SOA-C02 Practice Questions 2 — 50 Questions

Question 1

Drag and drop the steps to troubleshoot an unhealthy target in an Application Load Balancer target group into the correct order.

Accepted Answer

Verify security group rules allow traffic from the ALB, then verify health check settings (path, port, protocol), then check instance status and application health, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.. Troubleshooting starts with security group rules, then health check configuration, then instance and application status, then logs, and finally replacement if needed.

Answer

Verify health check settings (path, port, protocol), then verify security group rules, then check instance status and application health, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.

Answer

Check instance status and application health, then verify security group rules, then verify health check settings, then review ALB access logs and CloudWatch metrics, then replace the target instance if necessary.

Answer

Review ALB access logs and CloudWatch metrics, then verify security group rules, then verify health check settings, then check instance status and application health, then replace the target instance if necessary.

Question 2

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed in a single AWS region. The company wants to improve performance for users in other regions and reduce the load on the origin servers. The SysOps administrator decides to use Amazon CloudFront. After implementing CloudFront, the administrator notices that the cache hit ratio is very low (around 10%) for the dynamic API responses that are served by the application. These API responses are personalized per user and change frequently. The administrator wants to improve performance for these dynamic requests while still using CloudFront. The application uses cookies for session management and the API responses depend on the user's session. The administrator must ensure that users receive the correct personalized content. Which configuration should the administrator use?

Accepted Answer

Use Lambda@Edge to generate personalized responses at the edge without forwarding all requests to the origin.. For dynamic, personalized API responses that depend on user session cookies, caching is ineffective because each user's response is unique. Lambda@Edge allows you to run code at CloudFront edge locations to generate personalized responses or modify requests/responses. By using a Lambda function that inspects the session cookie and generates the appropriate API response at the edge, you can serve personalized content without forwarding every request to the origin. This improves performance by reducing round trips and origin load while ensuring users receive correct personalized content. Options B, C, and D do not effectively address the need for dynamic personalization with low cache hit ratio.

Answer

Configure CloudFront to use origin shield and enable keep-alive connections to the origin.

Answer

Configure CloudFront to forward cookies to the origin and enable caching based on cookies.

Answer

Disable caching for the API behavior in CloudFront and enable real-time logs.

Question 3

Drag and drop the steps to configure a VPC peering connection between two VPCs into the correct order.

Accepted Answer

Step 1: Create the peering request, Step 2: Accept the peering request, Step 3: Update route tables in both VPCs, Step 4: Adjust security groups.. First create the peering request, then accept it, then update route tables in both VPCs, and finally adjust security groups.

Answer

Step 1: Create the peering request, Step 2: Update route tables in both VPCs, Step 3: Accept the peering request, Step 4: Adjust security groups.

Answer

Step 1: Accept the peering request, Step 2: Create the peering request, Step 3: Update route tables in both VPCs, Step 4: Adjust security groups.

Answer

Step 1: Update route tables in both VPCs, Step 2: Create the peering request, Step 3: Accept the peering request, Step 4: Adjust security groups.

Question 4

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda. It uses Amazon CloudWatch alarms to monitor CPU utilization metrics and trigger an SNS topic, which then invokes an AWS Lambda function. The Lambda function can execute the logic to stop the EC2 instance when the alarm state indicates CPU utilization above 90% for 30 minutes, providing automated cost control without manual intervention.

Answer

Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation

Answer

Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions

Answer

AWS CloudTrail + Amazon EventBridge + AWS CodePipeline

Question 5

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

Accepted Answer

Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.. The correct action is to use the 'Release change' button in the CodePipeline console. This manually reruns the pipeline from the source stage, using the latest source revision. Option A is incorrect because creating a new commit with an empty message would trigger the pipeline only if the source repository is configured to detect changes, but it is unnecessary. Option C is incorrect because CodePipeline does not automatically retry after a failure; it stops at the failed stage. Option D is incorrect because re-uploading the same artifact may not trigger the pipeline if the S3 event is configured to detect only new objects, and it is not the standard procedure to rerun the pipeline.

Answer

Create a new commit with an empty message to trigger the pipeline.

Answer

Wait for the pipeline to automatically retry after the failure.

Answer

Re-upload the same artifact to the source S3 bucket to trigger the pipeline.

Question 6

Drag and drop the steps to enable AWS CloudTrail logging for a specific S3 bucket into the correct order.

Accepted Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.. First create a log bucket with proper policy, then create the trail and configure it to log events for the target bucket.

Answer

Step 2: Create a CloudTrail trail.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.

Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 2: Create a CloudTrail trail.

Answer

Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.

Question 7

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning. AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Answer

Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning

Answer

Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action

Answer

Use AWS Service Catalog to enforce versioning on all buckets provisioned through it

Question 8

A media company stores millions of video files in S3. Some files are accessed heavily after upload (when new) and rarely afterward; others are accessed unpredictably across months. The team cannot predict which files will be accessed and when. They want to minimize storage costs without risking retrieval latency penalties or per-object retrieval fees. Which storage class is appropriate?

Accepted Answer

Use S3 Intelligent-Tiering so objects automatically move between Frequent and Infrequent Access tiers based on access patterns, with no retrieval fees. S3 Intelligent-Tiering is the correct choice because it automatically moves objects between Frequent Access and Infrequent Access tiers based on changing access patterns, with no retrieval fees and no performance impact (millisecond latency). This matches the unpredictable access pattern described, as the service monitors access at the object level and adjusts storage tier without manual lifecycle rules or retrieval costs.

Answer

Use S3 Standard-IA and configure a lifecycle policy to move objects back to Standard after every access

Answer

Use S3 Glacier Instant Retrieval for all objects because it offers the lowest storage cost with millisecond retrieval

Answer

Use S3 Standard for all objects because it has no retrieval fees and provides the best availability

Question 9

A SysOps administrator manages an Amazon RDS for MySQL instance that handles a critical web application. During peak traffic, the number of database connections exceeds 500 for more than 15 minutes, leading to connection timeouts. The administrator wants to automatically increase the DB instance size when the connection count remains high, and decrease it when the load drops, to balance performance and cost. Which combination of AWS services should be used to achieve this automation with the least operational overhead?

Accepted Answer

Set up an Amazon CloudWatch alarm on the DatabaseConnections metric that triggers an AWS Lambda function to modify the DB instance class via the RDS API.. It uses a CloudWatch alarm to monitor the DatabaseConnections metric, which triggers an AWS Lambda function that directly calls the RDS ModifyDBInstance API to change the instance class. This approach provides the least operational overhead by leveraging native AWS services without additional infrastructure, custom resources, or periodic polling, and it enables real-time, event-driven scaling based on the specified threshold.

Answer

Configure a CloudWatch alarm on DatabaseConnections that triggers an Amazon CloudWatch Events rule, which directly modifies the DB instance class using a CloudFormation custom resource.

Answer

Use an AWS Config rule to monitor DatabaseConnections and invoke an AWS Lambda function to scale the RDS instance when the threshold is breached.

Answer

Use an AWS Systems Manager Automation runbook to periodically check the DatabaseConnections metric and adjust the RDS instance class if needed.

Question 10

A company runs a read-heavy database workload on Amazon RDS for PostgreSQL with a primary instance and two read replicas. The SysOps administrator observes that the read replicas frequently experience high replica lag during peak hours, causing stale reads for the application. The administrator needs to reduce replica lag while optimizing costs. The workload is predictable, with spikes during business hours and low traffic at night. Which combination of actions should the administrator take?

Accepted Answer

Upgrade the instance class of the read replicas to a larger type with more CPU and memory to handle the increased WAL replay rate.. Upgrading the read replica instance class provides more CPU and memory, which directly increases the WAL replay rate. In RDS for PostgreSQL, replica lag is primarily caused by the replica's inability to apply WAL changes as fast as the primary generates them. A larger instance class alleviates this bottleneck without incurring the cost of upgrading the primary instance.

Answer

Convert the read replicas to Multi-AZ instances to improve the replication process and reduce lag.

Answer

Add additional read replicas to distribute the read load and reduce the lag on each individual replica.

Answer

Upgrade the primary DB instance to a larger class with increased IOPS to reduce the amount of data that needs to be replicated.

Question 11

An application stores its RDS PostgreSQL credentials in AWS Secrets Manager. The security policy requires credentials to be rotated every 30 days automatically. During rotation, the application must continue to serve traffic with zero downtime. The application retrieves credentials by calling GetSecretValue at the start of each database connection. What must be configured to satisfy all requirements?

Accepted Answer

Enable automatic rotation in Secrets Manager with a 30-day schedule; use the AWS-provided Lambda rotation function for RDS PostgreSQL; ensure the application calls GetSecretValue per connection rather than caching credentials. AWS Secrets Manager's automatic rotation, combined with the AWS-provided Lambda rotation function for RDS PostgreSQL, ensures credentials are rotated every 30 days without manual intervention. The application's practice of calling GetSecretValue at the start of each database connection guarantees it always retrieves the current secret, avoiding stale credentials and achieving zero downtime during rotation.

Answer

Rotate credentials manually every 30 days by updating the secret value in the console and restarting the application

Answer

Create an EventBridge scheduled rule every 30 days that triggers a Lambda to generate a new RDS password and update both the database and the secret

Answer

Store credentials in an environment variable on the application's EC2 instance and rotate by updating the environment variable and reloading the application

Question 12

Drag and drop the steps to create an Amazon CloudWatch alarm that sends an email notification when CPU utilization exceeds 90% into the correct order.

Accepted Answer

Set up an SNS topic, then create the alarm selecting the CPU utilization metric, then define the condition (CPU > 90%), then add the notification action with the SNS topic.. First set up the SNS topic, then create the alarm selecting the metric, define the condition, and finally add the notification action.

Answer

Create the alarm selecting the CPU utilization metric, then set up an SNS topic, then define the condition (CPU > 90%), then add the notification action with the SNS topic.

Answer

Set up an SNS topic, then add the notification action with the SNS topic, then create the alarm selecting the CPU utilization metric, then define the condition (CPU > 90%).

Answer

Create the alarm selecting the CPU utilization metric, then define the condition (CPU > 90%), then set up an SNS topic, then add the notification action with the SNS topic.

Question 13

A SysOps administrator needs to deploy a new version of a web application to Amazon EC2 instances using AWS Elastic Beanstalk. The administrator wants to deploy the new version with zero downtime and validate the new version before routing production traffic to it. Which deployment policy should be used?

Accepted Answer

Immutable. Immutable deployment is correct because it launches a completely new set of EC2 instances in a separate Auto Scaling group, deploys the new application version to them, and passes health checks before swapping the environment's CNAME record to point to the new instances. This ensures zero downtime and allows validation of the new version before any production traffic is routed to it, as the old instances remain untouched until the swap is complete.

Answer

All at once

Answer

Rolling

Answer

Traffic splitting

Question 14

A company's security policy requires that all Amazon S3 buckets must have server-side encryption with AWS Key Management Service (SSE-KMS) enabled. The SysOps administrator needs to automatically detect any existing or new S3 bucket that does not have SSE-KMS enabled and automatically apply the encryption configuration. The solution must use managed AWS services with minimal custom code. Which combination of AWS services should be used?

Accepted Answer

Use AWS Config with a custom rule backed by an AWS Lambda function that checks if the S3 bucket has default SSE-KMS encryption enabled, and auto-remediates by enabling SSE-KMS default encryption (e.g., calling the PutBucketEncryption API).. It uses AWS Config with a custom Lambda-backed rule to detect non-compliant S3 buckets (those missing SSE-KMS) and auto-remediate by calling the PutBucketEncryption API to enable default SSE-KMS encryption on the bucket. This satisfies the requirement for minimal custom code (only the Lambda function) and uses managed AWS services (AWS Config, Lambda, S3) to automatically detect and fix both existing and new buckets, ensuring that all S3 buckets have SSE-KMS enabled as per the security policy.

Answer

Enable default encryption on the AWS account's S3 buckets using an S3 account-level setting in the S3 console, which automatically applies SSE-KMS to all new buckets.

Answer

Create an AWS CloudTrail event that triggers an AWS Lambda function when a bucket is created, and the Lambda applies SSE-KMS encryption. Use AWS Config to periodically scan existing buckets and apply encryption.

Answer

Use AWS Identity and Access Management (IAM) with a Service Control Policy (SCP) that denies any S3 bucket creation without SSE-KMS enabled, and use AWS Config to detect and notify on non-compliance.

Question 15

A company has two Amazon VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16) in the same AWS Region. The SysOps administrator needs to enable private IP connectivity between the two VPCs without using the public internet. The solution must be simple, low-cost, and provide high throughput. Which AWS service should the administrator use?

Accepted Answer

VPC peering. VPC peering is the correct choice because it enables direct private IP connectivity between two VPCs using the AWS global network, without requiring internet gateways, VPNs, or physical connections. It is simple to set up (no additional hardware or software), low-cost (no per-hour charges, only data transfer costs), and provides high throughput (bandwidth is limited only by the instance types, not by the peering connection itself).

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 16

A company has a VPC with public and private subnets. The private subnets need outbound internet access to download software updates while preventing any inbound internet traffic. The SysOps administrator must minimize costs. Which solution should the administrator implement?

Accepted Answer

Launch a NAT instance in a public subnet with an Elastic IP and disable source/destination check, then update private subnet route tables. A NAT instance, when launched in a public subnet with an Elastic IP and source/destination check disabled, can route outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. This solution minimizes costs compared to a NAT Gateway, as NAT instances use existing EC2 instance pricing and can be further reduced with spot instances or smaller instance types.

Answer

Create a NAT Gateway in a public subnet and update the private subnet route table to use it

Answer

Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the private subnets

Answer

Use AWS Transit Gateway with a VPN connection to an on-premises data center for internet access

Question 17

An environment has 12 individual CloudWatch metric alarms covering CPU, memory, disk, and network. When one instance degrades, all 12 alarms fire simultaneously and send 12 separate notifications to the on-call engineer. The team wants a single notification per incident regardless of how many individual alarms trigger. What CloudWatch feature addresses this?

Accepted Answer

Create a composite alarm that enters ALARM state when any of the 12 child alarms is in ALARM state, and configure a single SNS action on the composite alarm only. A composite alarm in CloudWatch can aggregate multiple child alarms into a single parent alarm. When any of the 12 child alarms enters the ALARM state, the composite alarm transitions to ALARM and triggers a single SNS notification, thereby reducing alert noise to one notification per incident.

Answer

Increase the alarm evaluation period on all 12 alarms to 30 minutes so they fire less frequently

Answer

Use an SNS topic with a delivery policy that batches notifications sent within a 60-second window

Answer

Configure all 12 alarms to write to the same CloudWatch Events rule and suppress duplicate events with EventBridge deduplication

Question 18

A company uses Amazon S3 to serve large files to users. The files are accessed frequently for the first 30 days after upload, then access drops significantly. The SysOps administrator wants to minimize storage costs while ensuring low-latency access for frequently accessed files and automatic optimization for changing access patterns. Which S3 storage class configuration should be used?

Accepted Answer

Use S3 Intelligent-Tiering.. S3 Intelligent-Tiering is the correct choice because it automatically moves objects between three access tiers (frequent, infrequent, and archive instant) based on changing access patterns, without any lifecycle rules or performance impact. This meets the requirement for low-latency access for frequently accessed files and automatic optimization, while minimizing storage costs as access drops after 30 days.

Answer

Use S3 Standard for 30 days, then transition to S3 Glacier Deep Archive.

Answer

Use S3 Standard then transition to S3 Glacier Flexible Retrieval after 30 days.

Answer

Use S3 One Zone-IA for the first 30 days, then transition to S3 Standard-IA.

Question 19

A web application publishes a custom metric 'FailedLoginAttempts' to Amazon CloudWatch. The SysOps administrator needs to be notified via Amazon SNS when the number of failed login attempts exceeds 100 within a 5-minute period. Which AWS service or feature should be used to create this notification?

Accepted Answer

Amazon CloudWatch alarm. An Amazon CloudWatch alarm is the correct service because it monitors a specific CloudWatch metric (such as 'FailedLoginAttempts') and triggers an action (such as sending an SNS notification) when the metric crosses a defined threshold over a specified period. In this case, the alarm evaluates whether the sum of 'FailedLoginAttempts' exceeds 100 within a 5-minute period, and upon breaching, it publishes to the SNS topic to notify the SysOps administrator.

Answer

Amazon CloudWatch Logs metric filter

Answer

Amazon CloudWatch dashboard

Answer

AWS Config rule

Question 20

A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?

Accepted Answer

The BGP session between the on-premises router and the Direct Connect router is down.. The BGP session between the on-premises router and the Direct Connect router is down. When BGP is down, the on-premises router cannot exchange routes with the AWS side over Direct Connect. Even though the on-premises router may be advertising a specific route, without an active BGP session, that route is not received by the Direct Connect router, and the virtual private gateway does not propagate it into the VPC. As a result, traffic from the on-premises network to the VPC falls back to using the internet route instead of Direct Connect. Option B is incorrect because the VPC route table controls outbound traffic from the VPC, not inbound traffic from on-premises; a default route to an Internet Gateway would cause asymmetric routing for return traffic but would not prevent inbound traffic from using Direct Connect if the BGP session is active.

Answer

The on-premises network does not have a route to the VPC CIDR.

Answer

The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.

Answer

The virtual private gateway is not attached to the VPC.