SOA-C02 Practice Questions 1 — 50 Questions

Question 1

A company needs to retain API call logs for 7 years for compliance. Which AWS service should be used to store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across your AWS infrastructure and can be configured to store logs in an S3 bucket with lifecycle policies that retain data for 7 years. CloudTrail is specifically designed for auditing and compliance, capturing management and data plane API calls, and supports long-term retention via S3 object locking or lifecycle rules.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 2

A company stores critical data in an S3 bucket. The SysOps administrator needs to ensure that the data is durable and can be recovered if an entire AWS Region becomes unavailable. What is the MOST cost-effective solution?

Accepted Answer

Configure S3 Cross-Region Replication to a bucket in another Region.. D is correct because S3 Cross-Region Replication (CRR) automatically replicates objects to a bucket in another AWS Region, ensuring data durability and recoverability even if an entire Region becomes unavailable. This is the most cost-effective solution for cross-region disaster recovery as it only incurs replication costs and storage fees in the destination Region, without requiring manual intervention or additional infrastructure.

Answer

Use AWS Backup to manually copy the bucket to another Region.

Answer

Enable S3 Versioning on the bucket.

Answer

Use S3 Standard storage class.

Question 3

A company runs a critical stateful web application on Amazon EC2 instances in a single AWS region. The application stores user session data in an Amazon ElastiCache for Redis cluster. The SysOps administrator must design a disaster recovery (DR) strategy that can survive a complete regional outage with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The application must be able to redirect users to the DR region with minimal manual effort. Which combination of actions meets these requirements?

Accepted Answer

Create a read replica of the ElastiCache Redis cluster in the DR region using the native cross-region replication feature. Use Route 53 with failover routing to point to the DR region ALB when the primary health check fails. Pre-configure EC2 instances in an Auto Scaling group in the DR region.. ElastiCache for Redis supports cross-region replication via a read replica in the DR region, which can keep session data synchronized with minimal lag, meeting the 15-minute RPO. Route 53 failover routing with health checks on the primary region's ALB automatically redirects traffic to the pre-configured DR region EC2 instances and ALB, achieving the 1-hour RTO with minimal manual effort. Pre-configuring the DR region with an Auto Scaling group ensures compute capacity is ready, while the read replica provides the required data availability.

Answer

Use Amazon Route 53 with weighted routing to distribute traffic between the two regions. Use a global DynamoDB table for session data, and launch EC2 instances in the DR region only when a failure is detected using AWS CloudFormation StackSets.

Answer

Use an Amazon CloudFront distribution with multiple origins (primary and DR). Enable session stickiness at the CloudFront level. Use EC2 instances in both regions behind separate ALBs. No special data replication is needed because sessions are stored in Redis.

Answer

Use EC2 instances with an Auto Scaling group in both regions. Schedule a Lambda function to take snapshots of the Redis cluster every 15 minutes and copy them to the DR region. Use Route 53 latency routing to direct users to the nearest region.

Question 4

A company has a legacy application that runs on a single Amazon EC2 instance. The SysOps administrator is tasked with migrating the application to an Auto Scaling group behind an Application Load Balancer to improve availability. The application stores session state locally on the instance. What should the administrator do to ensure a seamless migration with minimal changes to the application code?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Using Amazon ElastiCache for Redis to store session data externally allows the application to be stateless, enabling seamless scaling across multiple EC2 instances in an Auto Scaling group. This approach requires minimal code changes (typically just configuring the application to use a Redis endpoint instead of local storage) and ensures session data is not lost if an instance fails. Option A (sticky sessions) is a workaround but does not eliminate the dependency on local storage; sessions are still lost if an instance fails. Option B (disabling local session storage) does not solve the problem because the application still needs persistent session storage. Option D (using RDS) is possible but is not the best choice for session data because relational databases are typically slower for session caching and require more significant code and schema changes compared to Redis, which is an in-memory data store optimized for session management.

Answer

Configure the Application Load Balancer with sticky sessions (session affinity).

Answer

Disable the feature that stores session state locally.

Answer

Modify the application to store session data in an Amazon RDS database.

Question 5

A company runs a critical database workload on an Amazon RDS for MySQL DB instance with Multi-AZ deployment in the us-east-1 region. The SysOps administrator must design a disaster recovery strategy that can recover from a complete regional outage. The Recovery Time Objective (RTO) is 2 hours and the Recovery Point Objective (RPO) is 1 hour. Which solution meets these requirements at the lowest cost?

Accepted Answer

Create a cross-Region read replica in another Region and promote it to a standalone DB instance during a disaster.. A cross-Region read replica continuously replicates data from the primary RDS MySQL instance to another Region with minimal lag, typically achieving an RPO of seconds to minutes, well within the 1-hour requirement. Promoting the replica to a standalone instance during a disaster can be done in minutes, meeting the 2-hour RTO. This approach is the lowest cost among the viable options as it uses existing replication infrastructure without additional data transfer fees for snapshots or DMS replication instances.

Answer

Create manual snapshots of the DB instance every hour and copy them to another AWS Region.

Answer

Enable automated backups with a retention period of 35 days and restore to a different Region when needed.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to a DB instance in another Region.

Question 6

An organization wants to ensure that no Amazon S3 bucket in the entire AWS Organization can be made public. The security team requires a preventive control that cannot be overridden by individual account administrators. Which AWS service or feature should be used?

Accepted Answer

Create a Service Control Policy (SCP) in AWS Organizations that denies permissions to modify S3 bucket public access settings.. A Service Control Policy (SCP) in AWS Organizations is a preventive guard that applies to all accounts within the organization. It can explicitly deny actions like s3:PutBucketPublicAccessBlock, s3:PutBucketPolicy, and s3:PutObjectAcl, preventing any principal (including root users) from making S3 buckets public. Unlike detective or account-level controls, SCPs cannot be overridden by individual account administrators, meeting the requirement for a non-overridable preventive control.

Answer

Enable AWS Config rules in each account to detect public S3 buckets and automatically remediate them using AWS Lambda.

Answer

Use an IAM policy attached to all IAM users in each account that denies s3:PutBucketPolicy.

Answer

Apply Amazon S3 Block Public Access at the account level in each individual AWS account.

Question 7

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?

Accepted Answer

Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.. Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.

Answer

Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.

Answer

Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.

Answer

Create a resource-based policy on each EC2 instance that denies access from non-production accounts.

Question 8

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The SysOps administrator receives reports that some users are experiencing intermittent HTTP 503 errors. What is the most likely cause?

Accepted Answer

The health checks are failing for the target group, causing the ALB to stop sending traffic to all instances.. HTTP 503 errors from an Application Load Balancer typically indicate that the target group has no healthy registered targets. When health checks fail for all instances in the target group, the ALB cannot route traffic to any backend, resulting in a 503 response. This is the most common cause of intermittent 503 errors in ALB architectures.

Answer

The security group attached to the ALB does not allow inbound traffic on port 443.

Answer

The EC2 instances do not have the correct IAM role to register with the ALB.

Answer

The ALB idle timeout is set too low.

Question 9

A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?

Accepted Answer

Deploy a NAT Gateway in each public subnet. Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.

Answer

Deploy a NAT instance in each private subnet

Answer

Deploy a single NAT Gateway in one public subnet

Answer

Attach an Internet Gateway directly to the private subnets

Question 10

A production RDS MySQL database stores financial records. The team needs the ability to restore the database to any point within the last 7 days in case of accidental data deletion. Automated backups are currently disabled. What must be configured?

Accepted Answer

Enable automated backups and set the backup retention period to 7 days. To restore an RDS MySQL database to any point within the last 7 days, you must enable automated backups and set the backup retention period to 7 days. Automated backups enable point-in-time recovery (PITR), which allows restoration to any second within the retention window using binary logs. Without automated backups, RDS cannot perform PITR, even if manual snapshots exist.

Answer

Create a manual DB snapshot every night using the AWS CLI on a schedule

Answer

Enable Multi-AZ to maintain a synchronous standby replica in a second Availability Zone

Answer

Enable RDS read replicas and promote one if data deletion occurs

Question 11

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Accepted Answer

Misconfigured firewall or iptables. An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Answer

Network connectivity issues

Answer

Detached EBS root volume

Answer

Insufficient memory for applications

Question 12

A SysOps administrator is designing a monitoring solution for a critical application running on EC2 instances. The application requires that all API calls to the environment are logged for security analysis. Which TWO services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS CLI, SDKs, and other services. CloudTrail logs provide the identity of the caller, the time of the call, the source IP address, and the request parameters, which are essential for security analysis. Option B (Amazon CloudWatch Logs) is also correct because CloudTrail logs can be delivered to CloudWatch Logs for centralized monitoring, alerting, and retention, enabling real-time analysis and integration with other AWS services.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 13

A company stores large volumes of log data in Amazon S3. The logs are accessed frequently for the first 30 days, then occasionally for the next 60 days, and after 90 days they are rarely accessed but must be retained for 7 years for compliance. The SysOps administrator wants to minimize storage costs while ensuring data is available when needed. Which S3 lifecycle policy configuration should be applied?

Accepted Answer

Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.. It aligns the lifecycle transitions with the access patterns: frequent access for the first 30 days (S3 Standard), occasional access for the next 60 days (S3 Standard-IA), and rare access after 90 days (S3 Glacier Deep Archive, the lowest-cost storage class for long-term retention). The deletion after 7 years meets compliance requirements while minimizing costs by using progressively cheaper storage classes.

Answer

Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier after 60 days. Delete after 7 years.

Answer

Transition objects to S3 Glacier Deep Archive after 30 days, and delete after 7 years.

Answer

Transition objects to S3 One Zone-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.

Question 14

A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?

Accepted Answer

Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional. A CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.

Answer

Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it

Answer

Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement

Answer

Add a DeletionPolicy: Retain attribute to the RDS resource in the template

Question 15

A company has two Amazon VPCs (VPC-A and VPC-B) in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private IP connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

Accepted Answer

VPC Peering. VPC Peering is the correct solution because it allows direct private IP connectivity between two VPCs in the same AWS Region using the AWS global network backbone, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer charges. Since the VPCs have non-overlapping CIDR blocks, they can be peered without route conflicts, and traffic flows entirely within AWS without traversing the public internet or requiring a transit hub.

Answer

AWS Transit Gateway

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect

Question 16

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The admin has a template that creates an EC2 instance with a custom software stack. The software stack must be installed and configured using PowerShell scripts. The admin wants to minimize operational overhead by automating the creation of an AMI that includes the software stack, and the AMI should be rebuilt on a weekly basis to include the latest security patches. Which combination of AWS services should be used?

Accepted Answer

Use EC2 Image Builder to define a component with the PowerShell scripts, create a recipe, and schedule a pipeline to run weekly.. EC2 Image Builder is purpose-built for automating the creation, patching, and testing of custom AMIs. By defining a component that encapsulates the PowerShell scripts, creating a recipe that references that component, and scheduling a pipeline to run weekly, the administrator achieves fully automated, repeatable AMI builds with minimal operational overhead. This directly meets the requirement for weekly rebuilds with the latest security patches.

Answer

Use AWS Systems Manager Automation to run a PowerShell script on an existing EC2 instance, then manually create an AMI each week.

Answer

Use AWS CodePipeline with CodeBuild to run the PowerShell scripts and create an AMI using the AWS CLI, triggered by a weekly CloudWatch Events schedule.

Answer

Use Amazon EC2 Auto Scaling with a lifecycle hook to run the PowerShell script on instance launch, and schedule a weekly instance refresh.

Question 17

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

Accepted Answer

AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.. AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Answer

AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications.

Answer

Amazon Macie to discover sensitive data and then manually encrypt buckets.

Question 18

A company has two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The SysOps administrator needs to establish connectivity between these VPCs so that resources in VPC-A can reach resources in VPC-B using private IP addresses. The solution must be highly available and not involve a third-party appliance. Which solution should the administrator implement?

Accepted Answer

Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.. VPC Peering provides direct, private IP connectivity between two VPCs using the AWS global network, with no bandwidth bottleneck or single point of failure. By creating a peering connection and adding routes to the other VPC's CIDR in each VPC's route table, resources can communicate privately and the solution is highly available as the peering connection itself is redundant within AWS's infrastructure. No third-party appliance is required, and the setup is fully managed by AWS.

Answer

Create an AWS Transit Gateway and attach both VPCs to it. Configure route tables to allow communication.

Answer

Attach an internet gateway to each VPC and use Amazon Route 53 to resolve private DNS names over the internet.

Answer

Set up a site-to-site VPN connection between the two VPCs using AWS Virtual Private Gateway.

Question 19

A company runs a critical application on Amazon EC2 instances across multiple Availability Zones. The application stores state data on a shared Amazon EFS file system. The SysOps administrator needs to ensure that the file system remains available if an entire Availability Zone fails. The file system must also provide low-latency access from all instances. Which configuration meets these requirements?

Accepted Answer

Create an EFS file system with the Standard storage class in the same Region, and mount it from all instances using the regional mount target.. The EFS Standard storage class stores data redundantly across multiple Availability Zones (AZs) within a Region, ensuring high availability and durability even if an entire AZ fails. By mounting the file system using the regional mount target (which resolves to the EFS file system's regional DNS name), instances in any AZ can access the file system with low latency, as EFS automatically routes traffic to the most appropriate mount target in the same AZ. This configuration meets both the availability and low-latency requirements without additional replication or failover complexity.

Answer

Create an EFS file system with the One Zone storage class and mount it from all instances.

Answer

Create an EFS file system with the Standard storage class, enable replication to another Region, and use DNS failover.

Answer

Create an EFS file system with the Standard storage class, and enable Multi-AZ deployment.

Question 20

A company runs a batch processing application on Amazon EC2 instances every night. The job takes exactly 1 hour to complete and is time-sensitive. The SysOps administrator wants to minimize compute costs while ensuring the job can be interrupted and resumed if needed. Which EC2 purchasing option is most cost-effective?

Accepted Answer

Spot Instances. Spot Instances are the most cost-effective option because the batch job is fault-tolerant (can be interrupted and resumed) and runs for exactly 1 hour nightly. Spot Instances offer up to 90% discount compared to On-Demand, and with the ability to handle interruptions via checkpointing, they meet the requirement for cost minimization while supporting resumption.

Answer

On-Demand Instances

Answer

Reserved Instances (Standard 1-year)

Answer

Dedicated Hosts