SOA-C02 Practice Exam 55 — 20 Questions

Question 1

A company uses Amazon CloudFront to distribute content globally. The SysOps administrator notices that the origin load is high and the cache hit ratio is low. What should the administrator do to improve the cache hit ratio and reduce origin load?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the minimum, maximum, and default TTL values for the cache behavior.. Increasing the minimum, maximum, and default TTL values ensures that objects are cached for longer periods, which increases the likelihood of cache hits and reduces the load on the origin server. Option A (changing origin protocol policy to HTTPS only) does not affect caching behavior. Option B (adding an additional origin server) distributes load but does not directly improve cache hit ratio. Option C (enabling compression) reduces the size of transferred data but does not increase cache hits; it can even reduce caching efficiency if not configured properly.

Answer

Change the origin protocol policy to HTTPS only.

Answer

Add an additional origin server.

Answer

Enable compression for the content.

Question 2

A company runs a critical application on an EC2 instance backed by Amazon EBS. To protect against data loss, the company wants to create a backup strategy that allows for point-in-time recovery. Which solution should be used?

Accepted Answer

Create automated EBS snapshots.. Automated EBS snapshots provide point-in-time backups of the EBS volume, enabling granular recovery to a specific moment. Snapshots are stored in Amazon S3 and can be used to restore the volume or create new instances, directly addressing the requirement for point-in-time recovery against data loss.

Answer

Configure an S3 Lifecycle policy to move data to Glacier.

Answer

Create an Amazon Machine Image (AMI) of the instance.

Answer

Use Amazon EFS to store data.

Question 3

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. Users report intermittent 502 errors. What is the most likely cause?

Accepted Answer

The ALB is experiencing health check failures or scaling issues.. CloudFront returns HTTP 502 (Bad Gateway) when the origin — here an ALB — cannot successfully serve the request, most commonly because the ALB has no healthy targets registered. Health check failures or scaling events that leave the ALB without healthy backend instances cause CloudFront to receive an error response or no response, resulting in intermittent 502s.

Answer

The CloudFront distribution does not have Cache-Control headers configured.

Answer

AWS WAF is blocking requests from CloudFront.

Answer

The SSL/TLS certificate on the ALB is expired.

Question 4

A company runs a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application has predictable traffic patterns with high traffic during business hours and low traffic at night. The SysOps administrator wants to reduce compute costs while ensuring the application remains responsive during peak hours. The administrator has already implemented Auto Scaling based on CPU utilization. Which additional action should the administrator take to optimize costs?

Accepted Answer

Purchase Reserved Instances for the baseline capacity and use Spot Instances for the additional capacity during peak hours. It combines Reserved Instances for predictable baseline capacity (lower cost per hour) with Spot Instances for elastic peak demand, leveraging Auto Scaling to handle variable traffic. This hybrid approach reduces compute costs compared to using On-Demand instances for all capacity, while maintaining responsiveness during peak hours.

Answer

Use On-Demand instances only

Answer

Increase the minimum number of instances in the Auto Scaling group

Answer

Use Dedicated Hosts to reduce licensing costs

Question 5

A company is running a high-performance computing (HPC) workload on EC2. The workload is time-sensitive and runs for 2 hours every night. The company wants to minimize costs. Which THREE options should they consider? (Choose THREE.)

Accepted Answer

Use an EFS or S3 as shared storage instead of EBS volumes.. Options B, C, and E are correct. B is correct because using EFS or S3 as shared storage reduces costs compared to attaching individual EBS volumes to each instance. C is correct because using smaller instance types in parallel can be more cost-effective for HPC workloads that can be parallelized. E is correct because Spot Instances offer significant discounts for fault-tolerant workloads like HPC. Option A is incorrect because Reserved Instances require a 1-3 year commitment and would not be cost-effective for a 2-hour nightly job. Option D is incorrect because Dedicated Instances are more expensive and not necessary for this workload.

Answer

Purchase Reserved Instances for the nightly run.

Answer

Use Dedicated Instances for performance isolation.

Question 6

A SysOps Administrator is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. The instances can communicate over private IP addresses when security groups are set to allow all traffic, but fail when security groups are configured with specific rules. The Administrator wants to allow HTTP (port 80) and HTTPS (port 443) traffic from the client instance to the server instance. What security group rules are needed?

Accepted Answer

Add inbound rules on the server to allow HTTP and HTTPS from the client security group.. Security groups are stateful, meaning that if you allow inbound traffic, the response outbound is automatically allowed regardless of outbound rules. Therefore, you only need to add inbound rules on the server instance to allow HTTP and HTTPS traffic from the client security group. Option B is incorrect because no inbound rules are needed on the client. Option C is incorrect because no outbound rules are needed on either instance for this traffic. Option D is incorrect because outbound rules on the server are not required.

Answer

Add inbound rules on both the client and server.

Answer

Add outbound rules on both the client and server.

Answer

Add inbound rules on the client and outbound rules on the server.

Question 7

A SysOps administrator needs to ensure that all S3 buckets in the account have server access logging enabled. The administrator wants to be notified if a bucket is created without logging. What is the most efficient solution?

Accepted Answer

Use AWS Config with a managed rule to evaluate S3 buckets for server access logging.. AWS Config with the managed rule 's3-bucket-server-access-logging-enabled' continuously evaluates all S3 buckets against the desired configuration. When a bucket is created without server access logging, AWS Config automatically flags it as noncompliant and can trigger an SNS notification. This is the most efficient solution because it provides ongoing, automated compliance monitoring without requiring custom scripts or event-driven remediation.

Answer

Periodically run a script to list all buckets and check logging configuration.

Answer

Enable S3 event notifications on the bucket creation event and trigger a Lambda function.

Answer

Use CloudWatch Events to detect CreateBucket API calls and trigger a Lambda function.

Question 8

A company stores video files in Amazon S3. The files are accessed frequently for the first week, then weekly for the next month, and then rarely after that. The files must be retained for 5 years and any access must be served within minutes. The SysOps administrator needs to minimize storage costs while meeting these requirements. Which lifecycle policy configuration is the most cost-effective?

Accepted Answer

Transition to S3 Standard-IA after 7 days, then to S3 Glacier Instant Retrieval after 30 days.. It transitions to S3 Standard-IA after 7 days (matching the frequent first-week access), then to S3 Glacier Instant Retrieval after 30 days (matching the weekly access for the next month). Glacier Instant Retrieval provides millisecond retrieval for rarely accessed data, meeting the 'within minutes' requirement while minimizing costs compared to Standard-IA or Intelligent-Tiering.

Answer

Transition to S3 Standard-IA after 7 days, then to S3 Glacier Flexible Retrieval after 30 days.

Answer

Transition to S3 One Zone-IA after 7 days, then to S3 Glacier Deep Archive after 30 days.

Answer

Transition to S3 Intelligent-Tiering after 7 days.

Question 9

A company uses an Amazon DynamoDB table with on-demand capacity mode for a variable workload. The SysOps administrator notices high costs and wants to reduce them without affecting application performance. Which action should the administrator take?

Accepted Answer

Switch the table to provisioned capacity mode with auto scaling.. Switching from on-demand to provisioned capacity with auto scaling reduces costs for variable workloads by allowing you to set a lower base capacity and scale only when needed, avoiding the premium per-request pricing of on-demand mode. Auto scaling adjusts read/write capacity based on actual utilization, ensuring application performance is maintained while eliminating the cost overhead of paying for every request at on-demand rates.

Answer

Enable DynamoDB Accelerator (DAX) for caching.

Answer

Implement DynamoDB Global Tables to distribute data across regions.

Answer

Set a Time to Live (TTL) attribute to automatically expire old items.

Question 10

A SysOps administrator is troubleshooting an IAM policy that is not granting the expected permissions. The policy has a Deny effect on a specific action, but the user is still able to perform that action. What is the most likely reason?

Accepted Answer

The Deny statement includes a condition that is not met by the request. An explicit Deny in IAM only takes effect when the condition attached to that Deny statement evaluates to true for the request. If the Deny statement includes a condition (such as a specific IP range, MFA requirement, or time window) that the current request does not satisfy, the Deny does not apply, and an Allow from another policy can grant access. This is the most likely reason a user can still perform the action despite a Deny statement existing.

Answer

The Deny statement is listed after an Allow statement in the policy

Answer

IAM policies do not support deny statements with conditions

Answer

The user has an attached AWS managed policy that allows the action

Question 11

A company needs to resolve DNS names for on-premises servers from AWS. They have set up a DHCP options set with the on-premises DNS server IP. Which additional step is required?

Accepted Answer

Configure Route 53 Resolver outbound endpoint to forward queries to on-premises DNS.. The DHCP options set configures VPC resources to use the on-premises DNS server IP. However, to actually forward DNS queries from the VPC to the on-premises DNS server for resolution of on-premises hostnames, you need a Route 53 Resolver outbound endpoint. This endpoint provides a forwarding path from the VPC to the on-premises network (over VPN or Direct Connect). Option D (inbound endpoint) is used for the reverse direction—allowing on-premises DNS to forward queries to AWS for resolving private hosted zones—and is not required here. Options A and C are incorrect because VPC peering does not enable DNS resolution to on-premises networks; dedicated connectivity and DNS forwarding via Route 53 Resolver are needed.

Answer

Create a VPC peering connection and use the on-premises DNS IP as the DHCP option set.

Answer

Create a VPC peering connection to the on-premises network.

Answer

Configure Route 53 Resolver inbound endpoint to forward DNS queries from on-premises to AWS.

Question 12

A SysOps administrator is troubleshooting an issue where an Amazon EC2 instance running Amazon Linux 2 is not sending logs to CloudWatch Logs. The CloudWatch agent is installed and configured. Which step should the administrator take FIRST to diagnose the issue?

Accepted Answer

Check the CloudWatch agent status and review its log files on the instance.. The CloudWatch agent is already installed and configured, so the first step is to check its operational status and review its own log files (typically in /var/log/aws/amazon-cloudwatch-agent/). This directly reveals whether the agent is running, encountering configuration errors, or failing to connect to the CloudWatch Logs service endpoint, without making unnecessary changes.

Answer

Reinstall the CloudWatch agent from the AWS Systems Manager.

Answer

Update the IAM role attached to the instance to include CloudWatch Logs permissions.

Answer

Verify the EC2 instance status in the AWS Management Console.

Question 13

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The Security Team requires that all instances have a specific security patch installed. A SysOps administrator needs to verify compliance across all instances. What is the MOST efficient way to accomplish this?

Accepted Answer

Use AWS Systems Manager Patch Manager to scan and generate a compliance report.. AWS Systems Manager Patch Manager can scan instances for missing patches and generate a compliance report showing which instances are compliant or non-compliant with the patch baseline. This directly addresses the requirement to verify compliance across the fleet efficiently. It uses the patch baseline to define approved patches and reports on compliance status.

Answer

Use AWS Config rules to check for the patch.

Answer

Use AWS Systems Manager State Manager to enforce the patch.

Answer

Use AWS Systems Manager Inventory to collect software inventory.

Question 14

A company has an application that writes logs to CloudWatch Logs. The SysOps administrator needs to search for a specific error pattern across multiple log groups. Which solution is the most efficient?

Accepted Answer

Use CloudWatch Logs Insights to query the log groups.. CloudWatch Logs Insights is purpose-built for interactive ad-hoc querying of log data across multiple log groups, enabling efficient pattern matching and filtering without requiring pre-configured infrastructure. It uses a dedicated query language optimized for searching, aggregating, and analyzing log events, making it the most efficient solution for searching a specific error pattern across multiple log groups.

Answer

Create a CloudWatch dashboard to visualize log data.

Answer

Create a metric filter to count the error pattern.

Answer

Create a subscription filter to stream logs to Amazon ES.

Question 15

A SysOps administrator needs to automate the creation of an Amazon RDS for MySQL database instance. The administrator wants to use AWS CloudFormation and ensure that the database password is not stored in plaintext in the template. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to generate a random password and reference it in the CloudFormation template using a dynamic reference (resolve:secretsmanager).. AWS CloudFormation dynamic references with the resolve:secretsmanager syntax retrieve a secret value at stack deployment time directly from AWS Secrets Manager without ever storing it in the template or its parameters. Secrets Manager can generate and rotate the password automatically, and the template only contains a reference such as '{{resolve:secretsmanager:MySecret:SecretString:password}}'. This satisfies the requirement that the password never appears in plaintext in the template.

Answer

Store the password as a CloudFormation parameter with a default value and use the Ref intrinsic function.

Answer

Generate a password manually and store it in a text file in Amazon S3; reference the S3 URL in the template.

Answer

Use AWS Systems Manager Parameter Store (String type) and reference it with the dynamic reference resolve:ssm.

Question 16

A SysOps administrator is designing a disaster recovery plan for a web application. The application runs on EC2 instances in a single Availability Zone. What is the FIRST step to improve availability?

Accepted Answer

Deploy EC2 instances in at least two Availability Zones.. The application currently runs on EC2 instances in a single Availability Zone, which creates a single point of failure. The first step to improve availability is to eliminate this zone-level failure by deploying EC2 instances in at least two Availability Zones, as this provides fault isolation against an AZ outage. This foundational change directly addresses the root cause of the availability risk before adding other components like load balancers or database replication.

Answer

Use an Application Load Balancer to distribute traffic.

Answer

Enable Multi-AZ for the RDS database.

Answer

Create an Amazon CloudFront distribution for the application.

Question 17

A company wants to deploy a new version of a web application to an Auto Scaling group of EC2 instances behind an Application Load Balancer. The deployment should be automated and must not cause downtime. Which AWS service should be used?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is designed to automate deployments to EC2 instances, including those in an Auto Scaling group, and supports blue/green deployments to avoid downtime. It integrates with ALB to shift traffic gradually. This makes it the correct choice for automated, zero-downtime deployments.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 18

A company uses AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket. The stack creation fails because the S3 bucket name already exists. What should the administrator do to resolve this issue?

Accepted Answer

Change the S3 bucket name in the CloudFormation template to a unique name.. S3 bucket names are globally unique across all AWS accounts and regions, so CloudFormation cannot create a bucket whose name is already taken by another account. The correct fix is to change the BucketName property in the template to a name that is not in use, then re-run the stack. This resolves the naming collision without touching resources owned by other accounts.

Answer

Add a tag to the existing bucket to make it available for the stack.

Answer

Delete the existing S3 bucket and recreate the stack.

Answer

Update the bucket policy to allow the stack to use the bucket.

Question 19

A company requires that all AWS account activity be recorded and the logs be stored in a centralized S3 bucket for analysis. Which two AWS services should be used together to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon S3. AWS CloudTrail and Amazon S3. CloudTrail records all AWS account activity as API call events, and it can be configured with a trail that delivers those event logs to a centralized S3 bucket for storage and later analysis. The other options do not fit: GuardDuty is a threat-detection service that generates findings rather than recording all account activity, AWS Config tracks resource configuration changes and compliance rather than full API activity, Amazon Inspector assesses vulnerabilities on workloads, and VPC Flow Logs capture IP traffic metadata for network interfaces, not AWS account API activity.

Answer

Amazon GuardDuty and Amazon S3

Answer

AWS Config and Amazon S3

Answer

Amazon Inspector and Amazon S3

Answer

VPC Flow Logs and Amazon S3

Question 20

A company wants to allow an external auditor to assume an IAM role in their AWS account to review resources. What is the minimum information the auditor needs from the company to do this?

Accepted Answer

The Amazon Resource Name (ARN) of the IAM role to assume.. To assume an IAM role, the auditor must know the role's ARN, which uniquely identifies the role (including the account ID and role name). The auditor then calls sts:AssumeRole with that ARN. The role's trust policy must also allow the auditor's AWS account or principal to assume it, but the ARN is the minimum information the auditor needs to initiate the call.

Answer

The IAM user name and password of the company's admin user.

Answer

The IAM policy document that grants the auditor access.

Answer

The AWS account ID and the region where resources are hosted.