SOA-C02 Practice Exam 57 — 20 Questions

Question 1

A SysOps admin notices that an EC2 instance's status check fails intermittently. The instance is part of an Auto Scaling group. What is the most appropriate first step to diagnose the issue?

Accepted Answer

Review the instance's status check history in the EC2 console. The most appropriate first step is to review the instance's status check history in the EC2 console (Option D). This allows the SysOps admin to determine whether the failures are due to system status checks (e.g., underlying hardware issues) or instance status checks (e.g., OS-level problems). Since the instance is part of an Auto Scaling group, understanding the root cause is critical before taking any corrective action, as premature termination or reboot could mask the issue or lead to unnecessary replacements.

Answer

Stop and start the instance

Answer

Terminate the instance and let Auto Scaling replace it

Answer

Reboot the instance

Question 2

A company uses Amazon CloudWatch to monitor its AWS resources. The company wants to receive alerts when CPU utilization of an EC2 instance exceeds 80% for 5 consecutive minutes. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a threshold of 80% for 5 consecutive periods.. A CloudWatch alarm on the CPUUtilization metric with a threshold of 80% for 5 consecutive periods (each period being 1 minute) directly monitors the metric and triggers an alert when the condition is met. This is the most efficient and native way to achieve the requirement, as it requires no custom code or log parsing.

Answer

Use CloudWatch Logs to parse CPU utilization from system logs and trigger an alert.

Answer

Use Amazon EventBridge to schedule a Lambda function that checks CPU utilization.

Answer

Use AWS CloudTrail to monitor EC2 instance metrics.

Question 3

Refer to the exhibit. A SysOps administrator runs the AWS CLI command to check the event selectors for a CloudTrail trail. What does the output indicate?

Accepted Answer

The trail logs all management events.. The exhibit shows the output of the AWS CLI command to describe event selectors for a CloudTrail trail. The output indicates that the trail is configured to log all management events, as specified by the 'IncludeManagementEvents' field set to true and no data event selectors defined. Therefore, the trail logs all management events.

Answer

The trail logs both management and data events.

Answer

The trail logs all data events.

Answer

The trail logs only write management events.

Question 4

A SysOps administrator is reviewing the reliability of a production system that uses Amazon DynamoDB as its primary data store. The table has on-demand capacity and a single partition key. The application experiences occasional throttling errors during peak hours. Which action would most effectively improve reliability?

Accepted Answer

Review and optimize the partition key design to avoid hot partitions.. Throttling errors in DynamoDB with a single partition key are most often caused by uneven access patterns creating hot partitions. Optimizing the partition key design (e.g., using a composite key or adding a suffix to distribute writes) directly addresses the root cause by ensuring requests are spread evenly across partitions, which on-demand capacity alone cannot fix. This improves reliability by preventing throttling at the partition level, regardless of the table's total capacity.

Answer

Switch to provisioned capacity and set high read/write units.

Answer

Enable auto-scaling and increase the maximum capacity.

Answer

Enable DynamoDB Accelerator (DAX) to reduce read latency.

Question 5

A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (A) is correct because it records every API call that modifies IAM resources (CreateUser, AttachRolePolicy, PutRolePolicy, etc.) as management events, providing the raw audit trail of who did what and when. AWS Config (C) is correct because it continuously records IAM resource configurations and their change history, letting you see the before/after state of users, roles, and policies and evaluate them against rules. Amazon CloudWatch Logs (E) is correct because CloudTrail can deliver its event logs to a CloudWatch Logs log group, where you can retain, search, and set metric filters/alarms on IAM change events. Amazon GuardDuty (B) is a threat-detection service that analyzes logs for malicious behavior, not a change-auditing mechanism, and AWS Trusted Advisor (D) provides best-practice checks and recommendations rather than a record of IAM changes.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 6

A company is using Amazon CloudFront with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible via CloudFront. The SysOps administrator has configured an Origin Access Identity (OAI) and updated the bucket policy to allow access only to the OAI. However, users are still able to access the S3 bucket directly via the S3 URL. What is the most likely reason?

Accepted Answer

The bucket policy allows public read access in addition to the OAI access.. The most likely reason users can still access the S3 bucket directly is that the bucket policy contains a statement granting public read access (e.g., 'Principal': '*') in addition to the OAI allow statement. Even with OAI configured, an explicit public allow overrides the restriction. The bucket policy must be reviewed to remove any public access grants.

Answer

The bucket policy does not include a condition to require the OAI.

Answer

The OAI is not properly associated with the CloudFront distribution.

Answer

The S3 bucket is configured as a static website.

Question 7

A company is using AWS CloudFormation to manage infrastructure. A recent stack update failed, and the SysOps administrator needs to roll back to the previous known good state. However, the stack is in UPDATE_ROLLBACK_FAILED state. What should the administrator do to recover the stack?

Accepted Answer

Use the ContinueUpdateRollback API or AWS Management Console to resume the rollback after addressing the failure cause. When a CloudFormation stack enters UPDATE_ROLLBACK_FAILED, the rollback could not complete because a resource could not be returned to its previous state. The administrator must first fix the underlying resource issue (e.g., a deleted resource, a permission problem, or a resource that cannot be reverted), then invoke ContinueUpdateRollback via the console, CLI, or API to resume the rollback from where it stopped. This preserves the stack and its resources rather than destroying them.

Answer

Delete the stack and recreate it from the previous template

Answer

Contact AWS Support to enable automatic rollback recovery

Answer

Execute another stack update with the same parameters to overwrite the failed state

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must use MFA. They create an SCP that denies all actions if the IAM user does not have MFA. However, the SCP does not apply to the root user. The SysOps administrator finds that some IAM users in member accounts are still able to access the console without MFA. What is the most likely reason?

Accepted Answer

The SCP is applied to an OU that does not contain the affected accounts.. SCPs are inherited down the OU tree, but they only apply to accounts within the OU they are attached to. If the SCP is attached to an OU that does not contain the affected member accounts, those accounts are unaffected and their IAM users can still sign in without MFA.

Answer

The IAM user has a resource-based policy that allows access.

Answer

The SCP only applies to the root user, not IAM users.

Answer

The SCP is not inherited by child OUs.

Question 9

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack creation. The stack includes an AWS::Lambda::Function resource that depends on an AWS::IAM::Role. The error message is 'Resource handler returned message: "The role defined for the function cannot be assumed by Lambda" (Service: Lambda, Status Code: 400).' What is the most likely cause?

Accepted Answer

The trust policy of the IAM role does not include 'lambda.amazonaws.com' as a trusted entity. The error 'The role defined for the function cannot be assumed by Lambda' specifically indicates that the IAM role's trust policy (assume role policy document) does not list lambda.amazonaws.com as a trusted principal. When Lambda attempts to assume the execution role during function creation, the STS AssumeRole call fails because the trust relationship is missing or misconfigured. The fix is to update the role's trust policy to include the Lambda service principal.

Answer

The Lambda function name conflicts with an existing function

Answer

The IAM role does not have sufficient permissions to execute the Lambda function

Answer

The Lambda function has a resource-based policy that denies access

Question 10

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance with Multi-AZ enabled. During a stack update, the database engine version is changed. The update fails with a rollback. What is the most likely cause?

Accepted Answer

The engine version upgrade is not supported for Multi-AZ deployments.. Changing the database engine version on a Multi-AZ RDS instance is not supported directly through a CloudFormation stack update without additional steps. Multi-AZ deployments require both primary and standby instances to be upgraded, and if the new engine version is not compatible or the upgrade path is not supported, the update fails and triggers a rollback. Option B is incorrect because instance class availability is not the primary issue; the error relates to the engine version change, not the instance class. Option C is incorrect because storage type compatibility is not the relevant factor; the storage type remains unchanged. Option D is incorrect because the DB subnet group is not involved in engine version upgrades, and IP address availability is not a typical cause for this failure.

Answer

The DB instance class is not available for the new engine version.

Answer

The storage type is not compatible with the new engine version.

Answer

The DB subnet group does not have enough IP addresses.

Question 11

A company uses AWS CloudTrail to log API calls across all regions. The SysOps administrator notices that logs for a specific region are missing from the centralized S3 bucket. What is the most likely cause?

Accepted Answer

The CloudTrail trail is not enabled for that region.. CloudTrail trails can be configured to log API calls from specific regions or all regions. If logs for a particular region are missing from the centralized S3 bucket, the most likely cause is that the trail was not enabled for that region during trail creation or update. By default, a trail applied to all regions will automatically log activity from every region, but if the trail is configured for a single region or a subset, other regions will not have their logs delivered.

Answer

The S3 bucket policy denies write access from CloudTrail for that region.

Answer

CloudTrail log file validation is disabled.

Answer

The IAM role for CloudTrail does not have permissions to write logs from that region.

Question 12

A SysOps administrator notices that an EC2 instance running a web server is receiving unexpected traffic from an IP address that is known to be malicious. The administrator wants to block this IP address at the instance level. Which solution should be used?

Accepted Answer

Install a third-party firewall on the instance.. A host-based firewall (such as a third-party firewall installed on the instance) can block traffic from a specific IP address at the instance level. Option A is incorrect because network ACLs operate at the subnet level, not the instance level. Option B is incorrect because AWS WAF is designed to filter web requests at the application layer and is typically associated with load balancers or CloudFront, not directly with an individual EC2 instance. Option D is incorrect because security groups do not support deny rules; they only allow traffic, so they cannot be used to block specific IPs.

Answer

Modify the network ACL to deny traffic from that IP.

Answer

Use AWS WAF to block the IP address.

Answer

Update the security group to deny traffic from that IP.

Question 13

Refer to the exhibit. A SysOps administrator runs the AWS CLI command shown. The output shows that the CPUUtilization average over the period is 75%. However, the administrator knows that the instance was idle for the first 15 minutes of the hour. Which explanation best describes why the average might be misleading?

Accepted Answer

The average statistic over a period of 300 seconds can smooth out spikes, and the overall average of 75% may be due to a high spike after the idle period.. The average statistic over a 300-second period can smooth out brief but intense spikes in CPU utilization. In this scenario, the instance was idle for the first 15 minutes, so the average of 75% over the entire hour must be driven by a very high CPU spike later in the period. The period of 300 seconds aggregates data into 5-minute intervals, which can mask the idle period and make the overall average misleading.

Answer

The period is too long; a shorter period like 60 seconds would show more granular data.

Answer

The command should include --unit Percent to get accurate data.

Answer

The --statistics parameter should be set to 'Sum' to capture total usage.

Question 14

A company is using Amazon Route 53 as its DNS service. The SysOps team needs to route traffic to multiple resources based on the geographic location of the users. Which TWO routing policies can achieve this? (Select TWO.)

Accepted Answer

Geoproximity routing. The question asks for two routing policies that route traffic based on geographic location. Geoproximity routing (Option A) and Geolocation routing (Option E) are the correct choices. Geoproximity routing considers both geographic location and optional bias, while Geolocation routing uses strict geographic boundaries. Latency-based routing (Option D) routes based on network latency, not geography, even if latency often correlates with distance. Simple routing (Option B) and Failover routing (Option C) do not use geographic information at all.

Answer

Simple routing

Answer

Failover routing

Answer

Latency-based routing

Question 15

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A site-to-site VPN between on-premises and AWS requires a virtual private gateway (A), which is the AWS-side VPN concentrator attached to the VPC and terminating the IPSec tunnels; a customer gateway (D), which is the AWS resource representing the on-premises VPN device (its public IP and BGP ASN) that terminates the other end of the tunnels; and a VPN connection (C), which is the actual IPSec tunnel resource linking the virtual private gateway to the customer gateway and carrying traffic between the two networks. An internet gateway (B) is not required for this design because it provides internet access for public subnets, not the encrypted VPN termination, and a Direct Connect virtual interface (E) belongs to AWS Direct Connect private/public transit VIFs, which are a separate dedicated-connection service rather than an IPSec site-to-site VPN component.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 16

A company is using Amazon CloudFront to distribute content globally. They want to restrict access to their content so that only users from specific countries can access it. Which TWO actions can be taken to achieve this?

Accepted Answer

Configure CloudFront geo restriction (whitelist or blacklist) at the distribution level.. CloudFront geo restriction allows you to whitelist or blacklist countries at the distribution level, directly controlling access based on the geographic location of the viewer's IP address. This is a native CloudFront feature that does not require additional services, making it a straightforward solution for country-based access control.

Answer

Configure an S3 bucket policy with a condition for aws:SourceIp.

Answer

Use IAM policies to restrict access based on the user's location.

Answer

Set up an Application Load Balancer rule to deny traffic from certain IP ranges.

Question 17

A company uses AWS CloudFormation to deploy a web application. The template currently hard-codes the EC2 instance type (e.g., t3.medium). The SysOps administrator wants to make the instance type configurable so that different environments (dev, test, prod) can use different instance types without modifying the template each time. Which CloudFormation feature enables this?

Accepted Answer

Parameters. CloudFormation Parameters allow you to pass custom values into a template at stack creation or update time. By defining a parameter for the instance type (e.g., with allowed values like t3.micro, t3.medium, t3.large), you can reuse the same template across dev, test, and prod environments without editing the template file itself.

Answer

Mappings

Answer

Conditions

Answer

Outputs

Question 18

A company runs a batch processing application on Amazon EC2 instances that runs every night for 2 hours. The job can be interrupted and resumed without any issue. The SysOps administrator wants to minimize compute costs for this workload. Which EC2 purchasing option should be used?

Accepted Answer

Spot Instances. Spot Instances are the correct choice because the workload is fault-tolerant (can be interrupted and resumed) and runs for only 2 hours nightly. Spot Instances offer significant cost savings (up to 90% off On-Demand) but can be reclaimed by AWS with a 2-minute warning, which is acceptable here since the job can resume without issue. This aligns with the goal of minimizing compute costs for a non-critical, interruptible batch process.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Hosts

Question 19

A SysOps administrator is troubleshooting slow application performance. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Amazon CloudWatch metrics show that the average CPU utilization across the instances is below 20%, but the application is still slow. What is the MOST likely cause of the performance issue?

Accepted Answer

The application database is under-provisioned and is causing slow query responses.. The most likely cause is that the application database is under-provisioned, leading to slow query responses. Even though EC2 CPU utilization is low, the application performance is bottlenecked by database latency. This is a common scenario where the database tier is the constraint, not the compute tier.

Answer

The Auto Scaling group is scaling too aggressively, causing thrashing.

Answer

The Application Load Balancer has a sticky session configuration that is not distributing traffic evenly.

Answer

The EC2 instances are using burstable performance and have exhausted their CPU credits.

Question 20

A SysOps administrator needs to set up monitoring for an application that runs on an EC2 instance. The application generates custom metrics that should be available for analysis in CloudWatch. Which steps are required to achieve this? (Select TWO.)

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to call PutMetricData.. The EC2 instance must have an IAM role attached with permissions to call PutMetricData, which authorizes the instance to publish custom metrics to CloudWatch. Without this IAM role, any attempt to send metrics from the instance will fail due to missing credentials.

Answer

Create an SNS topic and subscribe the application to send metrics.

Answer

Install the CloudWatch Logs agent to send custom metrics.

Answer

Enable detailed monitoring on the EC2 instance to collect custom metrics.