SOA-C02 Practice Exam 53 — 20 Questions

Question 1

A company hosts a static website on Amazon S3 with public read access enabled. The website is accessed via a custom domain name that uses Amazon Route 53. The domain name points to the S3 bucket's website endpoint. Users report that they can access the website using the S3 bucket URL but not the custom domain name. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Route 53 alias record points to the S3 bucket's regional endpoint instead of the website endpoint.. For an S3 static website behind a custom domain, the Route 53 alias record must point to the bucket's S3 website endpoint (for example, bucket.s3-website-us-east-1.amazonaws.com), not the regional REST endpoint (bucket.s3.us-east-1.amazonaws.com). The regional endpoint does not serve index documents or support website redirects, so requests via the custom domain fail even though the bucket URL works. This mismatch is the most likely cause of the reported behavior.

Answer

The S3 bucket policy does not allow public access.

Answer

The website does not support HTTPS and the browser blocks it.

Answer

The DNS TTL is too long and the changes have not propagated.

Question 2

A company runs a stateless web application on Amazon EC2 instances in an Auto Scaling group with a minimum of 2 and maximum of 10 instances. The instances are behind an Application Load Balancer (ALB). The SysOps administrator needs to ensure that the application can survive the failure of an entire AWS Availability Zone (AZ) in the region. Which configuration is necessary?

Accepted Answer

Configure the Auto Scaling group with subnets in at least two Availability Zones and ensure the ALB has subnets in the same AZs.. Deploying the Auto Scaling group across multiple Availability Zones (AZs) and ensuring the ALB has subnets in the same AZs allows the application to continue serving traffic even if one entire AZ fails. The ALB can route requests to healthy instances in the remaining AZs, and the Auto Scaling group will replace failed instances in other AZs as needed, maintaining the minimum instance count. This architecture is a fundamental pattern for high availability in AWS.

Answer

Increase the Auto Scaling group minimum to 10 instances to absorb the failure.

Answer

Use larger instance types to handle the load of a failed AZ.

Answer

Use multiple Application Load Balancers in different AZs.

Question 3

A company has an on-premises data center connected to AWS via an AWS Direct Connect connection. The SysOps administrator needs to ensure high availability for the connectivity. Which configuration provides the highest availability for the Direct Connect connection?

Accepted Answer

Establish two Direct Connect connections to different AWS Direct Connect locations.. Establishing two Direct Connect connections to different AWS Direct Connect locations provides geographic redundancy. If one AWS Direct Connect location experiences an outage, the other connection remains operational, ensuring high availability. This configuration eliminates single points of failure at the facility level, which is the most resilient design for hybrid connectivity.

Answer

Establish a single Direct Connect connection with a VPN backup.

Answer

Establish two Direct Connect connections to the same AWS Direct Connect location.

Answer

Use multiple virtual interfaces on a single Direct Connect connection.

Question 4

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect to an on-premises network with a CIDR of 10.0.0.0/8. What is the issue?

Accepted Answer

The CIDR blocks overlap, causing routing conflicts.. Overlapping CIDR blocks prevent VPC peering or VPN connections because routes conflict. Option A is not the issue. Option B is not the primary issue. Option D is not directly a problem.

Answer

The on-premises CIDR is private and cannot be used with AWS.

Answer

AWS does not support /8 CIDR blocks.

Answer

The VPC CIDR is too large.

Question 5

A SysOps administrator needs to monitor the CPU utilization of an EC2 instance and receive an alert when it exceeds 80% for 10 consecutive minutes. Which AWS service should be used to configure this monitoring and alerting?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it allows you to monitor a specific metric, such as EC2 CPUUtilization, and trigger an action (e.g., an SNS notification) when the metric crosses a defined threshold (80%) for a specified number of consecutive evaluation periods (10 minutes, which with the default 1-minute period equals 10 datapoints). This directly fulfills the requirement for threshold-based alerting on a single metric over a sustained duration.

Answer

Amazon EventBridge

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 6

A SysOps administrator needs to automate the deployment of a three-tier web application. The application consists of an Application Load Balancer, a fleet of EC2 instances running a web server, and an Amazon RDS MySQL database. The administrator must ensure that the database credentials are securely stored and automatically rotated. The administrator also needs to version the infrastructure configuration. Which combination of AWS services should the administrator use?

Accepted Answer

AWS CloudFormation for infrastructure and AWS Secrets Manager for secrets.. AWS CloudFormation is used to automate infrastructure deployment and version the configuration as code. AWS Secrets Manager securely stores database credentials and provides automatic rotation. Together, they meet the requirements for secure credential management and infrastructure versioning.

Answer

AWS CloudFormation for infrastructure and AWS Systems Manager Parameter Store for secrets.

Answer

AWS OpsWorks for infrastructure and AWS Secrets Manager for secrets.

Answer

AWS CodeCommit for infrastructure versioning and AWS KMS for secrets.

Question 7

Refer to the exhibit. A SysOps administrator creates this stack. Which of the following is true about the bucket?

Accepted Answer

The bucket has versioning enabled. The exhibit shows a CloudFormation template where the S3 bucket resource includes the VersioningConfiguration property with Status set to Enabled. When this stack is deployed, AWS applies that configuration to the bucket, so versioning is active. This means every object overwrite or delete creates a new version rather than destroying the prior object.

Answer

The bucket is publicly accessible

Answer

The bucket does not have versioning enabled

Answer

The bucket allows public read access

Question 8

A SysOps administrator is managing a multi-account AWS environment using AWS Organizations. The security team has mandated that all Amazon S3 buckets across all accounts must be encrypted with SSE-KMS using a centrally managed KMS key. The administrator has created a KMS key in the master account and enabled key rotation. The key policy allows the root user of each member account to use the key. However, users in member accounts report that they cannot upload objects to their S3 buckets with SSE-KMS using the central key, even though they have s3:PutObject permissions. The administrator verifies that the KMS key policy includes the necessary permissions for the member accounts. What should the administrator do to resolve the issue?

Accepted Answer

Attach an IAM policy to the users/roles in the member accounts that allows kms:GenerateDataKey using the central KMS key.. Cross-account KMS usage requires permissions on both sides: the key policy must allow the external account, and the IAM principal in that account must also be granted kms:GenerateDataKey (and kms:Decrypt) via an IAM policy. The key policy alone is insufficient.

Answer

Create a new KMS key in each member account and configure S3 bucket default encryption accordingly.

Answer

Ensure that the KMS key policy allows the master account to administer the key.

Answer

Update the S3 bucket policy to allow the s3:PutObject action only when encryption is set to SSE-KMS.

Question 9

A SysOps administrator wants to receive alerts when the estimated charges for an AWS account exceed a certain threshold. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets enables you to set custom cost and usage budgets and receive alerts when your actual or forecasted costs exceed your budget thresholds. This is the correct service for receiving alerts on estimated charges. Option A (AWS Trusted Advisor) provides cost optimization recommendations but does not send billing alerts. Option B (AWS Cost Explorer) allows you to analyze your costs but does not send proactive alerts. Option C (Amazon CloudWatch billing metric) does have billing metrics, but to set alerts on those metrics you must use AWS Budgets; CloudWatch itself is not the service for budget alerts.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

Amazon CloudWatch (billing metric)

Question 10

A company runs a fleet of EC2 instances in a production environment. The instances are part of an Auto Scaling group that uses a launch template with a m5.large instance type. The company's SysOps administrator notices that the instances are often over-provisioned, with average CPU utilization below 20% for the past month. The administrator wants to reduce costs without affecting application performance. The application is stateless and can handle temporary performance degradation. Which action should the administrator take?

Accepted Answer

Modify the launch template to use a t3.medium instance type.. Modifying the launch template to use a t3.medium instance type is correct because t3 instances are burstable and cost-effective for workloads with low average CPU utilization (below 20%). The application is stateless and can handle temporary performance degradation, making burstable instances suitable. This reduces costs without affecting performance during normal operation, as t3.medium provides a baseline CPU with the ability to burst.

Answer

Purchase Reserved Instances for the current m5.large instances to lower hourly cost.

Answer

Enable detailed monitoring on all instances to collect more data.

Answer

Increase the minimum size of the Auto Scaling group to reduce scale-out events.

Question 11

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences variable traffic patterns with occasional spikes. The current setup uses On-Demand instances in an Auto Scaling group with a simple scaling policy based on average CPU utilization. The team wants to optimize cost while ensuring that the application can handle spikes in traffic. What should the team do to reduce cost?

Accepted Answer

Configure the Auto Scaling group to use a mixed instances policy with Spot Instances for a portion of the capacity and On-Demand for the remainder.. A mixed instances policy lets the Auto Scaling group blend Spot Instances (up to ~90% cheaper than On-Demand) for the stateless, interruption-tolerant portion of the web tier with On-Demand instances as a stable baseline. This directly reduces compute cost while the ASG still scales out to absorb traffic spikes, and Spot capacity pools across multiple instance types/AZs improve availability. It is the only option that changes the pricing model of the existing capacity rather than just the scaling trigger.

Answer

Switch to a target tracking scaling policy based on request count per target.

Answer

Implement scheduled scaling to add capacity during known peak hours.

Answer

Purchase Reserved Instances for the minimum expected capacity to get a discount.

Question 12

A SysOps administrator needs to ensure that an Amazon EC2 instance can access an Amazon S3 bucket without storing long-term credentials on the instance. Which approach should be used?

Accepted Answer

Create an IAM role with S3 permissions and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance profile allows the instance to obtain temporary security credentials from the instance metadata service, eliminating the need to store long-term credentials on the instance. Option A is incorrect because security groups control network traffic, not API-level access to S3. Option B is incorrect because a bucket policy granting access based on a public IP address is insecure and does not provide AWS credentials. Option D is incorrect because storing IAM user credentials on the instance is insecure and not a best practice.

Answer

Configure a security group rule that allows outbound traffic to S3.

Answer

Assign a bucket policy that grants access to the EC2 instance's public IP address.

Answer

Create an IAM user with programmatic access and store the credentials in a file on the instance.

Question 13

A company uses Amazon Route 53 for DNS. They want to ensure that if the primary web server fails, traffic is automatically routed to a secondary server in another region. Which routing policy should be used?

Accepted Answer

Failover routing policy. The Failover routing policy in Amazon Route 53 is specifically designed for active-passive failover configurations. When the primary endpoint fails a health check, Route 53 automatically returns the secondary record in DNS responses, ensuring traffic is routed to the secondary server in another region. This directly meets the requirement for automatic failover between primary and secondary web servers.

Answer

Simple routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 14

A company runs a critical production database on Amazon RDS for MySQL with a Multi-AZ deployment. The database experiences a primary instance failure. The SysOps administrator needs to understand exactly how the failover process worked and why the application experienced a longer-than-expected downtime. Which AWS service or feature should the administrator use to review detailed events and actions during the failover?

Accepted Answer

AWS Personal Health Dashboard. AWS Personal Health Dashboard provides a personalized view of the health of AWS services and resources, including detailed event logs for RDS Multi-AZ failovers. It surfaces the exact sequence of actions (e.g., DNS record update, failover initiation, completion) and any underlying AWS infrastructure issues that caused the extended downtime, such as degraded hardware or network latency. This is the correct tool because it gives the administrator a chronological, AWS-side account of the failover process, which is not available through other services.

Answer

Amazon RDS Performance Insights

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 15

A SysOps administrator manages a web application hosted on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. Recently, the development team deployed a new version that increases the load time for certain pages. Users report that they are randomly seeing other users' data. The administrator suspects that the sticky session configuration is not working correctly. The ALB target group is configured with stickiness enabled using the AWSALB cookie. What should the administrator do to verify that sticky sessions are being honored?

Accepted Answer

Use a browser's developer tools to inspect the cookies on the client side and verify the AWSALB cookie is being set and includes the correct target group identifier. To verify sticky sessions, inspect browser developer tools to confirm the AWSALB cookie is set and remains unchanged across requests. The cookie value is opaque and cannot be decoded to reveal the target group identifier. ALB access logs can also be used to correlate the cookie with the target IP, and the presence of the cookie in access logs does prove the client sent it.

Answer

Increase the stickiness duration to 7 days and test again

Answer

Check the ALB access logs for the presence of the stickiness cookie

Answer

Check the target group health check settings to ensure all instances are healthy

Question 16

A company has an application that requires UDP traffic to be distributed across multiple EC2 instances. Which AWS load balancer type should be used?

Accepted Answer

Network Load Balancer. A Network Load Balancer (NLB) operates at Layer 4 and can handle both TCP and UDP traffic, making it the correct choice for distributing UDP traffic across multiple EC2 instances. Unlike other load balancers, NLB preserves the source IP address and can forward UDP packets without inspecting application-layer headers, which is essential for UDP-based applications such as DNS, VoIP, or gaming servers.

Answer

Classic Load Balancer

Answer

Amazon CloudFront

Answer

Application Load Balancer

Question 17

Which TWO actions improve the availability of an application running on EC2 instances in a single Auto Scaling group? (Choose 2)

Accepted Answer

Use an Elastic Load Balancer with health checks to route traffic only to healthy instances.. An Elastic Load Balancer (ELB) performs health checks against EC2 instances and automatically routes traffic only to instances that pass those checks. If an instance becomes unhealthy, the ELB stops sending traffic to it, preventing user requests from reaching a failing instance and thereby improving application availability.

Answer

Increase the instance size to handle higher load.

Answer

Create a CloudWatch alarm to notify when the CPU utilization exceeds 80%.

Answer

Enable EBS optimization on the instances.

Question 18

A company runs a stateful web application on EC2 instances behind a Network Load Balancer. The application requires that client requests from a particular session are always sent to the same target instance. Which feature should the SysOps administrator configure on the NLB to meet this requirement?

Accepted Answer

Configure sticky sessions using flow-based routing (client IP affinity). Network Load Balancers (NLBs) support session stickiness through flow-based routing based on the client's IP address and port (Layer 4). This ensures that requests from the same client session are consistently routed to the same target instance, meeting the requirement without using application-layer cookies.

Answer

Configure path-based routing rules

Answer

Enable health checks on the target group

Answer

Enable cross-zone load balancing

Question 19

A company runs a critical application on a single Amazon EC2 instance with an attached Amazon EBS volume. The SysOps administrator needs to implement a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes. The application runs continuously and data changes frequently. Which solution should the administrator implement?

Accepted Answer

Use AWS Elastic Disaster Recovery (AWS DRS) to continuously replicate the instance to a staging area in another region.. AWS Elastic Disaster Recovery (AWS DRS) continuously replicates the entire EC2 instance, including the EBS volume, to a staging area in another AWS Region with sub-second data changes. This meets the RPO of 15 minutes and RTO of 30 minutes because you can launch a fully recovered instance in the target region within minutes from the latest consistent point, without relying on periodic snapshots or backups that would miss frequent data changes.

Answer

Use Amazon Data Lifecycle Manager (DLM) to take EBS snapshots every 15 minutes and automate the creation of a new AMI.

Answer

Use AWS Backup to schedule backups every 15 minutes and restore from the latest backup when needed.

Answer

Use an Auto Scaling group with a custom AMI that is updated every 15 minutes by a Lambda function.

Question 20

A company has a multi-account AWS environment using AWS Organizations. The SysOps Administrator needs to deploy a standardized set of baseline resources (VPC, subnets, security groups, and an S3 bucket for logs) into each new member account as soon as the account is created. The administrator wants to automate this process using AWS CloudFormation and ensure that the baseline resources are deployed without manual intervention. The organization uses AWS CloudTrail and AWS Config for governance. What solution should the administrator implement?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to accounts in the organization.. AWS CloudFormation StackSets with automatic deployment is purpose-built for this scenario: it deploys a single template across multiple accounts in an AWS Organization and can automatically push the stack to new member accounts as they are added. The 'automatic deployment' setting enables StackSets to target the entire OU or organization, so new accounts inherit the baseline resources without manual intervention. This directly satisfies the requirement to deploy VPC, subnets, security groups, and an S3 log bucket into each new account automatically.

Answer

Create an AWS Config rule that triggers an AWS Lambda function to deploy the baseline resources when a new account is created.

Answer

Store the CloudFormation template in Amazon S3 and use S3 event notifications to trigger a Lambda function that deploys the stack into the new account.

Answer

Use AWS Service Catalog to create a portfolio with the baseline products and grant access to the organization.