SOA-C02 Practice Test 50 — 15 Questions

Question 1

Regulatory requirements mandate that all RDS and EBS backups are replicated to a secondary AWS region within 24 hours of creation. The company has workloads in us-east-1 and must replicate backups to eu-west-1. Restoring from the secondary region must be possible without manual copying steps during a disaster. What service and configuration implements this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an AWS Backup plan with a cross-Region copy rule that replicates recovery points to a backup vault in eu-west-1 within 24 hours. AWS Backup is the correct service because it natively supports cross-Region copy rules that automatically replicate recovery points (including RDS snapshots and EBS snapshots) to a backup vault in a secondary Region within a specified time window. This meets the 24-hour replication requirement and enables direct restores from the secondary Region without manual copying, as the backup vault in eu-west-1 contains the replicated recovery points ready for use.

Answer

Schedule a Lambda function that calls CreateDBSnapshot and CopyDBSnapshot to replicate RDS snapshots, and CreateSnapshot and CopySnapshot for EBS volumes to eu-west-1

Answer

Enable RDS automated backups with cross-region replication and configure EBS snapshot copy separately using Data Lifecycle Manager

Answer

Use S3 Cross-Region Replication to replicate the backup bucket containing RDS and EBS snapshots to eu-west-1

Question 2

A company uses multiple AWS accounts and needs to generate a detailed cost and usage report that can be queried using Amazon Athena for custom analysis. Which AWS service should the administrator enable?

Accepted Answer

AWS Cost and Usage Reports. AWS Cost and Usage Reports (CUR) is the correct service because it generates detailed cost and usage data in CSV or Parquet format, which can be directly queried using Amazon Athena via integration with AWS Glue and Amazon QuickSight. This enables custom analysis and ad-hoc queries on the full billing dataset, unlike other services that provide pre-aggregated views or alerts.

Answer

AWS Cost Explorer

Answer

AWS Budgets

Answer

AWS Application Cost Profiler

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences variable traffic with occasional spikes. The SysOps administrator wants to optimize costs while ensuring that the application can handle spikes without performance degradation. The current setup uses a fixed number of instances. Which action should the administrator take?

Accepted Answer

Implement an Auto Scaling group with a target tracking scaling policy based on ALB request count per target.. An Auto Scaling group with a target tracking policy based on ALB request count per target automatically scales instances in and out to match traffic, handling spikes while minimizing cost during low-traffic periods. This directly addresses variable traffic with occasional spikes.

Answer

Purchase Reserved Instances for the current number of instances to reduce hourly cost.

Answer

Replace on-demand instances with Spot Instances for all traffic.

Answer

Increase the instance size to a compute-optimized type to handle spikes.

Question 4

A company is using Amazon RDS for MySQL with Multi-AZ deployment. They want to optimize costs while maintaining high availability. Which TWO actions should the SysOps administrator take?

Accepted Answer

Purchase Reserved Instances for the database instance.. Option A is correct because purchasing Reserved Instances for the RDS DB instance provides a significant discount (up to ~69% for 3-year All Upfront terms) compared to On-Demand pricing, directly reducing cost while leaving the Multi-AZ high-availability configuration fully intact. Option D is correct because rightsizing the DB instance class (for example, moving from db.m5.xlarge to db.m5.large) eliminates spend on over-provisioned CPU/memory, and it can be done with a modification that preserves the Multi-AZ standby, so high availability is maintained. Option B is wrong because removing Multi-AZ sacrifices the synchronous standby replica and automatic failover, violating the requirement to maintain high availability. Option C is wrong because RDS does not support auto scaling of the DB instance itself; only storage can be auto scaled, and read scaling requires Read Replicas, not instance auto scaling. Option E is wrong because a Single-AZ deployment plus snapshots is not highly available—snapshot restore creates a new instance and involves substantial RPO/RTO, so it fails the availability requirement.

Answer

Remove Multi-AZ to reduce costs.

Answer

Enable auto scaling for the RDS instance to handle variable load.

Answer

Move to a single-AZ deployment and take snapshots for recovery.

Question 5

Which THREE components are required to establish a site-to-site VPN connection between an AWS VPC and an on-premises network? (Choose three.)

Accepted Answer

Customer gateway (CGW). A customer gateway (CGW) is required because it represents the on-premises side of the site-to-site VPN connection. It provides the public IP address and BGP ASN (if dynamic routing is used) of the on-premises VPN device, allowing AWS to establish IPsec tunnels with the correct endpoint.

Answer

Transit gateway

Answer

AWS Direct Connect

Question 6

Which TWO actions can be taken to improve the availability of a web application hosted on EC2 instances behind an Application Load Balancer? (Select two.)

Accepted Answer

Configure an Auto Scaling group with health checks to replace unhealthy instances.. Option A is correct because an Auto Scaling group configured with health checks (ELB or EC2 health checks) automatically detects and replaces unhealthy instances, maintaining the desired capacity and thus improving availability. Option C is correct because deploying EC2 instances across multiple Availability Zones provides fault isolation; if one AZ fails, the Application Load Balancer routes traffic to healthy instances in other AZs, maintaining availability. Option B is incorrect because larger instance types increase capacity/performance but do not address redundancy or failure recovery. Option D is incorrect because using a single Region does not improve availability against AZ-level failures and is not a redundancy measure. Option E is incorrect because placing all instances in a single subnet concentrates them in one AZ, reducing availability and creating a single point of failure.

Answer

Use larger EC2 instance types.

Answer

Use a single AWS Region for all instances.

Answer

Place all EC2 instances in a single subnet.

Question 7

A company has an Amazon S3 bucket that stores critical data. The security team wants to be notified whenever an object in the bucket is deleted. Which solution should the SysOps administrator implement?

Accepted Answer

Enable CloudTrail data events for the S3 bucket, create a CloudWatch Events rule for 'DeleteObject' API calls, and send notifications via SNS.. It uses CloudTrail data events to capture 'DeleteObject' API calls specifically for the S3 bucket, then routes those events via CloudWatch Events to an SNS topic for notification. This provides a reliable, real-time notification mechanism for object deletions without requiring custom code or post-hoc analysis.

Answer

Configure an S3 event notification for 's3:ObjectRemoved:*' events to trigger an AWS Lambda function that sends an email.

Answer

Use AWS Config to monitor S3 bucket resources and trigger an SNS notification on configuration changes.

Answer

Enable S3 server access logs and use Amazon Athena to query for delete events, then send notifications.

Question 8

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones in us-east-1. The application stores data in an Amazon RDS for MySQL DB instance with Multi-AZ deployment. The SysOps administrator needs to design a disaster recovery strategy that can recover from a complete regional outage. The Recovery Time Objective (RTO) is 2 hours and the Recovery Point Objective (RPO) is 1 hour. Which solution should the administrator implement?

Accepted Answer

Configure cross-region automated backups for the RDS instance with a backup window. Deploy an identical infrastructure stack in a second region using AWS CloudFormation StackSets. Create an Amazon Route53 DNS failover record set with health checks to automatically fail over to the second region.. It meets both the RTO of 2 hours and RPO of 1 hour. Cross-region automated backups for RDS provide an RPO of 1 hour or less by continuously backing up transaction logs to a secondary region. Deploying an identical infrastructure stack via CloudFormation StackSets ensures rapid provisioning in the secondary region, and Route53 DNS failover with health checks automates traffic redirection within the RTO window.

Answer

Create a read replica of the RDS instance in a second region. Configure an Amazon CloudFront distribution with the ALB as origin. Use Route53 failover routing policy to route traffic to the CloudFront distribution.

Answer

Take daily manual snapshots of the RDS instance and copy them to a second region. Store the AWS CloudFormation template for the infrastructure in an S3 bucket with cross-region replication. In the event of a disaster, manually deploy the stack and restore the snapshot.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to a second region. Use an Application Load Balancer in the primary region and a Network Load Balancer in the secondary region. Create a Route53 weighted routing policy to distribute traffic.

Question 9

A SysOps administrator is setting up a Network Load Balancer (NLB) to handle millions of requests per second. The target group consists of EC2 instances that are in a single Availability Zone. Which of the following is a potential issue?

Accepted Answer

If the single AZ becomes unavailable, the NLB will not automatically fail over to other AZs.. Option A is the correct answer because if the NLB is provisioned in a single Availability Zone (AZ) and that AZ fails, the NLB will not automatically fail over to other AZs, which is a potential issue for high availability. Option B is incorrect because an NLB can be associated with only one AZ. Option C is incorrect because the NLB can preserve the source IP address when using instance targets. Option D is incorrect because the NLB can handle high throughput even in a single AZ.

Answer

The NLB cannot be associated with only one Availability Zone.

Answer

The NLB cannot preserve the source IP address of the client.

Answer

The NLB will not be able to handle the traffic volume due to the single AZ limitation.

Question 10

A company uses Amazon CloudFront to serve static content from an S3 bucket. The S3 bucket is configured as an origin with RestrictBucketAccess set to Yes, and the origin access identity (OAI) is configured. Users can access the content via CloudFront, but direct S3 URLs return Access Denied. However, some users report that they can still access the content directly via S3 URLs. What is the most likely reason?

Accepted Answer

The S3 bucket policy allows public read access in addition to the OAI.. The most likely reason users can still access content directly via S3 URLs is that the S3 bucket policy allows public read access in addition to the OAI. Even though CloudFront is configured with OAI and RestrictBucketAccess, if the bucket policy grants public read permissions (e.g., via a statement with Principal: "*"), then direct S3 access remains possible. The OAI only restricts access when the bucket policy explicitly denies public access and allows only the OAI.

Answer

The OAI is not properly associated with the CloudFront distribution.

Answer

The CloudFront distribution is using a custom origin instead of S3.

Answer

CloudFront is using pre-signed URLs that are being shared.

Question 11

Refer to the exhibit. An IAM policy is attached to a user. What is the effective permission regarding the s3:DeleteObject action on the example-bucket?

Accepted Answer

Denied because of the explicit Deny statement. The effective permission is Denied because of the explicit Deny statement. In AWS IAM policy evaluation, an explicit Deny always overrides any Allow, regardless of the order in which statements appear or whether the action is otherwise permitted. Since the policy contains an explicit Deny for s3:DeleteObject on example-bucket, the request is denied.

Answer

Denied because the action is not allowed explicitly

Answer

Allowed because the Allow statement is listed first

Answer

Allowed because the Deny statement has a typo

Question 12

Drag and drop the steps to migrate an on-premises application to AWS using AWS Application Migration Service (MGN) into the correct order.

Accepted Answer

Install the agent, then configure replication, then sync, then test, then cut over.. The correct sequence for migrating an on-premises application to AWS using AWS Application Migration Service is: first install the AWS Replication Agent on the source server, then configure the replication settings including launch settings and target VPC, then start the initial sync to replicate the entire server volume, then perform a test launch to validate the replicated environment, and finally initiate the cutover to redirect production traffic to the new AWS instance. Each step builds on the previous one to ensure a successful migration with minimal downtime.

Answer

Install the agent, then sync, then configure replication, then test, then cut over.

Answer

Configure replication, then install the agent, then sync, then test, then cut over.

Answer

Install the agent, then configure replication, then test, then sync, then cut over.

Question 13

An organization uses AWS Service Catalog to manage approved IT services. A SysOps administrator needs to update a CloudFormation template used by a product. The administrator wants to ensure that existing provisioned products are updated with the new template version. What step must the administrator take after updating the product?

Accepted Answer

Create a new product version and update the provisioned products to use the new version.. After updating a CloudFormation template used by an AWS Service Catalog product, the administrator must create a new product version and then update the existing provisioned products to use that new version. Service Catalog versions are immutable — you cannot edit an existing version in place. Existing provisioned products continue using the version they were launched with until explicitly updated, so the administrator must both publish the new version and perform the update on each provisioned product.

Answer

Update the portfolio that contains the product.

Answer

Update the product's CloudFormation template directly in the Service Catalog console.

Answer

Terminate the existing provisioned products and reprovision them.

Question 14

The security team requires that no S3 bucket in the account ever has public read or write ACLs enabled. They want non-compliant buckets automatically remediated within 5 minutes of detection without any manual intervention. What is the correct implementation?

Accepted Answer

Create an AWS Config rule for s3-bucket-public-read-prohibited; configure auto-remediation using the AWS-DisableS3BucketPublicReadWrite SSM Automation document. AWS Config can evaluate S3 bucket ACLs against the `s3-bucket-public-read-prohibited` managed rule and automatically trigger an AWS Systems Manager (SSM) Automation document (`AWS-DisableS3BucketPublicReadWrite`) as a remediation action. This ensures non-compliant buckets are fixed within minutes without manual intervention, meeting the 5-minute requirement.

Answer

Create an EventBridge rule that matches S3 PutBucketAcl API calls and triggers a Lambda function to re-apply a private ACL

Answer

Enable S3 Block Public Access at the account level to prevent public ACLs from being set in the first place

Answer

Schedule a daily Lambda function that lists all buckets, checks ACLs, and removes public grants if found

Question 15

A company runs a batch processing job every Saturday for 3 hours. The job can be interrupted and resumed at any point. The SysOps administrator wants to minimize compute costs for this workload. Which EC2 purchasing option should the administrator use?

Accepted Answer

Spot Instances. Spot Instances are ideal for fault-tolerant, interruptible workloads like batch processing that can be resumed. They offer significant cost savings (up to 90% compared to On-Demand) because they use spare EC2 capacity, which can be reclaimed by AWS with a 2-minute interruption notice. Since the job runs only 3 hours weekly and can be interrupted and resumed, Spot Instances minimize compute costs effectively.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Hosts