SOA-C02 Practice Test 49 — 15 Questions

Question 1

A SysOps administrator notices that an Amazon RDS for MySQL instance has high read activity. The application performs many read queries but few writes. The database is currently a single db.r5.large instance. What change would improve read performance and reduce cost?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a read replica and use a smaller instance type for the replica.. Creating a read replica offloads read traffic from the primary instance, improving performance for read-heavy workloads. Using a smaller instance type for the replica reduces cost compared to scaling up the primary. Option A is wrong because Multi-AZ provides high availability via a standby instance that cannot serve reads; it does not improve read performance. Option B (increasing instance size) is a vertical scaling approach that increases cost without the same cost-efficiency as a read replica. Option C is incorrect because migrating to DynamoDB would require application changes and may not be compatible with the existing MySQL schema and queries.

Answer

Enable Multi-AZ for high availability and use the standby for reads.

Answer

Increase the instance size to db.r5.xlarge.

Answer

Migrate the database to Amazon DynamoDB.

Question 2

A company has a fleet of EC2 instances in an Auto Scaling group behind an Application Load Balancer. The security team requires that all traffic to the instances be encrypted in transit. Currently, the ALB terminates HTTPS and forwards HTTP to the instances. The security team wants to ensure that the traffic between the ALB and the instances is also encrypted. What should the SysOps administrator do to meet this requirement with minimal changes?

Accepted Answer

Change the ALB listener to use HTTPS and configure the target group to use HTTPS with a self-signed certificate on the instances.. It encrypts traffic between the ALB and EC2 instances with minimal changes: you change the ALB listener to HTTPS and configure the target group to use HTTPS, using a self-signed certificate on the instances for encryption. Option A is incorrect because replacing the ALB with a Network Load Balancer is not minimal and adds complexity. Option B is incorrect because adding a CloudFront distribution introduces additional cost and overhead, not minimal. Option C is incorrect because setting up a VPN connection is overly complex and not necessary for this requirement.

Answer

Replace the ALB with a Network Load Balancer and use TLS termination on the instances.

Answer

Place a CloudFront distribution in front of the ALB and use HTTPS for all origins.

Answer

Set up a VPN connection between the ALB and the instances.

Question 3

A company requires all S3 uploads to use server-side encryption with a specific customer managed KMS key. What is the most direct enforcement mechanism?

Accepted Answer

Add a bucket policy that denies PutObject unless the required SSE-KMS headers and key ID are present.. A bucket policy with a condition that denies `s3:PutObject` unless the required `x-amz-server-side-encryption` header is set to `aws:kms` and the `x-amz-server-side-encryption-aws-kms-key-id` header matches the specific customer managed KMS key ARN is the most direct enforcement mechanism. This policy-based approach ensures that any upload attempt lacking the required SSE-KMS headers and key ID is rejected at the S3 API level, regardless of the IAM permissions of the uploader.

Answer

Enable S3 versioning only.

Answer

Enable S3 Transfer Acceleration.

Answer

Create an IAM user for every uploader with console access.

Question 4

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline consists of a source stage (AWS CodeCommit) and a deploy stage (AWS CodeDeploy) that deploys to an Auto Scaling group. The SysOps administrator needs to add a stage to run automated unit tests before the deployment proceeds. The tests must be executed in an isolated environment, and if they fail, the pipeline must stop and notify the development team. Which action should the administrator take?

Accepted Answer

Add a stage between source and deploy that uses an AWS CodeBuild action to run unit tests defined in a buildspec file. The pipeline will automatically stop if the build action fails.. AWS CodeBuild is natively integrated with CodePipeline to run automated tests defined in a buildspec file. When the build action fails, CodePipeline automatically stops the pipeline execution and can send notifications via Amazon SNS, meeting the requirement for an isolated test environment and automatic failure notification without manual intervention.

Answer

Add a manual approval action between the source and deploy stages. The development team will manually run the tests on their local machines and then approve the pipeline to proceed.

Answer

Insert a test stage after the source stage with an AWS CloudFormation action that deploys a test stack and runs tests using a custom resource Lambda function.

Answer

Add a Lambda function as an action in the pipeline that runs the unit tests. The Lambda function writes the test results to an S3 bucket, and a subsequent approval action checks the results.

Question 5

A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application uses Amazon EBS volumes (gp2) for data storage. The SysOps administrator notices that the storage costs are high, and the application's IOPS requirements are consistently below 3000. The administrator wants to reduce storage costs without affecting performance. Which action should the administrator take?

Accepted Answer

Convert the EBS volumes from gp2 to gp3 volume type.. Gp3 volumes offer a baseline performance of 3000 IOPS and 125 MB/s throughput at a lower cost than gp2 volumes, making them ideal for workloads with IOPS requirements consistently below 3000. By converting from gp2 to gp3, the administrator can reduce storage costs without any performance impact, as gp3 provides the same or better baseline performance at a lower price per GB.

Answer

Modify the EBS volumes to use Provisioned IOPS (io1) volumes and set IOPS to 2000.

Answer

Implement an Amazon EBS snapshot lifecycle policy to delete old snapshots and reduce storage costs.

Answer

Enable EBS optimization on the EC2 instances to improve throughput and reduce costs.

Question 6

A SysOps administrator manages a fleet of EC2 instances that run a batch processing job. The job runs every hour and takes about 45 minutes to complete. The administrator wants to be notified if any job takes longer than 1 hour. Currently, the administrator uses CloudWatch Logs to capture job start and end times from application logs. The job writes a log message at start with 'JOB_START' and at end with 'JOB_END'. The administrator wants to create a metric filter that counts jobs that exceed 1 hour. However, the administrator is unsure how to achieve this with CloudWatch Logs. What should the administrator do?

Accepted Answer

Use CloudWatch Events to capture the log events and trigger a Lambda function to compute duration.. CloudWatch Events (now part of Amazon EventBridge) can capture log events in real-time and trigger a Lambda function. The Lambda function can then compute job duration by correlating JOB_START and JOB_END events (e.g., using a DynamoDB table to store start times) and publish a custom metric or trigger an alarm if duration exceeds 1 hour. This approach handles the per-job correlation that metric filters cannot achieve.

Answer

Use CloudWatch Logs Insights to run a query every hour and check the duration.

Answer

Create a metric filter that extracts the timestamp of JOB_START and JOB_END and computes the duration in a custom metric.

Answer

Create a Lambda function that is triggered by S3 to process the logs and publish a custom metric.

Question 7

A company's security policy requires that only traffic from the corporate office IP range (203.0.113.0/24) can access an Amazon S3 bucket that stores internal reports. The SysOps administrator must enforce this restriction. Which policy type should be modified to implement this requirement?

Accepted Answer

S3 bucket policy. An S3 bucket policy is the correct choice because it allows you to explicitly deny or allow access to the S3 bucket based on the source IP address using the `aws:SourceIp` condition key. This policy is attached directly to the bucket and can restrict access to only the corporate office IP range (203.0.113.0/24), regardless of the IAM user or role making the request. It enforces the security requirement at the resource level, which is the most direct and effective method for controlling network-based access to an S3 bucket.

Answer

IAM identity-based policy

Answer

VPC endpoint policy

Answer

AWS Organizations SCP

Question 8

A SysOps administrator notices that the monthly bill for Amazon RDS is higher than expected. The environment includes multiple DB instances with low CPU and memory utilization. Which action will most effectively reduce costs while maintaining performance?

Accepted Answer

Resize the DB instances to a smaller instance class. The DB instances have low CPU and memory utilization, indicating they are over-provisioned. Resizing to a smaller instance class directly reduces the hourly compute cost without affecting performance, as the current workload does not require the larger instance's capacity.

Answer

Enable Multi-AZ deployment for high availability

Answer

Delete unused RDS snapshots

Answer

Provisioned IOPS (io1) storage for better performance

Question 9

An Auto Scaling group launches new EC2 instances when CPU exceeds 70 percent. The instances take 4 minutes to bootstrap (install software, register with a service discovery system, and warm up caches). Without a hook, the load balancer routes traffic to new instances before they are ready, causing 503 errors. What is the correct solution?

Accepted Answer

Add a lifecycle hook on the autoscaling:EC2_INSTANCE_LAUNCHING transition; signal CompleteLifecycleAction(CONTINUE) when bootstrap finishes. Lifecycle hooks allow the Auto Scaling group to pause instance launch until a custom action (e.g., bootstrap completion) is finished. By adding a hook on the autoscaling:EC2_INSTANCE_LAUNCHING transition, the instance is held in a 'pending:wait' state. Once the bootstrap script calls CompleteLifecycleAction with the CONTINUE result, the instance transitions to 'InService' and can then be registered with the load balancer, preventing premature traffic and 503 errors.

Answer

Increase the load balancer health check grace period to 10 minutes to give instances time to bootstrap

Answer

Increase the warm-up time in the Auto Scaling group's instance refresh configuration

Answer

Use a weighted target group with 0 weight for new instances until they are confirmed healthy

Question 10

Users are intermittently reporting 502 Bad Gateway errors when accessing the application through an Application Load Balancer. The team needs to identify which target IPs are associated with the failures and the request processing time for those requests. Application logs on instances do not capture failures before the ALB connection. What should be enabled?

Accepted Answer

Enable ALB access logs, specify an S3 bucket destination, and query the logs to filter on elb_status_code=502. ALB access logs capture detailed information about each request, including the target IP address, request processing time, and the HTTP status code returned by the ALB. By enabling these logs and querying for `elb_status_code=502`, you can identify which target IPs were associated with the failures and the `request_processing_time` for those requests. This directly addresses the need to correlate failures with specific targets and timing, without relying on application instance logs that miss pre-connection failures.

Answer

Enable AWS X-Ray on the ALB to trace each request end-to-end from client to target

Answer

Configure a VPC Flow Log on the subnets containing the ALB to capture all network traffic

Answer

Install an agent on the application instances that logs all incoming connection attempts from the ALB

Question 11

A security team applied Network ACL rules to a subnet to allow inbound TCP traffic on port 443 (HTTPS). Users connecting from the internet can initiate connections, but they never receive responses. The NACL is applied to the subnet containing the web servers. What is missing?

Accepted Answer

Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports. Network ACLs are stateless, meaning they evaluate each packet independently without tracking connection state. While the inbound rule allows HTTPS traffic (TCP 443) to reach the web servers, the outbound response traffic from the servers to the clients' ephemeral ports (typically 1024–65535) is blocked by the default deny-all outbound rule. Adding an outbound NACL rule allowing TCP traffic on destination ports 1024–65535 permits the response traffic to flow back to the clients, resolving the issue.

Answer

Enable stateful packet inspection on the NACL by toggling the 'track connections' setting in the VPC console

Answer

Add a security group outbound rule allowing all traffic because NACL rules only apply to inbound traffic

Answer

Change port 443 to allow both TCP and UDP protocols in the inbound NACL rule

Question 12

A company runs an Amazon RDS for MySQL DB instance in us-east-1. The SysOps administrator needs to implement a disaster recovery solution that can recover from a regional outage with a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of less than 1 minute. Which solution should the administrator use?

Accepted Answer

Aurora Global Database. Aurora Global Database is the correct choice because it provides a fully managed cross-region replication solution with a typical RPO of less than 1 second and an RTO of less than 1 minute during a regional failover. It uses a primary cluster in one region and up to five secondary clusters in other regions, with asynchronous replication that is optimized for low latency, meeting the stringent RPO/RTO requirements.

Answer

Multi-AZ deployment

Answer

Cross-region read replica

Answer

Automated snapshot copy to another region

Question 13

EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?

Accepted Answer

Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway. An S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.

Answer

Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately

Answer

Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway

Answer

Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT

Question 14

A company wants to securely store database credentials used by an application running on Amazon EC2. Which AWS service should be used to rotate and manage access to these secrets?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed specifically for storing, rotating, and managing access to secrets such as database credentials. It provides built-in rotation for supported databases (e.g., Amazon RDS, Redshift) and integrates with IAM for fine-grained access control. This makes it the ideal service for securely managing database credentials used by an application on EC2.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 15

A SysOps administrator wants to identify Amazon EC2 instances that are underutilized to reduce costs. The administrator needs recommendations for rightsizing instances based on historical CPU and memory usage. Which AWS service provides these recommendations?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it analyzes historical utilization metrics (CPU, memory, I/O, and network throughput) from Amazon CloudWatch and generates rightsizing recommendations for EC2 instances. It uses machine learning to identify underutilized instances and suggests instance types that better match workload requirements, directly addressing the need to reduce costs through rightsizing.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail