SOA-C02 Practice Exam 52 — 20 Questions

Question 1

A company's security team requires that all Amazon S3 buckets are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any S3 bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' with an automatic remediation action using AWS Systems Manager Automation.. AWS Config's managed rule 's3-bucket-server-side-encryption-enabled' continuously evaluates S3 buckets for encryption compliance, and its automatic remediation action can invoke an AWS Systems Manager Automation document to enable SSE-S3 encryption on noncompliant buckets without custom code. This fully meets the requirement to automatically detect and remediate unencrypted buckets using AWS managed services.

Answer

Use AWS Trusted Advisor to identify unencrypted buckets and then manually enable encryption.

Answer

Use AWS CloudTrail to detect PutBucket operations and trigger a Lambda function that enables encryption.

Answer

Create an IAM bucket policy that denies any PutObject request that does not include x-amz-server-side-encryption header.

Question 2

A SysOps administrator needs to ensure that all S3 buckets in the account are logged to CloudTrail for data events. The administrator enables CloudTrail with data events for S3 and selects 'All buckets' in the current account. However, after a week, they notice that some buckets are not being logged. What is the most likely reason?

Accepted Answer

The S3 buckets are in a different AWS Region from the CloudTrail trail.. The most likely reason some buckets are not being logged is that those buckets reside in a different AWS Region than the one where the CloudTrail trail is configured. If the administrator creates a single-region trail and selects ‘All buckets’ for data events, the trail will only capture data events for S3 buckets in that specific region. Buckets in other regions will not be logged, resulting in partial logging coverage. Option C correctly identifies this regional mismatch.

Answer

The IAM user who created the trail does not have s3:PutObject permissions on the buckets.

Answer

The S3 buckets do not have a bucket policy that allows CloudTrail to write the log files.

Answer

The S3 buckets have server access logging enabled, which conflicts with CloudTrail logging.

Question 3

A company runs a stateless web application on EC2 instances behind an Application Load Balancer. The SysOps Administrator needs to ensure the application can withstand the loss of an entire Availability Zone. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones.. Configuring the Auto Scaling group to launch instances in at least two Availability Zones (AZs) ensures that if one entire AZ fails, the remaining AZ(s) still have running instances to serve traffic. This is a fundamental pattern for high availability and fault tolerance in AWS, as it distributes the application across physically separate data centers within a region.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Use an Elastic IP address for each EC2 instance.

Question 4

A company has two VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The VPCs are in the same AWS region. The SysOps administrator needs to enable private IP connectivity between the two VPCs so that an EC2 instance in VPC-A can communicate with an EC2 instance in VPC-B using their private IP addresses. The administrator wants a simple, low-cost solution with high throughput. Which AWS service should be used?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it enables direct, private IP connectivity between two VPCs in the same AWS region using the existing AWS network infrastructure, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer. It meets the requirements for simplicity, low cost, and high throughput, as traffic stays within the AWS backbone and does not require a separate transit hub or VPN.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 5

A SysOps administrator updates a CloudFormation stack to change the EC2 instance type from t2.micro to t3.medium. The update fails with the error shown. What is the MOST likely cause?

Accepted Answer

The t3.medium instance type is not available in the specified Availability Zone.. The error indicates that the t3.medium instance type is not available in the specified Availability Zone (AZ). AWS instance types are offered on a per-AZ basis, and not all instance types are available in every AZ. When a CloudFormation stack update fails with this error, it typically means the template explicitly or implicitly specifies an AZ that does not support the target instance type.

Answer

The account does not have service limits to launch a t3.medium instance.

Answer

The AMI used does not support the t3.medium instance type.

Answer

The CloudFormation template has a parameter constraint that rejects t3.medium.

Question 6

A company is designing a backup strategy for its on-premises file servers to AWS. Which TWO services can be used to back up data to AWS? (Choose TWO.)

Accepted Answer

AWS Backup. AWS Backup is correct because it provides a fully managed, policy-based backup service that can centrally automate and manage backups for on-premises file servers via the AWS Backup Gateway (formerly Storage Gateway Virtual Tape Library). It integrates with AWS Storage Gateway to back up on-premises data to S3 and Glacier, supporting file-level recovery without needing custom scripts.

Answer

AWS Snowball

Answer

Amazon EFS

Answer

S3 Transfer Acceleration

Question 7

A company wants to visualize the geographic distribution of failed login attempts to their web application. The application runs on EC2 instances behind an ALB. They have access logs enabled for the ALB. Which service should be used to create the visualization?

Accepted Answer

Amazon QuickSight with S3 as a data source.. Amazon QuickSight is a fully managed business intelligence service that can directly query ALB access logs stored in Amazon S3, enabling the creation of geospatial visualizations (e.g., heat maps) of failed login attempts. ALB access logs are delivered to S3 in a structured format, and QuickSight can parse and visualize this data without additional processing. This makes QuickSight with S3 as a data source the correct choice for building the required geographic visualization.

Answer

Amazon CloudWatch Dashboard with a custom widget.

Answer

Amazon Kinesis Data Analytics with a Lambda function.

Answer

Amazon S3 Select with Athena.

Question 8

A company's security policy requires that all Amazon S3 buckets must have server-side encryption enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and notify the security team. Which AWS service should be used to detect non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and evaluates the configuration of AWS resources against desired policies. By using an AWS Config managed rule such as `s3-bucket-server-side-encryption-enabled`, you can automatically detect any S3 bucket that lacks server-side encryption and trigger an SNS notification to the security team.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 9

A company's security policy requires that IAM users rotate their access keys every 90 days. The SysOps administrator must automatically identify users whose access keys are older than 90 days and notify the security team. Which combination of AWS services should be used to meet this requirement with the least operational overhead?

Accepted Answer

AWS Config with the 'access-keys-rotated' managed rule and Amazon SNS. AWS Config's 'access-keys-rotated' managed rule checks whether IAM user access keys have been rotated within the specified number of days (default 90). When a non-compliant resource is detected, AWS Config can trigger an Amazon SNS notification directly, without any custom code or additional infrastructure. This combination provides a fully managed, serverless solution with the least operational overhead.

Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters and alarms

Answer

IAM Access Analyzer and AWS Lambda

Answer

Amazon GuardDuty and Amazon EventBridge

Question 10

A company runs a web application on EC2 instances behind an Application Load Balancer. The database is an RDS MySQL instance with Multi-AZ enabled. The application experiences intermittent 5xx errors that correlate with database failover events. What is the MOST likely cause and solution?

Accepted Answer

Enable DNS caching with a low TTL in the application and use the RDS instance endpoint with a retry mechanism.. During an RDS Multi-AZ failover, the DNS record for the primary instance endpoint is updated to point to the standby instance. If the application caches the old DNS resolution with a high TTL, it continues to send connections to the unreachable primary, causing 5xx errors. Enabling DNS caching with a low TTL (e.g., 5 seconds) and implementing a retry mechanism ensures the application quickly resolves the new endpoint and reconnects, minimizing downtime.

Answer

Configure the application to use the RDS reader endpoint.

Answer

Use a read replica to offload read traffic and reduce failover impact.

Answer

Increase the database connection pool size to handle retries.

Question 11

A company runs a web application on Amazon EC2 instances in an Auto Scaling group that spans two Availability Zones. The application uses an Application Load Balancer (ALB) that is deployed across the same Availability Zones. The SysOps administrator wants to ensure the application remains available if an entire Availability Zone fails. Which configuration is essential for this high availability?

Accepted Answer

Configure the Auto Scaling group with at least one instance in each Availability Zone.. For high availability across an Availability Zone (AZ) failure, the Auto Scaling group must have at least one healthy instance in each AZ. This ensures that if one AZ becomes unavailable, the ALB can route traffic to instances in the remaining AZ. Without this minimum distribution, a single AZ failure could leave the application with zero healthy targets if all instances were in the failed AZ.

Answer

Enable cross-zone load balancing on the Application Load Balancer.

Answer

Use an Amazon Route 53 health check to route traffic away from a failed AZ.

Answer

Attach an Elastic IP address to each instance in the Auto Scaling group to ensure IP persistence.

Question 12

A company has an Amazon VPC with a CIDR block of 10.0.0.0/16 and an AWS Site-to-Site VPN connection to an on-premises data center. The on-premises DNS servers host a private domain 'corp.example.com'. The SysOps administrator needs to enable EC2 instances in the VPC to resolve DNS names for 'corp.example.com' using the on-premises DNS servers. Which Route 53 feature should be configured?

Accepted Answer

Route 53 Resolver outbound endpoints with forwarding rules. Route 53 Resolver outbound endpoints allow EC2 instances in a VPC to forward DNS queries for a specific domain (e.g., corp.example.com) to on-premises DNS servers via the Site-to-Site VPN connection. By creating a forwarding rule on the outbound endpoint, DNS queries for corp.example.com are sent to the on-premises DNS resolvers, enabling resolution of private DNS names without exposing the VPC to inbound traffic.

Answer

Route 53 Resolver inbound endpoints

Answer

VPC peering between the VPC and the on-premises network

Answer

Route 53 private hosted zone for corp.example.com

Question 13

A company is using Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. How should this be configured?

Accepted Answer

Configure Origin Access Control (OAC) with the S3 bucket policy.. Origin Access Control (OAC) is the recommended method to restrict access to an S3 bucket so that only CloudFront can retrieve objects. When OAC is enabled, CloudFront signs requests to S3 using a specific principal, and the S3 bucket policy is configured to allow access only to that principal. This prevents direct access to the bucket via S3 URLs or other AWS services, ensuring that content is served exclusively through CloudFront.

Answer

Use CloudFront signed URLs or cookies.

Answer

Attach an IAM role to CloudFront that grants S3 read access.

Answer

Create a bucket policy that allows access only from the CloudFront distribution's IP addresses.

Question 14

A SysOps administrator is tasked with encrypting data at rest for an Amazon S3 bucket that stores sensitive customer information. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption solution meets these requirements?

Accepted Answer

Use server-side encryption with Amazon S3-managed keys (SSE-S3).. SSE-S3 uses Amazon S3-managed keys that are automatically rotated by AWS, meeting the requirement for AWS-managed and automatic rotation. Option A is wrong because client-side encryption is not managed by AWS and does not use server-side encryption. Option B is wrong because SSE-C requires the customer to provide their own encryption keys, which are not automatically rotated. Option D is wrong because SSE-KMS uses AWS KMS keys that are customer-managed unless automatic rotation is specifically enabled, and the question requires automatic rotation without additional configuration.

Answer

Use client-side encryption with AWS KMS.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with AWS KMS (SSE-KMS).

Question 15

A company uses Amazon MQ (RabbitMQ) for messaging between microservices. The SysOps administrator needs to ensure the message broker is highly available with automatic failover and no data loss. Which deployment mode should be used?

Accepted Answer

Active/standby broker. Amazon MQ for RabbitMQ supports an active/standby deployment mode that provides automatic failover and no data loss. In this mode, one broker instance is active and a second is a synchronous standby; if the active fails, the standby takes over without losing messages because all data is replicated synchronously across both instances. This meets the high availability and data durability requirements specified in the question.

Answer

Single-instance broker

Answer

Cluster deployment

Answer

Multi-AZ broker with read replicas

Question 16

A company wants to automatically remediate an Amazon EC2 instance that becomes unresponsive by rebooting it. The solution should use AWS managed services to minimize custom code. Which combination should a SysOps administrator use? (Choose TWO.)

Accepted Answer

Amazon CloudWatch alarm on EC2 status check failures. Amazon CloudWatch can monitor EC2 status check failures (both system and instance checks) and trigger an alarm. When the alarm enters the ALARM state, it can directly invoke an AWS Systems Manager Automation document to reboot the instance, which is a managed, code-free remediation approach. This combination minimizes custom code by using built-in AWS services.

Answer

Amazon EC2 Auto Scaling and lifecycle hooks

Answer

Amazon CloudWatch alarm and AWS Lambda function

Answer

Amazon EventBridge rule to trigger an SNS notification

Question 17

Instances in a private subnet need outbound internet access for software updates. The route table sends 0.0.0.0/0 to a NAT gateway, but updates fail. Which condition should you check first?

Accepted Answer

Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.. A NAT gateway must reside in a public subnet with a route table entry directing 0.0.0.0/0 to an internet gateway (IGW). Without this, the NAT gateway cannot translate private IPs to the IGW's public IP, so outbound traffic from private instances fails. This is the most common root cause for failed internet access through a NAT gateway.

Answer

Attach an internet gateway directly to the private subnet instances.

Answer

Replace all security groups with network ACLs.

Answer

Enable VPC peering to another account.

Question 18

Which TWO actions should a SysOps administrator take to improve the availability and reduce latency for a web application hosted on EC2 instances behind an Application Load Balancer?

Accepted Answer

Implement Auto Scaling to add instances based on CPU utilization.. Auto Scaling based on CPU utilization dynamically adjusts the number of EC2 instances to match demand, improving availability by ensuring sufficient capacity during traffic spikes and reducing latency by distributing load across more instances. Option E is correct because deploying EC2 instances in multiple Availability Zones (AZs) provides fault tolerance: if one AZ fails, the ALB continues routing traffic to healthy instances in other AZs, which also reduces latency by serving users from the closest AZ.

Answer

Use larger EC2 instance types to handle more traffic.

Answer

Configure the ALB health check to have a shorter interval.

Answer

Use an Amazon CloudFront distribution in front of the ALB to cache content at edge locations.

Question 19

An administrator deploys a CloudFormation template that includes the snippet shown in the exhibit. Later, the administrator deletes the stack. What happens to the S3 bucket?

Accepted Answer

The bucket is retained but no longer managed by CloudFormation. The DeletionPolicy attribute set to 'Retain' on the S3 bucket resource causes CloudFormation to preserve the bucket when the stack is deleted. The bucket will still exist in the account but will no longer be under CloudFormation management. Therefore, option D is correct. Option A is incorrect because the bucket is retained regardless of its contents. Option B is incorrect because the bucket is not emptied or deleted. Option C is incorrect because the bucket is not deleted along with the stack.

Answer

The bucket is deleted only if it contains no objects

Answer

The bucket is emptied and then deleted

Answer

The bucket is deleted along with the stack

Question 20

A company uses AWS CodePipeline with AWS CodeBuild to build and deploy a static website to an S3 bucket. The website is served via Amazon CloudFront. The deployment fails intermittently because the S3 bucket policy does not allow CloudFront access after the bucket is updated. What is the BEST way to automate the bucket policy update during the deployment?

Accepted Answer

Use AWS CloudFormation to manage the S3 bucket and its policy, and update the stack as part of the pipeline.. AWS CloudFormation can manage the S3 bucket and its policy as part of the infrastructure. Using CloudFormation, the bucket policy can be updated automatically when the stack is updated, ensuring that CloudFront access is maintained. Option A is incorrect because including an AWS CLI command in the buildspec may work but is less robust and not as automated as using CloudFormation. Option C is incorrect because manually adding a bucket policy statement in the S3 management console is not automated and prone to errors. Option D is incorrect because while using a CloudFront origin access identity (OAI) and configuring it in the bucket policy is a best practice, it does not automate the policy update during deployment; CloudFormation handles this automatically.

Answer

Include an AWS CLI command in the buildspec to update the bucket policy after the build.

Answer

Add a bucket policy statement in the S3 management console to grant CloudFront access.

Answer

Use a CloudFront origin access identity (OAI) and configure it in the bucket policy.