SOA-C02 Practice Exam 58 — 20 Questions

Question 1

A company hosts a critical web application on EC2 instances behind an Application Load Balancer. The security team enabled AWS WAF on the ALB to block SQL injection and XSS attacks. They also use AWS Shield Advanced for DDoS protection. Recently, the application experienced intermittent performance degradation during normal traffic patterns. The security team reviewed the WAF logs and found that legitimate user requests with query strings containing the word "select" (e.g., ?category=select+option) were being blocked. The team wants to ensure that only actual SQL injection attempts are blocked, not legitimate requests with similar patterns. What course of action should the SysOps administrator take to resolve this issue while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom WAF rule that inspects specific query string parameters with a more precise regex pattern to reduce false positives.. The issue is that the AWS WAF SQL injection rule is triggering false positives on legitimate query strings containing the word 'select' (e.g., '?category=select+option'). The best course of action is to create a custom WAF rule that inspects specific query string parameters with a more precise regex pattern, allowing legitimate patterns while still blocking actual SQL injection attempts. This maintains security by targeting the actual attack vectors rather than disabling protection entirely.

Answer

Disable the SQL injection rule in AWS WAF and rely solely on AWS Shield Advanced for protection.

Answer

Enable AWS Shield Advanced's automatic mitigation feature to handle all layer 7 attacks.

Answer

Replace the WAF SQL injection rule with a rate-based rule to limit request rates from specific IPs.

Question 2

A SysOps administrator manages IAM roles for Amazon EC2 instances. The administrator needs to identify permissions that have never been used in the last 90 days to right-size the policies. Which AWS feature should be used to achieve this?

Accepted Answer

IAM Access Analyzer unused access analysis. IAM Access Analyzer unused access analysis is the correct AWS feature because it specifically analyzes IAM roles and policies to identify permissions that have not been used within a specified time frame (e.g., 90 days). It provides a report of unused actions, allowing the administrator to right-size policies by removing unnecessary permissions. This directly addresses the requirement to identify unused permissions for EC2 instance roles.

Answer

AWS CloudTrail Insights

Answer

IAM policy simulator

Answer

AWS Config managed rules

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences unpredictable traffic spikes. Which AWS service should be used to automatically adjust the number of EC2 instances based on demand, optimizing cost and performance?

Accepted Answer

AWS Auto Scaling. AWS Auto Scaling is the correct service because it automatically adjusts the number of EC2 instances in response to demand, using scaling policies based on metrics like CPU utilization or request count. This ensures that the application can handle traffic spikes without manual intervention, optimizing both cost (by scaling down during low demand) and performance (by scaling up during spikes). The service integrates directly with the Application Load Balancer to register and deregister instances as needed.

Answer

Amazon CloudWatch

Answer

Elastic Load Balancing

Answer

AWS Lambda

Question 4

A SysOps administrator needs to restrict access to an Amazon S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy statement should be added to the bucket policy?

Accepted Answer

Condition: { StringEquals: { 'aws:SourceVpce': 'vpce-12345' } }. The condition key 'aws:SourceVpce' is used to restrict access to requests originating from a specific VPC endpoint (identified by its endpoint ID). Option A uses 'aws:SourceVpc', which restricts to an entire VPC, not a specific endpoint. Option B uses 'ec2:Vpc', which is not a valid condition key for S3 bucket policies. Option C uses 'aws:VpcSourceIp', which is not a valid condition key; the correct key for IP-based restrictions is 'aws:SourceIp'.

Answer

Condition: { StringEquals: { 'aws:SourceVpc': 'vpc-12345' } }

Answer

Condition: { StringEquals: { 'ec2:Vpc': 'vpc-12345' } }

Answer

Condition: { IpAddress: { 'aws:VpcSourceIp': '10.0.0.0/16' } }

Question 5

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application needs to serve HTTPS content. The SysOps administrator wants to offload SSL termination to the ALB and automatically renew the certificate before expiration. Which solution should the administrator implement?

Accepted Answer

Use AWS Certificate Manager (ACM) to request a public certificate and associate it with the ALB.. AWS Certificate Manager (ACM) integrates natively with Application Load Balancers to handle SSL/TLS termination. ACM can automatically renew public certificates issued by Amazon's trusted certificate authority, eliminating the need for manual renewal. By associating the ACM certificate with the ALB's HTTPS listener, the administrator offloads SSL termination and ensures automatic certificate renewal before expiration.

Answer

Upload a third-party certificate to IAM and associate it with the ALB.

Answer

Store the certificate in Amazon S3 and configure the ALB to read from S3.

Answer

Use a self-signed certificate on each EC2 instance and configure the ALB for TCP passthrough.

Question 6

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. Users report intermittent 503 errors. The SysOps Administrator checks the ALB metrics and sees that the Sum of HTTP 503s correlates with spikes in CPU utilization on the EC2 instances. What is the MOST likely cause and solution?

Accepted Answer

Configure the Auto Scaling group to scale out based on average CPU utilization and ensure sufficient capacity.. The most likely cause is that the EC2 instances are overwhelmed due to insufficient capacity, leading to 503 errors from the ALB. Configuring the Auto Scaling group to scale out based on average CPU utilization (B) ensures that additional instances are added when CPU spikes, providing sufficient capacity to handle the load and reducing 503 errors.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay on the ALB target group to allow in-flight requests to complete.

Answer

Decrease the health check interval to detect unhealthy instances faster.

Question 7

A company hosts a static website on Amazon S3 with public read access. The website content is updated weekly. The SysOps administrator notices that the monthly S3 costs are higher than expected. The website receives about 10,000 requests per day, and each object is small (average 50 KB). The administrator wants to reduce costs without affecting the user experience. The website does not require HTTPS or custom domain at this time. Which action should the administrator take?

Accepted Answer

Place an Amazon CloudFront distribution in front of the S3 bucket.. Placing an Amazon CloudFront distribution in front of the S3 bucket reduces costs by caching content at edge locations, thereby reducing the number of GET requests to S3 and leveraging lower CloudFront data transfer rates. This does not affect user experience because cached content is served quickly. Option A is incorrect: enabling default encryption adds encryption but does not reduce costs; it may increase overhead slightly. Option B is incorrect: S3 Glacier Flexible Retrieval is designed for archival storage with high retrieval latency and costs, making it unsuitable for serving a static website. Option D is incorrect: enabling S3 Versioning increases storage costs by retaining multiple versions of objects, which does not lower expenses.

Answer

Enable default encryption for the S3 bucket.

Answer

Transition the objects to S3 Glacier Flexible Retrieval.

Answer

Enable S3 Versioning to prevent accidental deletions.

Question 8

A SysOps administrator is troubleshooting a CodeDeploy deployment that uploads artifacts to an S3 bucket. The deployment fails with an 'AccessDenied' error. The IAM policy for the CodeDeploy service role includes the statement shown in the exhibit. What is the most likely cause of the failure?

Accepted Answer

The upload does not set the ACL to 'bucket-owner-full-control'.. The policy includes a condition that requires the object's ACL to be set to 'bucket-owner-full-control'. If the upload does not specify this ACL in the request, the condition is not met, and the request fails with AccessDenied. Therefore, option A is correct. Option B is incorrect because the resource ARN does include the bucket (the policy grants access to objects within the bucket). Option C is incorrect because the policy does not mention encryption headers; the condition is about ACL. Option D is incorrect because the s3:PutObject action is allowed by the policy; the failure is due to the condition on ACL.

Answer

The resource ARN does not include the bucket itself.

Answer

The policy does not allow encryption headers.

Answer

The policy does not allow the s3:PutObject action.

Question 9

A company is using AWS CloudFormation to manage infrastructure. They have a stack that creates an EC2 instance and an Elastic IP. The instance is in a VPC with an internet gateway. The stack creation succeeds, but the instance does not have internet connectivity. What is the most likely cause?

Accepted Answer

The subnet's route table does not have a route to the internet gateway.. For an EC2 instance in a VPC to reach the internet, three things are required: a public IP (or Elastic IP), an internet gateway attached to the VPC, and a route in the subnet's route table pointing 0.0.0.0/0 to that IGW. The question states the instance has an Elastic IP and the VPC has an IGW, so the missing piece is the route table entry. Without a 0.0.0.0/0 route to igw-xxxx, traffic from the instance has no path off the subnet regardless of the EIP.

Answer

The instance does not have a public IP address.

Answer

The instance is in a private subnet.

Answer

The security group does not allow outbound traffic.

Question 10

A company uses Amazon S3 to store log files. The logs are accessed frequently for the first 30 days, then rarely accessed after that. The company must retain logs for 7 years for compliance. What is the MOST cost-effective storage solution?

Accepted Answer

Use S3 Standard for 30 days and then transition to S3 Glacier Deep Archive.. S3 Lifecycle policies can transition objects from S3 Standard to S3 Glacier Deep Archive after 30 days, minimizing costs while meeting compliance. S3 Glacier Flexible Retrieval is more expensive than Deep Archive for long-term archival. S3 Intelligent-Tiering adds monitoring costs. S3 One Zone-IA is not suitable for long-term archival due to lower durability.

Answer

Use S3 Standard for 7 years.

Answer

Use S3 One Zone-IA for 30 days and then transition to S3 Glacier Flexible Retrieval.

Answer

Use S3 Intelligent-Tiering for the entire 7 years.

Question 11

A company uses Amazon CloudWatch to monitor its Amazon EC2 instances. The SysOps administrator wants to receive an email notification when any EC2 instance's CPUUtilization metric exceeds 90% for 5 consecutive minutes. Which combination of services should be used to meet this requirement with the least operational overhead?

Accepted Answer

Create a CloudWatch metric alarm that sends a notification to an Amazon SNS topic subscribed with email endpoints. It directly uses a CloudWatch metric alarm configured to trigger when CPUUtilization exceeds 90% for 5 consecutive minutes, which then publishes to an Amazon SNS topic with email endpoints. This combination requires no custom code, no Lambda functions, and no additional services, minimizing operational overhead while meeting the requirement precisely.

Answer

Create a CloudWatch Logs metric filter and a Lambda function that sends email via SES

Answer

Create a CloudWatch Events rule that matches EC2 instance state changes and sends to SQS with a Lambda consumer

Answer

Configure a CloudWatch dashboard that displays CPU utilization and share it with the team

Question 12

A DevOps engineer is troubleshooting a failed CloudFormation stack update. The stack includes an Auto Scaling group with a launch template. The update changed the AMI ID in the launch template, but the new instances launched with the old AMI. What is the most likely cause?

Accepted Answer

The launch template version is not set to use the latest version.. When a CloudFormation stack references a launch template by ID without pinning a version, the Auto Scaling group uses the template's default version. Updating the AMI in a new launch template version does not change the default version automatically, so the ASG continues launching instances from the old default version. The fix is to either set the new version as default or explicitly reference the version in the ASG's LaunchTemplate specification.

Answer

The Auto Scaling group is not configured to perform a rolling update.

Answer

The new AMI ID is invalid or not available in the region.

Answer

The CloudFormation stack update did not successfully complete.

Question 13

A company uses AWS Organizations and wants to restrict the use of specific AWS services across all member accounts. Which TWO methods can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Create IAM policies in each account that deny the service actions and attach them to all IAM users and roles.. IAM policies in each account can deny actions for specific services, and when attached to all IAM users and roles, they effectively restrict usage across the account, though this requires consistent application. Option D is correct because SCPs attached to the root organizational unit can deny access to specified services across all member accounts in the organization. Option B is incorrect because AWS Config rules can detect non-compliance but cannot enforce restrictions or disable services. Option C is incorrect because AWS Service Catalog is used to create and manage a catalog of approved services, not to block disallowed services. Option E is incorrect because VPC endpoints control network traffic to services, not service-level restrictions.

Answer

Use AWS Config rules to automatically disable non-compliant services.

Answer

Use AWS Service Catalog to block the use of disallowed services.

Answer

Configure VPC endpoints to block traffic to the disallowed services.

Question 14

An organization has a CloudWatch dashboard that displays metrics for multiple AWS services. The dashboard is shared with the operations team. Recently, some team members reported that the dashboard is not loading for them. Which action should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Confirm that the team members have the necessary IAM permissions for cloudwatch:GetDashboard.. The most likely cause of the dashboard not loading is that the team members lack the required IAM permission to retrieve the dashboard definition. CloudWatch dashboards are stored as JSON objects, and the `cloudwatch:GetDashboard` action is necessary to fetch and render that data in the console. Without this permission, the API call fails silently, resulting in a blank or non-loading dashboard.

Answer

Verify that the team members have subscribed to the metric streams.

Answer

Ensure the CloudWatch agent is installed on the instances displaying the dashboard.

Answer

Check that the dashboard is in the same region as the resources.

Question 15

A company uses Amazon CloudWatch Logs to store application logs from EC2 instances. The log volume is 100 GB per day, and logs are retained for 1 year. The SysOps administrator wants to reduce costs while maintaining compliance. Which solution is MOST effective?

Accepted Answer

Export logs to Amazon S3 and configure a lifecycle policy to transition them to Glacier Deep Archive after 30 days.. Exporting logs to Amazon S3 and transitioning them to Glacier Deep Archive after 30 days is the most cost-effective compliant solution because CloudWatch Logs storage is significantly more expensive per GB than S3, and Glacier Deep Archive costs roughly $0.00099/GB-month versus CloudWatch Logs at ~$0.03/GB-month. This preserves the 1-year retention requirement while cutting storage costs by over 90%.

Answer

Reduce the log retention period to 30 days.

Answer

Disable server-side encryption for the log group to reduce overhead.

Answer

Use CloudWatch Logs Insights to query logs instead of storing them.

Question 16

A company's security policy requires that all IAM users must have multi-factor authentication (MFA) enabled. A SysOps administrator needs to automatically detect IAM users without MFA and generate a compliance report. Which AWS service should be used to meet this requirement with minimal operational overhead?

Accepted Answer

AWS Config. AWS Config provides managed rules such as `iam-user-mfa-enabled` that can continuously evaluate IAM users against the requirement for MFA. When a user is found without MFA, AWS Config can trigger an automatic remediation action or generate a compliance report via its dashboard or Amazon SNS notifications, meeting the detection and reporting need with minimal operational overhead.

Answer

AWS CloudTrail

Answer

IAM Access Analyzer

Answer

AWS Trusted Advisor

Question 17

A company's security policy requires that all Amazon S3 buckets must be encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?

Accepted Answer

AWS Config and AWS Lambda. AWS Config can evaluate S3 bucket configurations against a managed rule (s3-bucket-server-side-encryption-enabled) to detect non-compliant buckets. When a non-compliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule or a custom remediation action to automatically enable SSE-S3 encryption on the bucket. This combination uses managed services and minimizes custom code, meeting the security policy requirement.

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon Macie and AWS Step Functions

Question 18

An organization has a policy requiring that all Amazon EC2 instances launched in the production account must have detailed monitoring enabled for Amazon CloudWatch. A SysOps administrator needs to enforce this rule automatically. Which solution will ensure that any EC2 instance launched without detailed monitoring is automatically remediated?

Accepted Answer

Use AWS Config with the managed rule 'ec2-instance-detailed-monitoring-enabled' and configure an automatic remediation action using AWS Systems Manager Automation to enable detailed monitoring on non-compliant instances.. AWS Config with the managed rule 'ec2-instance-detailed-monitoring-enabled' continuously evaluates EC2 instances against the policy. When an instance is non-compliant (i.e., launched without detailed monitoring), the automatic remediation action uses an AWS Systems Manager Automation document to enable detailed monitoring on that instance, ensuring enforcement without manual intervention.

Answer

Use AWS Trusted Advisor to check for instances without detailed monitoring and send a notification to the administrator via email.

Answer

Use an Amazon CloudWatch Events rule to detect RunInstances API calls and trigger a Lambda function that enables detailed monitoring on newly launched instances.

Answer

Use an IAM policy that denies the ec2:RunInstances action unless the user specifies the parameter to enable detailed monitoring.

Question 19

A company has a production AWS account with a single VPC and multiple subnets across two Availability Zones. The company hosts a web application on EC2 instances in an Auto Scaling group. The application uses an Amazon Aurora MySQL database cluster with one writer and two reader instances in the same VPC. The SysOps administrator configured AWS CloudTrail to log API calls and Amazon CloudWatch alarms for operational monitoring. After a recent network partition event in one Availability Zone, the application became unavailable for several minutes. The administrator wants to improve the application's resilience to such events without changing the database cluster configuration. The administrator has budget for additional resources but wants to minimize costs. What should the administrator do?

Accepted Answer

Ensure the Auto Scaling group launches instances in both Availability Zones. Configure the Application Load Balancer to be cross-zone load balancing enabled.. Distributing EC2 instances across both Availability Zones and enabling cross-zone load balancing on the ALB ensures that traffic is routed to healthy instances in any AZ, providing high availability for the application tier during an AZ failure without changing the database cluster. Option A is incorrect because Multi-AZ for Aurora is already inherent; increasing instance size does not improve resilience. Option B is incorrect because a cross-region read replica does not help with within-region AZ failures and adds cost and complexity. Option C is incorrect because creating a second VPC in another region with a separate cluster is expensive and unnecessary for an AZ-level failure.

Answer

Enable Multi-AZ for the Aurora cluster, which is already enabled by default. Additionally, increase the instance size of the writer instance.

Answer

Configure a cross-region read replica for the Aurora cluster and promote it to primary if the primary AZ fails.

Answer

Create a second VPC in a different AWS Region and set up a second Aurora cluster. Use Route 53 with failover routing to direct traffic to the secondary region if the primary fails.

Question 20

Which THREE components are required to set up a site-to-site VPN connection between a VPC and an on-premises network? (Choose three.)

Accepted Answer

Virtual private gateway or transit gateway. A virtual private gateway or transit gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network. It provides the target for the VPN connection and must be attached to the VPC to enable site-to-site VPN functionality.

Answer

NAT Gateway

Answer

Internet gateway