SOA-C02 Practice Exam 54 — 20 Questions

Question 1

A company runs a critical web application on Amazon EC2 instances that are part of an Auto Scaling group. The application receives unpredictable traffic spikes. The SysOps administrator needs to ensure that when a scale-out event occurs, new instances are ready to serve traffic quickly to minimize latency spikes. Currently, the instance launch and configuration process (including software installs and cache warming) takes about 5 minutes. The administrator wants to reduce the time it takes for new instances to start serving traffic. Which combination of Auto Scaling features should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement an Auto Scaling warm pool with a minimum number of pre-initialized instances in a 'Stopped' state. Configure the scaling policy to move instances from the warm pool to the Auto Scaling group when needed.. An Auto Scaling warm pool maintains a pool of pre-initialized instances in a 'Stopped' state that are fully configured (software installed, cache warmed) and ready to serve traffic. When a scale-out event occurs, instances from the warm pool are moved to the Auto Scaling group and transitioned to 'Running' state, bypassing the 5-minute launch and configuration delay, thereby minimizing latency spikes.

Answer

Use a launch template that includes a pre-warmed Amazon Machine Image (AMI) with all software pre-installed, and configure the Auto Scaling group to use a larger instance type to reduce initialization time.

Answer

Use scheduled scaling to predictively launch instances before the traffic spikes based on historical patterns.

Answer

Configure lifecycle hooks to add a wait time during instance launch so that the instance is fully configured before it is placed behind the load balancer.

Question 2

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment strategy is set to CodeDeployDefault.HalfAtATime. The lifecycle hooks for the Auto Scaling group include a test hook that runs during instance launch. During a recent deployment, the deployment failed because the new instances failed the test hook and were not marked as healthy. The SysOps administrator needs to ensure that failed instances are automatically terminated and replaced with new ones from the Auto Scaling group. Which configuration change should the administrator make?

Accepted Answer

Modify the Auto Scaling group's health check type to ELB. Setting the Auto Scaling group's health check type to ELB (Elastic Load Balancer) ensures that the Auto Scaling group uses the ELB's health check status to determine instance health. When the test lifecycle hook fails, the new instances are not marked as healthy by the ELB, causing the Auto Scaling group to automatically terminate and replace them. This aligns with the requirement to automatically replace failed instances, as the default EC2 health check only considers instance status (e.g., running vs. stopped) and does not reflect application-level health.

Answer

Modify the CodeDeploy deployment configuration to use an increased minimum healthy instance count

Answer

Modify the Auto Scaling group's health check grace period to a lower value

Answer

Modify the CodeDeploy deployment to ignore the lifecycle hook failure

Question 3

A SysOps administrator receives an alert that an EC2 instance in an Auto Scaling group is unhealthy. The instance fails the EC2 status check. What is the BEST course of action to restore availability automatically?

Accepted Answer

Configure the Auto Scaling group to use EC2 status checks for health checks and set the health check grace period appropriately.. Configuring the Auto Scaling group to use EC2 status checks for health checks allows it to automatically detect when an instance fails the EC2 status check and replace it with a new one, ensuring high availability without manual intervention. The health check grace period prevents premature termination during initial instance bootstrapping. This is the most automated and resilient approach for restoring availability in response to EC2 status check failures.

Answer

Use AWS Systems Manager to replace the underlying host.

Answer

Manually reboot the instance from the EC2 console.

Answer

Create a CloudWatch alarm that triggers an SNS notification to the administrator.

Question 4

A company wants to monitor the number of messages in an Amazon SQS queue and scale the number of EC2 instance consumers based on queue depth. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch and Amazon EC2 Auto Scaling. Amazon CloudWatch monitors the SQS queue depth (ApproximateNumberOfMessagesVisible metric) and triggers an Amazon EC2 Auto Scaling scaling policy based on a CloudWatch alarm. This allows the number of EC2 consumer instances to dynamically scale in or out in response to the queue depth, ensuring efficient processing without over-provisioning.

Answer

Amazon Elastic Load Balancing and Amazon EC2 Auto Scaling

Answer

Amazon CloudWatch and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Question 5

A SysOps administrator needs to ensure that all S3 buckets in the account are configured with server access logging. Which AWS service can evaluate the buckets and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously evaluate your S3 buckets against a managed rule (s3-bucket-server-access-logging-enabled) and automatically remediate non-compliant buckets using AWS Systems Manager Automation documents. This allows the SysOps administrator to enforce server access logging as a compliance requirement without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 6

A company runs a file-sharing application on AWS. Users upload files to an S3 bucket, which triggers a Lambda function to process the files and store metadata in a DynamoDB table. Recently, users have reported that some uploaded files are never processed. The SysOps Administrator checks the CloudWatch logs and finds no errors from the Lambda function. The S3 bucket is configured to send events to the Lambda function. The DynamoDB table has sufficient write capacity. The administrator suspects that the event notifications are being lost. Which action should the SysOps Administrator take to ensure that every file upload triggers a Lambda function and that the function processes the file successfully?

Accepted Answer

Configure an SQS queue as the event destination for the S3 bucket, and have the Lambda function process messages from the queue.. Using an SQS queue as the event destination for S3 bucket events provides a durable, reliable mechanism to capture every event. S3 sends event notifications to the SQS queue, and if the Lambda function fails or is throttled, the message remains in the queue for later processing. This decouples the event source from the function and ensures no events are lost. Option B is incorrect because DynamoDB Streams capture changes to DynamoDB items, not S3 events. Option C is wrong because increasing reserved concurrency only helps with Lambda scaling but does not address potential event loss due to failures or delivery issues. Option D is wrong because DynamoDB write capacity is already sufficient; the issue is with S3 event delivery, not database writes.

Answer

Use DynamoDB Streams to capture file metadata changes instead of Lambda invocation.

Answer

Increase the Lambda function's reserved concurrency to handle more invocations.

Answer

Increase the write capacity of the DynamoDB table to avoid throttling.

Question 7

A SysOps administrator wants to identify underutilized Amazon EC2 instances that could be downsized to reduce costs. The administrator needs a tool that provides recommendations based on historical utilization data. Which AWS service should the administrator use?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it analyzes historical utilization metrics (CPU, memory, network, and storage) for EC2 instances and generates specific downsizing recommendations to reduce cost without sacrificing performance. It uses machine learning to identify underutilized resources and provides actionable guidance, making it the ideal tool for this use case.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 8

A company is using AWS Lambda functions to process incoming messages from Amazon SQS. The Lambda function sometimes fails due to a transient error, and the message is not processed. The team wants to automatically retry failed messages and send them to a dead-letter queue (DLQ) after three failed attempts. Which configuration meets these requirements?

Accepted Answer

Configure the SQS queue with a redrive policy that allows three maximum receives before sending to a DLQ.. When SQS is configured as an event source for Lambda, retries are controlled by the SQS queue's redrive policy. The redrive policy with maxReceiveCount determines how many times a message can be received before it is moved to the DLQ. Setting maxReceiveCount to 3 means after three receive attempts (i.e., three failed processing attempts), the message is sent to the DLQ. Option C is incorrect because Lambda's dead-letter configuration is used for asynchronous invocations, not for SQS event source mappings. For SQS-triggered functions, the DLQ must be configured on the SQS queue itself using a redrive policy, not on the Lambda function.

Answer

Set the Lambda function's reserved concurrency to 1 and enable 'maximumRetryAttempts' to 2.

Answer

Create an SQS queue with a visibility timeout that allows three retries before sending to a DLQ.

Answer

Configure the SQS queue as an event source for Lambda with a DLQ specified in the Lambda function's dead-letter configuration.

Question 9

Refer to the exhibit. An IAM policy is attached to a user. The user's IP address is 10.0.1.5. What is the result when the user tries to download an object from the folder 'confidential' in 'example-bucket'?

Accepted Answer

The request is denied because of the explicit Deny statement.. The policy contains an explicit Deny for the 'confidential' folder. In IAM, an explicit Deny overrides any Allow. Therefore, even if the user's IP is within the allowed range, the Deny blocks the download. Options B, C, and D are incorrect because the Deny is unconditional and does not depend on IP address.

Answer

The request is allowed because the Deny statement only applies if the IP is outside the range.

Answer

The request is allowed because the user's IP matches the allowed range.

Answer

The request is denied because the Deny statement applies only when the IP is outside the range.

Question 10

A company stores critical data in an S3 bucket. To ensure data durability and availability, the company wants to automatically replicate objects to a bucket in a different AWS Region. Which S3 feature should be used?

Accepted Answer

Configure S3 Cross-Region Replication.. S3 Cross-Region Replication (CRR) is the correct feature because it automatically and asynchronously replicates objects from a source S3 bucket in one AWS Region to a destination bucket in a different AWS Region. This ensures data durability and availability by maintaining a copy in a separate geographic location, meeting the requirement for cross-region replication. CRR requires versioning to be enabled on both source and destination buckets.

Answer

Enable S3 Standard storage class on the bucket.

Answer

Use S3 One Zone-IA storage class.

Answer

Enable S3 Versioning on the bucket.

Question 11

A SysOps administrator notices that an EC2 instance's CPU utilization has been at 100% for the past hour. The administrator checks CloudWatch metrics and sees no anomalies in network or disk I/O. Which step should the administrator take to investigate further?

Accepted Answer

Enable detailed monitoring on the EC2 instance to get 1-minute CloudWatch metrics.. Detailed monitoring (1-minute metrics) provides higher-resolution data than the default 5-minute metrics, allowing the administrator to identify short-lived CPU spikes or patterns that might be averaged out in the standard 5-minute interval. Since network and disk I/O appear normal, the issue is likely a process or application consuming CPU, and finer-grained metrics help pinpoint the timing and correlate with specific events or logs.

Answer

Install the CloudWatch Logs agent on the instance to capture system logs.

Answer

Check the EC2 instance's CPU credit balance in CloudWatch.

Answer

Stop the EC2 instance and start it again to reset the CPU.

Question 12

An IAM user has the policy shown in the exhibit. The user is trying to download an object from example-bucket from an IP address of 192.0.2.50. However, the request is denied. What is the most likely reason?

Accepted Answer

The bucket has a bucket policy that denies access from the user's IP address.. The bucket policy explicitly denies the request from IP 192.0.2.50, overriding any IAM policy that allows the action. Option A is incorrect because aws:SourceIp is a valid condition key. Option C is incorrect because the resource ARN 'arn:aws:s3:::example-bucket/*' is appropriate for GetObject on objects. Option D is incorrect because the condition key aws:SourceIp requires the IpAddress operator, not StringEquals.

Answer

The condition key aws:SourceIp should be aws:SourceIpAddress.

Answer

The resource ARN does not include the bucket itself.

Answer

The condition syntax is incorrect because it should use StringEquals.

Question 13

A SysOps administrator is investigating a failed CloudFormation stack creation. The describe-stack-events output shows that the stack creation failed with the reason 'Resource creation cancelled'. What is the most likely cause of this failure?

Accepted Answer

A WaitCondition resource did not receive the required signal within the specified timeout period.. The WaitCondition timed out before receiving the required signal, causing CloudFormation to cancel the stack creation. Option A is incorrect because a parameter validation error would appear as a different reason. Option B is incorrect because there is no indication of missing IAM permissions. Option D is incorrect because the stack creation was cancelled due to the wait condition timeout, not a nested stack failure.

Answer

The stack template contains an invalid parameter value.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to create the resources.

Answer

A nested stack within the parent stack failed to create.

Question 14

A company uses AWS Backup to back up its Amazon EFS file systems. The SysOps administrator needs to ensure that backups are retained for 7 years to meet compliance requirements. What should the administrator do?

Accepted Answer

Create a backup plan with a lifecycle policy that retains backups for 7 years.. AWS Backup allows you to define backup plans that include lifecycle policies to automatically transition backups to cold storage and expire them after a specified retention period. By setting the retention period to 7 years (2557 days) in the backup plan, AWS Backup will automatically manage the deletion of backups after that time, ensuring compliance without manual intervention.

Answer

Manually delete backups older than 7 years every month.

Answer

Increase the backup frequency to daily.

Answer

Configure cross-region backup to copy backups to another region.

Question 15

A company runs a critical microservices application on Amazon ECS with Fargate launch type. The application consists of several services that communicate via internal HTTP calls. The SysOps Administrator notices that during periods of increased load, some services become unresponsive and the health checks fail. The ECS service auto scaling is configured based on CPU utilization, but it does not scale quickly enough. The administrator needs to improve the reliability and responsiveness of the application. The services are stateless and can be scaled horizontally. The current architecture uses a single Application Load Balancer for each service. The ALB health checks are set to a 30-second interval with a 5-second timeout and 2 unhealthy thresholds. The administrator has observed that when a service instance becomes unhealthy, it takes too long for the ALB to stop sending traffic to it, causing errors. What should the SysOps Administrator do to improve the reliability and responsiveness of the application?

Accepted Answer

Configure the ALB health check to have a 5-second interval, 2-second timeout, and 2 unhealthy threshold.. Reducing the health check interval to 5 seconds and timeout to 2 seconds with an unhealthy threshold of 2 allows the ALB to detect service failures much faster. With the original settings (30s interval, 5s timeout, 2 threshold), detection could take up to 65 seconds. With the new settings, detection time is reduced to about 12 seconds, so traffic is stopped sooner and errors are minimized. Option A is wrong because increasing the interval and threshold would make detection even slower. Option C is wrong because increasing the CPU target delays scaling, which does not address health check responsiveness. Option D is wrong because a Network Load Balancer uses TCP health checks which are less application-aware and may not detect HTTP-level failures, and it does not inherently speed up health check detection.

Answer

Increase the ALB health check interval to 60 seconds and unhealthy threshold to 5.

Answer

Increase the ECS service auto scaling target CPU utilization to 90%.

Answer

Replace the ALB with a Network Load Balancer and use TCP health checks.

Question 16

A company requires that all S3 buckets be tagged with a 'CostCenter' tag. A SysOps administrator needs to enforce this and prevent creation of untagged buckets. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) that denies s3:CreateBucket unless the request includes the required tag. AWS Organizations SCPs can be used to deny actions that do not meet certain conditions, such as requiring specific tags. An SCP with a condition for 'aws:RequestTag' can enforce tagging at bucket creation. IAM policies can also enforce tagging for specific users, but SCPs apply to all accounts in the organization. AWS Config rules can detect non-compliant resources but cannot prevent creation. CloudTrail is for logging, not enforcement.

Answer

Create an IAM policy that allows s3:CreateBucket only if the bucket has the tag, and attach it to all users

Answer

Enable AWS CloudTrail to log bucket creation and review logs daily

Answer

Use an AWS Config rule to automatically delete untagged buckets

Question 17

A SysOps administrator is troubleshooting a failed AWS Elastic Beanstalk environment update. The update changed the configuration of the EC2 instances in the Auto Scaling group, but the new instances fail to launch. The administrator checks the Auto Scaling group's scaling activities and sees a 'Failed' status with the message: 'Instance failed to reach the desired state.' What should the administrator check next?

Accepted Answer

Check the CloudWatch logs for the failed instance to identify application or configuration errors.. When Elastic Beanstalk instances fail to launch with 'Instance failed to reach the desired state,' the next step is to examine the instance's logs (via CloudWatch Logs or the EB console's logs bundle) to identify configuration or application errors. This message typically indicates the instance launched but failed health checks or initialization, so logs reveal the root cause.

Answer

Check the IAM role attached to the environment's EC2 instances for missing permissions.

Answer

Check the account service quotas for EC2 instances.

Answer

Check the termination protection setting on the Auto Scaling group.

Question 18

A company is using Amazon CloudFront to distribute content globally. The origin is an S3 bucket. The SysOps administrator notices that cache hit ratio is low. Which configuration change would MOST improve the cache hit ratio?

Accepted Answer

Set longer Cache-Control max-age headers on the S3 objects.. Cache hit ratio measures how often CloudFront serves content from edge caches instead of forwarding requests to the origin. The Cache-Control max-age header (and its s-maxage/Expires equivalents) directly controls how long CloudFront keeps an object in cache before revalidating with S3. Extending max-age on the S3 objects means each cached copy satisfies more subsequent requests, which raises the hit ratio without changing request patterns.

Answer

Use query string parameters to differentiate content.

Answer

Configure custom error responses for 404 errors.

Answer

Enable Origin Shield for the distribution.

Question 19

A company uses AWS CloudTrail to log API activity. The SysOps administrator needs to ensure that log files are protected from accidental deletion and are available for compliance audits for at least 7 years. Which service should be used to meet these requirements?

Accepted Answer

Enable S3 Object Lock in Compliance mode.. S3 Object Lock in Compliance mode provides a write-once-read-many (WORM) model that prevents any user, including the AWS account root user, from deleting or overwriting objects for the specified retention period. This meets both the protection from accidental deletion and the 7-year compliance audit requirement, as the retention mode cannot be shortened or removed once applied.

Answer

Enable S3 Versioning on the CloudTrail S3 bucket.

Answer

Move CloudTrail logs to Amazon S3 Glacier after 90 days.

Answer

Store logs in Amazon CloudWatch Logs with an expiration policy of 7 years.

Question 20

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to send traffic to an EC2 instance in subnet-B. Both instances are in the same VPC and have appropriate security group rules. However, traffic is not reaching the destination. What is the MOST likely cause?

Accepted Answer

The network ACL associated with subnet-B is denying inbound traffic from subnet-A.. Network ACLs are stateless and must explicitly allow both inbound and outbound traffic for each subnet. If the NACL on subnet-B denies inbound traffic from subnet-A's CIDR (10.0.1.0/24), the packets will be dropped even though security groups allow them. Since the instances are in the same VPC, the default route table includes a local route for the entire VPC CIDR (10.0.0.0/16), so routing is not the issue. Security groups are stateful and already allow the traffic per the scenario.

Answer

The route table for subnet-A does not have a route for subnet-B's CIDR.

Answer

The security group on the destination instance does not allow inbound traffic from the source instance.

Answer

The VPC peering connection is not established between the two subnets.