SOA-C02 Practice Exam 51 — 20 Questions

Question 1

An organization uses Amazon CloudFront to serve static content from an S3 bucket. The content is updated frequently, but users are seeing stale files. What is the most efficient way to invalidate the cache for updated objects?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudFront invalidation for the updated files.. CloudFront caches objects at edge locations based on the cache key (path, headers, query strings). When origin content changes, the edge cache still serves the old object until TTL expires. Creating an invalidation explicitly purges the specified paths from all edge locations, forcing CloudFront to fetch fresh content from the S3 origin on the next request. This is the fastest, most targeted way to serve updated files without waiting for TTL expiry.

Answer

Use the S3 console to set a new cache-control header.

Answer

Change the origin path in the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 2

A company runs a batch processing job on Amazon EMR every night. The job runs for 6 hours and requires a cluster of 20 m5.xlarge instances. The company wants to reduce costs while ensuring the job completes on time. Which solution is MOST cost-effective?

Accepted Answer

Use Spot Instances for core and task nodes and an On-Demand instance for the primary node.. Amazon EMR clusters consist of a primary node (master), core nodes (which run HDFS and task processes), and task nodes (which only run tasks and can be lost without data loss). Spot Instances are ideal for task nodes because they can be interrupted without affecting HDFS data, and for core nodes if the cluster is resilient to interruptions (e.g., using EMRFS consistent view or if the job can tolerate some core node loss). The primary node must be On-Demand to avoid cluster termination if the Spot Instance is reclaimed. This mix minimizes cost while ensuring the job completes on time.

Answer

Use On-Demand instances for all nodes.

Answer

Purchase Reserved Instances for the entire cluster.

Answer

Use Spot Instances for the primary node and On-Demand for core and task nodes.

Question 3

A SysOps administrator ran the above AWS CLI command to update an existing CloudFormation stack. The command failed with the error shown. What is the most likely cause?

Accepted Answer

The stack is in a failed state from a previous operation and must be deleted or rollback continued.. When a CloudFormation stack is in a failed state (e.g., UPDATE_ROLLBACK_FAILED or ROLLBACK_COMPLETE), any subsequent update operation is rejected with an error stating the stack is in a state that does not permit updates. The administrator must either continue the rollback (ContinueUpdateRollback) or delete and recreate the stack before another update can proceed. This matches the typical 'Stack is in UPDATE_ROLLBACK_FAILED state and can not be updated' error returned by the CLI.

Answer

The template file has a syntax error.

Answer

The parameter values provided are invalid.

Answer

The IAM role specified lacks permissions.

Question 4

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes. The SysOps administrator needs to identify the root cause. Which set of CloudWatch metrics should be analyzed first?

Accepted Answer

ALB TargetResponseTime and EC2 CPUUtilization. Intermittent latency spikes in a web application behind an Application Load Balancer (ALB) are most directly investigated by correlating ALB TargetResponseTime (which measures the time taken for the target to respond to the ALB) with EC2 CPUUtilization (which indicates whether the instance is under compute pressure). A spike in TargetResponseTime alongside high CPUUtilization suggests the EC2 instance is struggling to process requests, pointing to a compute bottleneck as the root cause.

Answer

EC2 CPUUtilization and NetworkIn

Answer

EC2 StatusCheckFailed and ALB UnhealthyHostCount

Answer

ALB RequestCount and HealthyHostCount

Question 5

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application is deployed using AWS Elastic Beanstalk with a rolling update deployment policy. Recently, the development team pushed a new application version that introduced a memory leak. Within minutes, the instances started failing health checks, and Elastic Beanstalk initiated a replacement of the instances. However, during the replacement, the application experienced downtime because the new instances were not passing health checks, and the old instances were already terminated. The SysOps Administrator must modify the deployment to prevent downtime during future failed deployments. Which solution should the administrator implement?

Accepted Answer

Implement a Blue/Green deployment using a separate Elastic Beanstalk environment and swap CNAMEs after testing.. Blue/Green deployment with Elastic Beanstalk creates a separate environment running the new version. Health checks validate the new instances before swapping the CNAME. If the new environment fails, the old environment continues serving traffic, eliminating downtime. Option A is wrong because increasing Auto Scaling sizes does not change the deployment policy; it only affects scaling limits. Option C is wrong because Classic Load Balancer lacks advanced health check features and does not address the deployment strategy. Option D is wrong because All at once deployment would replace all instances simultaneously, causing downtime even without failure, and does not provide a rollback mechanism.

Answer

Increase the Auto Scaling group's minimum and maximum size to handle more instances.

Answer

Replace the ALB with a Classic Load Balancer to reduce complexity.

Answer

Change the deployment policy to All at once to speed up the deployment.

Question 6

A company has a production application running on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer. The SysOps administrator notices that during deployments, the application experiences a brief period of downtime. Which combination of actions should the administrator take to achieve zero-downtime deployments?

Accepted Answer

Configure the ECS service to use a rolling update with a minimum healthy percent of 100 and a maximum percent of 200.. Setting the minimum healthy percent to 100 and maximum percent to 200 ensures that during a rolling update, the ECS service first launches new tasks (up to 200% of the desired count) before terminating any old tasks. This guarantees that the ALB always has a sufficient number of healthy targets to serve traffic, eliminating downtime. The Application Load Balancer distributes traffic between old and new tasks during the transition, achieving zero-downtime deployments.

Answer

Configure the ECS service to use a rolling update with a minimum healthy percent of 0 and a maximum percent of 100.

Answer

Increase the deregistration delay on the ALB target group to 300 seconds.

Answer

Use a blue/green deployment with CodeDeploy and set the 'Minimum healthy percent' to 50.

Question 7

A company hosts a static website on Amazon EC2 instances behind an Application Load Balancer. They want to improve latency for users around the world by caching content at edge locations. Which AWS service should they use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (e.g., HTML, CSS, images) at edge locations worldwide, reducing latency for global users by serving cached responses from the nearest edge rather than the origin EC2 instances behind the Application Load Balancer. It integrates directly with ALB as a custom origin, offloading traffic and improving response times for repeated requests.

Answer

AWS Global Accelerator

Answer

AWS Direct Connect

Answer

Amazon Route 53

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences variable traffic patterns. The operations team notices that during low traffic periods, there are still a large number of running instances, leading to higher costs. What should the team do to reduce costs while maintaining performance?

Accepted Answer

Implement a target tracking scaling policy based on average CPU utilization.. The problem is over-provisioning during low-traffic periods, so the solution must automatically reduce capacity when demand drops while preserving the ability to scale up. A target tracking scaling policy based on average CPU utilization continuously adjusts the desired instance count to maintain the target, scaling in during off-peak and out during peaks. This is the standard, hands-off cost-optimization approach for variable workloads.

Answer

Replace the existing instances with larger instance types to handle peak load.

Answer

Manually scale down the number of instances during off-peak hours.

Answer

Purchase Reserved Instances for the baseline capacity.

Question 9

A SysOps administrator is troubleshooting an application that runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The administrator checks the ALB access logs and finds entries with 'elb_status_code' 503 and 'target_status_code' '-'. What is the most likely cause?

Accepted Answer

The target instances are unhealthy, causing the ALB to return 503.. The ALB access log entry with `elb_status_code` 503 and `target_status_code` '-' indicates that the load balancer itself generated the 503 error because it could not establish a connection to any healthy target. The dash for the target status code means the request never reached a target instance, which occurs when all targets in the target group are marked unhealthy by the health checks. This is the most common cause of intermittent 503 errors with an ALB.

Answer

The SSL certificate on the ALB has expired.

Answer

The target instances have high CPU utilization.

Answer

The security group on the ALB is blocking traffic.

Question 10

A SysOps administrator is troubleshooting a cost overrun in an AWS account. The cost explorer shows that data transfer costs have significantly increased. The architecture includes an Application Load Balancer (ALB) internet-facing, EC2 instances in private subnets, and an S3 bucket for static assets. Which action will MOST effectively reduce data transfer costs?

Accepted Answer

Implement a VPC Gateway Endpoint for S3 so that traffic from EC2 to S3 stays within the AWS network.. Implementing a VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 without traversing the NAT Gateway or internet, eliminating data transfer costs associated with NAT Gateway data processing and internet egress. This is the most effective cost reduction because S3 traffic is often a major contributor to data transfer charges in such architectures.

Answer

Enable Amazon CloudFront to cache static assets and reduce direct requests to the ALB.

Answer

Replace the NAT Gateway with a NAT instance to reduce hourly charges.

Answer

Change the ALB to internal (private) and use AWS Direct Connect for user access.

Question 11

An administrator runs the above CloudWatch command to analyze CPU utilization for an EC2 instance. The instance is currently running with a t3.large instance type. The company wants to optimize costs. Based on the data, which action should the administrator take?

Accepted Answer

Downsize the instance to t3.medium to reduce costs.. The average CPU utilization over the week is low (around 15.5%), indicating the instance is over-provisioned. Downsizing to a t3.medium (half the vCPUs and memory) would likely be sufficient and reduce costs. Reserved Instances would be cost-effective only if the instance runs consistently, but the current utilization is low. Scaling up would increase costs. Stopping the instance is not an option if needed.

Answer

Stop the instance to save costs immediately.

Answer

Scale up the instance to t3.xlarge to improve performance.

Answer

Purchase a Reserved Instance for the current instance type.

Question 12

A company has a production DynamoDB table with on-demand capacity. They need to ensure business continuity with a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour in case of a regional outage. What is the MOST cost-effective solution?

Accepted Answer

Enable DynamoDB global tables for the table.. DynamoDB global tables provide multi-region, multi-active replication with changes typically propagated within seconds, meeting an RPO of 5 minutes and an RTO of 1 hour by allowing traffic to be redirected to a replica in another region. This is the most cost-effective solution because it eliminates the need for separate backup storage or compute resources, and on-demand capacity scales automatically without provisioning.

Answer

Use AWS Backup to schedule daily backups and restore in another region.

Answer

Enable point-in-time recovery (PITR) on the table.

Answer

Configure cross-region read replicas for the table.

Question 13

A company has the following S3 bucket policy attached to a bucket named 'example-bucket'. A user is unable to download an object from the bucket using an HTTP URL (not HTTPS). What is the cause?

Accepted Answer

The Deny statement blocks all S3 actions when the request is not using HTTPS.. The bucket policy contains a Deny statement that applies to all s3:* actions when the request does not use HTTPS (SecureTransport is false). Even though there is an Allow statement for GetObject to everyone, the explicit Deny overrides the Allow. Option A is incorrect because the issue is not about anonymous users; the Deny affects all requests. Option C is incorrect because the policy does not mention server-side encryption. Option D is incorrect because the Deny statement applies to all S3 actions, not just PutObject.

Answer

The bucket policy does not allow GetObject for anonymous users.

Answer

The bucket policy requires server-side encryption for all requests.

Answer

The Deny statement only applies to PutObject, not GetObject.

Question 14

A company runs a critical web application on EC2 instances behind an Application Load Balancer across three Availability Zones. The application stores session data in an RDS MySQL database. To improve reliability, the company wants to ensure that a single Availability Zone failure does not impact the application's availability. Which combination of actions should the SysOps administrator take?

Accepted Answer

Deploy RDS in Multi-AZ configuration with automatic failover, and enable cross-zone load balancing on the ALB.. Deploying RDS in Multi-AZ with automatic failover ensures database resilience against an AZ failure by maintaining a synchronous standby replica in a different AZ, while enabling cross-zone load balancing on the ALB distributes traffic across instances in all AZs, preventing a single AZ failure from taking down the entire application. Together, these actions address both the session data persistence and compute layer availability requirements.

Answer

Configure the ALB to use only healthy instances and enable detailed CloudWatch metrics.

Answer

Increase the EC2 instance size to handle more traffic in a single AZ.

Answer

Increase the Auto Scaling group's desired capacity to a larger number.

Question 15

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is not reachable from the internet. The instance has a public IP and is in a public subnet. The security group allows HTTP and HTTPS from 0.0.0.0/0. The network ACL allows all inbound and outbound traffic. What should the administrator check NEXT?

Accepted Answer

Verify that the subnet's route table has a route to an internet gateway.. The instance is in a public subnet with a public IP and security group allowing HTTP/HTTPS, and the network ACL allows all traffic. The most likely remaining issue is that the subnet's route table lacks a route to an internet gateway (IGW), which is required for traffic to and from the internet. Without this route, the instance cannot send responses back to internet clients, making it unreachable despite having a public IP.

Answer

Check that the instance is associated with an Elastic IP address.

Answer

Confirm that the instance's operating system firewall is disabled.

Answer

Review the VPC Flow Logs for the instance's network interface.

Question 16

Refer to the exhibit. A SysOps administrator created this IAM policy for an application that sends custom metrics to CloudWatch and writes logs to CloudWatch Logs. The application reports that it cannot publish logs. What is the most likely reason?

Accepted Answer

The resource ARN for the logs actions is incorrect; it should include 'log-group:' before the wildcard.. The IAM policy uses `arn:aws:logs:us-east-1:123456789012:*` for the `Resource` element of the `logs:PutLogEvents` and `logs:CreateLogGroup` actions. For CloudWatch Logs, the resource ARN must include the `log-group:` prefix before the log group name or wildcard, such as `arn:aws:logs:us-east-1:123456789012:log-group:*`. Without this prefix, the ARN does not match any valid CloudWatch Logs resource, causing the application to fail when attempting to publish logs.

Answer

The policy requires a condition key to restrict access to specific log groups.

Answer

The policy does not allow the cloudwatch:PutMetricData action for the specific metric.

Answer

The application must assume an IAM role to write logs.

Question 17

A SysOps administrator notices that an Amazon RDS for MySQL instance's CPU utilization is consistently above 80% during business hours. The administrator wants to identify the queries causing the high load without impacting performance. Which action should be taken?

Accepted Answer

Enable Performance Insights on the RDS instance.. Performance Insights provides a database-specific performance schema that visualizes database load and identifies the SQL queries responsible for high CPU utilization. It operates with minimal overhead by sampling the database engine's internal performance data, making it ideal for diagnosing query performance issues without impacting the production workload.

Answer

Enable the MySQL slow query log and store it in CloudWatch Logs.

Answer

Enable Enhanced Monitoring to get OS-level metrics.

Answer

Increase the retention period for CloudWatch metrics to 15 months.

Question 18

A company needs to comply with PCI DSS requirements for its AWS environment. Which TWO services should the SysOps administrator use to automate compliance checks and generate reports? (Choose TWO.)

Accepted Answer

AWS Config. AWS Config (B) is correct because it continuously records resource configuration changes and evaluates them against managed or custom rules, such as the PCI DSS conformance pack, which automates compliance checks against AWS resources. AWS Audit Manager (E) is correct because it automates evidence collection and produces audit-ready reports mapped to frameworks like PCI DSS, which is exactly what the company needs for generating compliance reports. Amazon CloudWatch (A) is for metrics, logs, and alarms, not compliance evaluation or audit reporting. AWS CloudTrail (C) records API activity for auditing but does not itself perform automated compliance checks or generate compliance reports. AWS Trusted Advisor (D) provides best-practice recommendations across cost, security, and limits, but it is not a PCI DSS compliance automation or reporting service.

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 19

A SysOps administrator needs to grant a developer access to view only the logs of a specific Amazon RDS instance. Which IAM action should be allowed?

Accepted Answer

rds:DownloadDBLogFilePortion. `rds:DownloadDBLogFilePortion` grants permission to download and view the contents of a log file for a specific RDS instance. The question asks for the action to 'view only the logs', which requires retrieving the log file content. `rds:DescribeDBLogFiles` only lists available log files, not the actual log data. Therefore, to view logs, the developer needs the `DownloadDBLogFilePortion` permission.

Answer

rds:DescribeDBInstances

Answer

rds:DescribeDBLogFiles

Answer

rds:DescribeEvents

Question 20

A company uses Amazon S3 to store backup data. The SysOps administrator needs to ensure that the data is encrypted at rest and that access is limited to only authorized users. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or AWS KMS.. Enabling default encryption on the S3 bucket using SSE-S3 or AWS KMS ensures that all objects stored in the bucket are encrypted at rest automatically, meeting the encryption-at-rest requirement. This can be configured via the bucket properties, and it applies to any object uploaded without explicit encryption headers.

Answer

Block all public access to the S3 bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable S3 Transfer Acceleration.