of memory and duration, and a faster execution can offset the higher memory price.

Answer

Increase the timeout value to 5 minutes.

Answer

Enable Provisioned Concurrency.

Answer

Deploy the function on an EC2 instance.

Question 2

A company has a VPC with public and private subnets across three Availability Zones. The public subnets host NAT Gateways, and the private subnets host EC2 instances that need to access the internet. The SysOps administrator notices that EC2 instances in one private subnet cannot reach the internet, while others can. What is the MOST likely cause?

Accepted Answer

The route table for the private subnet does not have a default route to the NAT Gateway.. The most likely cause is that the route table associated with the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic destined for the internet has no path and fails. Option A is incorrect because secondary private IP addresses do not affect internet access. Option B is incorrect because NAT Gateways must be in a public subnet (not private) to have internet access. Option C is incorrect because network ACLs are stateless and would affect all instances equally, not just those in one subnet.

Answer

The EC2 instances have a secondary private IP address that is not registered.

Answer

The NAT Gateway is not in a public subnet.

Answer

The network ACL for the private subnet blocks outbound traffic.

Question 3

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The administrator needs to store and reference sensitive data such as database passwords in the stack without hardcoding them in the template. Which CloudFormation feature should be used?

Accepted Answer

Use AWS Systems Manager Parameter Store secure strings and dynamic references in the CloudFormation template. AWS CloudFormation supports dynamic references (using the `resolve:ssm` or `resolve:ssm-secure` syntax) that allow you to reference Systems Manager Parameter Store secure strings directly in the template. This keeps sensitive data like database passwords out of the template and the stack's metadata, ensuring they are not exposed in plaintext during stack operations or in the console.

Answer

Use AWS Secrets Manager and reference the secret using a static reference in the template

Answer

Define plaintext parameters in the template and mark them as NoEcho

Answer

Store the secrets in an encrypted S3 object and reference it via a URL in the template

Question 4

A company has deployed a web application behind an Application Load Balancer (ALB) across multiple Availability Zones. Users in some regions report slow page load times. Which action should the SysOps Administrator take to improve performance for all users?

Accepted Answer

Use AWS Global Accelerator to route traffic over the AWS global network.. AWS Global Accelerator improves performance by directing traffic over the AWS global network and using edge locations close to users, reducing latency for all users. Option A is correct because it optimizes the path from users to the application. Option B is incorrect because increasing ALB capacity only helps with handling more requests, not latency for geographically distant users. Option C is incorrect because CloudFront is primarily for caching static content, and the application serves dynamic content that may not be cacheable. Option D is incorrect because moving to a single Availability Zone reduces fault tolerance and does not address latency for users far from that zone.

Answer

Increase the ALB capacity by adding more target instances.

Answer

Enable Amazon CloudFront to cache dynamic content.

Answer

Move the application to a single Availability Zone to reduce network hops.

Question 5

A company runs a critical e-commerce application on Amazon ECS with Fargate launch type, fronted by an Application Load Balancer. The application uses an Amazon ElastiCache for Redis cluster for session state and an Amazon RDS for MySQL Multi-AZ database for persistent data. Recently, during a deployment of a new service version, the application became unresponsive for 15 minutes. The SysOps administrator discovered that the deployment updated the task definition with a new environment variable that pointed to an incorrect ElastiCache endpoint. The ECS service was configured with a rolling update, minimum healthy percent of 50%, and maximum percent of 200%. After the deployment, all tasks failed health checks due to a connection timeout to the wrong Redis endpoint. What is the MOST effective way to prevent this issue in future deployments?

Accepted Answer

Implement a blue/green deployment strategy using AWS CodeDeploy and test the new task definition before shifting traffic.. Implementing a blue/green deployment with AWS CodeDeploy allows testing the new task definition in a separate target group before shifting traffic. If the new tasks fail health checks (e.g., due to incorrect ElastiCache endpoint), traffic remains on the blue environment, preventing application downtime. Option A is incorrect because a CloudWatch alarm only triggers an alert or rollback after the issue occurs; it does not prevent the deployment from impacting users. Option B is incorrect because updating one task at a time (canary) still exposes tasks to the wrong configuration, and since the minimum healthy percent is 50%, at least half the tasks would fail before detection. Option D is incorrect because the ECS deployment circuit breaker rolls back only after the deployment fails, but it does not prevent the initial impact during the rolling update.

Answer

Configure a CloudWatch alarm that triggers an automatic rollback if the error rate exceeds 10%.

Answer

Update the ECS service to use a canary deployment by updating one task at a time.

Answer

Enable ECS deployment circuit breaker and set the rollback configuration to automatically roll back failed deployments.

Question 6

A company uses AWS CloudFormation to deploy infrastructure. A SysOps admin wants to receive a notification when a stack update fails. Which approach is the most efficient?

Accepted Answer

Create an EventBridge rule that matches CloudFormation stack events. Amazon EventBridge can directly capture CloudFormation stack events (e.g., CREATE_FAILED, UPDATE_FAILED) in real time and trigger a notification via SNS or Lambda. This approach is serverless, requires no polling, and is the most efficient method for reacting to stack update failures as they occur.

Answer

Write a script that polls the CloudFormation API and sends notifications

Answer

Use AWS Config to monitor stack resources

Answer

Enable CloudTrail and create a metric filter for stack update failures

Question 7

A company has a web application behind an Application Load Balancer (ALB) with sticky sessions enabled. The ALB's target group contains EC2 instances in an Auto Scaling group. After a deployment, users report that they are being logged out frequently. What is the most likely cause?

Accepted Answer

The ALB's stickiness cookie is not configured or is being overwritten.. Sticky sessions (session affinity) rely on a cookie generated by the ALB (AWSALB) to route subsequent requests from a user to the same target. If the cookie is not configured or is overwritten (e.g., by the application after deployment), the ALB treats each request as new and may route to different instances, causing the user to be logged out. Option A is incorrect because deregistration delay controls how long the ALB waits before deregistering an instance, which does not affect existing sessions unless instances are being removed. Option C is incorrect because while frequent health checks may cause instances to be marked unhealthy, this would result in connection errors or routing to other instances, but it does not explain logouts due to sticky session loss. Option D is incorrect because cross-zone load balancing distributes traffic across zones but does not affect session stickiness.

Answer

The deregistration delay is set too low.

Answer

Health checks are too frequent and marking instances unhealthy.

Answer

Cross-zone load balancing is disabled.

Question 8

Which TWO AWS services can be used to monitor the performance of an Amazon RDS database and set alarms based on metrics?

Accepted Answer

Amazon RDS Performance Insights. Amazon CloudWatch (Option D) is the primary monitoring service for AWS resources, including Amazon RDS. It collects metrics like CPU utilization, database connections, and read/write latency, and allows you to set CloudWatch Alarms that trigger actions (e.g., SNS notifications) when thresholds are breached. Amazon RDS Performance Insights (Option B) provides deeper database performance analysis by visualizing database load and identifying bottlenecks, and it can also publish metrics to CloudWatch for alarm purposes.

Answer

AWS Lambda

Answer

Amazon S3

Answer

AWS CloudTrail

Question 9

A security policy prohibits opening SSH port 22 on any EC2 instance. The operations team needs to run a shell script on 150 Linux instances to collect configuration inventory data. The script output must be captured for review. How should the team execute the script?

Accepted Answer

Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket. SSM Run Command with the AWS-RunShellScript document allows you to execute shell scripts on multiple EC2 instances without opening SSH port 22, as it operates over the AWS Systems Manager agent (SSM Agent) using HTTPS (port 443). The output can be directed to an S3 bucket for centralized review, satisfying both the security policy and the requirement to capture script output.

Answer

Create a bastion host with SSH access and use a for loop to SSH into each instance and run the script

Answer

Use EC2 Instance Connect to establish a temporary SSH session for each instance and run the script

Answer

Terminate all instances and re-launch them from a new AMI that includes the configuration inventory already baked in

Question 10

A company runs a critical application on an EC2 instance that stores data on an EBS volume. The SysOps administrator needs to implement a backup strategy that provides the ability to restore the volume to a specific point in time within the last 24 hours, with a recovery time objective (RTO) of less than 15 minutes. Which solution meets these requirements?

Accepted Answer

Schedule EBS snapshots every hour and keep them for 24 hours.. Scheduling EBS snapshots every hour and retaining them for 24 hours provides point-in-time recovery granularity within the last 24 hours. EBS snapshots are incremental, stored in Amazon S3, and can be used to create a new volume or restore an existing one; restoring from a snapshot typically takes only a few minutes, meeting the RTO of less than 15 minutes.

Answer

Configure a RAID 1 mirror of the EBS volume across two Availability Zones.

Answer

Enable automated backups on the EC2 instance.

Answer

Use AWS Backup to create backup plans for the EBS volume.

Question 11

Refer to the exhibit. A SysOps administrator runs the command to list running EC2 instances. What is the purpose of the '--query' parameter?

Accepted Answer

It filters the output to show only specified fields.. The AWS CLI '--query' parameter uses JMESPath to filter and shape the JSON response returned by the API call, so it controls which fields appear in the output. It does not change what the API returns from the server; it only transforms the client-side presentation. This is why it is described as filtering the output to show only specified fields.

Answer

It filters the results on the server side.

Answer

It limits the API call to only running instances.

Answer

It saves the output to a file.

Question 12

A SysOps administrator needs to monitor the disk usage on Amazon EC2 instances running Linux. The administrator wants to collect disk utilization metrics every 5 minutes and set up an alarm when disk usage exceeds 80%. Which solution meets these requirements?

Accepted Answer

Install the Amazon CloudWatch Agent on the instances and configure it to collect disk metrics.. The Amazon CloudWatch Agent is required to collect custom metrics like disk utilization from EC2 instances. It can be configured to gather disk space metrics every 5 minutes and publish them to CloudWatch, where an alarm can be set to trigger when usage exceeds 80%. EC2 detailed monitoring only collects hypervisor-level metrics (CPU, network, disk I/O), not guest OS-level disk usage.

Answer

Use the EC2 detailed monitoring feature to collect disk metrics.

Answer

Use AWS Systems Manager Patch Manager to check disk space.

Answer

Configure an Amazon CloudWatch metric filter on the system log.

Question 13

A company uses a centralized logging solution with Amazon OpenSearch Service. The log volume has grown significantly, increasing costs. The logs are retained for 90 days for compliance, but only the last 30 days are frequently accessed. Which combination of actions would reduce costs without compromising compliance?

Accepted Answer

Migrate indices older than 30 days to UltraWarm nodes.. Migrating indices older than 30 days to UltraWarm nodes reduces storage costs because UltraWarm provides cost-effective storage for infrequently accessed data. This retains data for the full 90-day compliance period while keeping the last 30 days in hot storage for fast access. Option A is incorrect because moving logs to S3 Glacier would make querying impractical and is not designed for OpenSearch. Option B is incorrect because increasing data nodes would increase costs without addressing storage optimization. Option D is incorrect because deleting indices after 30 days would violate the 90-day retention requirement.

Answer

Move the logs to Amazon S3 Glacier and use a Lambda function to query them.

Answer

Increase the number of data nodes to improve indexing performance.

Answer

Configure an index lifecycle policy to delete indices older than 30 days.

Question 14

A company is using AWS Lambda functions to process events from Amazon S3. The functions are invoked several thousand times per minute. The SysOps administrator notices that the functions are taking longer to execute during peak times. Which action should the administrator take to improve performance?

Accepted Answer

Increase the memory allocation for the Lambda functions.. Increasing the memory allocation for a Lambda function also proportionally increases its CPU allocation, which can improve execution speed for compute-bound tasks, such as processing events from S3 during peak times. Option A is incorrect because increasing the timeout only allows the function to run longer, but does not make it faster. Option B is incorrect because Lambda abstracts the underlying infrastructure; you cannot choose EC2 instance types. Option D is incorrect because provisioned concurrency reduces cold starts but does not affect the execution time of warm functions.

Answer

Increase the Lambda function timeout.

Answer

Use a larger EC2 instance type for the Lambda functions.

Answer

Enable provisioned concurrency on the Lambda functions.

Question 15

A company is running a production web application on EC2 instances behind an ALB. The application experiences predictable traffic spikes during business hours. Which cost optimization strategy would be MOST effective?

Accepted Answer

Configure Scheduled Scaling to add instances before the spike and remove after.. The most effective cost optimization strategy because Scheduled Scaling allows you to increase capacity predictably before traffic spikes and decrease afterward, ensuring you only pay for what you need. Option B is incorrect because Spot Instances can be interrupted and are not suitable for production workloads that require high availability. Option C is incorrect because using larger instances does not dynamically adjust to spikes and may lead to over-provisioning during low traffic. Option D is incorrect because On-Demand instances are more expensive than using scheduled scaling with a mix of Reserved Instances or Savings Plans to cover the baseline and scheduled scaling for the spikes.

Answer

Use Spot Instances for the entire workload.

Answer

Use larger instance types to handle the spikes without scaling.

Answer

Use On-Demand instances exclusively to handle the spikes.