SOA-C02 Practice Exam 59 — 20 Questions

Question 1

A company has two VPCs in the same AWS region. VPC A hosts a web application, and VPC B hosts a database. The SysOps administrator needs to enable private IP communication between the two VPCs without using the public internet. The administrator wants a simple, low-cost solution that uses the AWS network backbone. Which AWS service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Peering. VPC Peering allows direct, private IP connectivity between two VPCs using the AWS network backbone without traversing the public internet. It is the simplest and most cost-effective solution for connecting exactly two VPCs in the same region, as there are no additional hourly charges beyond data transfer costs, and no intermediate devices or bandwidth limitations are introduced.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 2

A SysOps administrator needs to allow a Lambda function to access a DynamoDB table in the same AWS account. Which configuration is required?

Accepted Answer

Assign an IAM role to the Lambda function with DynamoDB permissions.. Lambda functions assume an IAM role (the execution role) that grants permissions to AWS services. To allow a Lambda function to access a DynamoDB table in the same account, you attach an IAM policy to that execution role granting the necessary DynamoDB actions (e.g., GetItem, PutItem) on the table's ARN. This is the standard, required configuration for same-account access.

Answer

Create a VPC endpoint for DynamoDB and attach it to the Lambda function.

Answer

Configure a network ACL to allow traffic from Lambda to DynamoDB.

Answer

Add the Lambda function as a principal in the DynamoDB table's resource-based policy.

Question 3

A company has an Amazon CloudFront distribution with an S3 bucket as origin. The bucket contains sensitive data. Which configuration ensures that users access the content only through CloudFront and not directly via the S3 URL?

Accepted Answer

Configure an Origin Access Identity (OAI) in CloudFront and update the bucket policy. An Origin Access Identity (OAI) is a special CloudFront user that the distribution uses to fetch objects from the S3 bucket. By updating the bucket policy to grant read access only to that OAI and removing public access, direct requests to the S3 URL are denied while CloudFront can still serve the content. This is the standard AWS pattern for locking an S3 origin behind CloudFront.

Answer

Enable S3 server-side encryption

Answer

Use CloudFront signed URLs or signed cookies

Answer

Enable S3 Block Public Access on the bucket

Question 4

A SysOps administrator needs to automate the creation of an Amazon S3 bucket with versioning enabled and default encryption using AWS CloudFormation. Which CloudFormation resource type should the administrator use?

Accepted Answer

AWS::S3::Bucket. AWS::S3::Bucket is the CloudFormation resource type used to create an S3 bucket, and it supports properties such as VersioningConfiguration and BucketEncryption directly within the resource definition. This allows the administrator to enable versioning and default encryption in a single resource declaration.

Answer

AWS::S3::BucketPolicy

Answer

AWS::KMS::Key

Answer

AWS::S3::BucketVersioning

Question 5

An organization wants to automate the creation of AWS resources using AWS CloudFormation. They need to ensure that certain resources, such as an Amazon S3 bucket, are not accidentally deleted when the stack is deleted. Which CloudFormation feature should they use?

Accepted Answer

DeletionPolicy attribute with value 'Retain'. The DeletionPolicy attribute with value 'Retain' instructs AWS CloudFormation to preserve a resource when its stack is deleted. This is the correct feature to prevent accidental deletion of critical resources like an S3 bucket, as the bucket and its contents will remain in the account even after the stack is removed.

Answer

DeletionPolicy attribute with value 'Protect'

Answer

DeletionPolicy attribute with value 'Delete'

Answer

Stack policy

Question 6

A SysOps administrator is deploying a new web application using AWS Elastic Beanstalk. The application requires a high-performance relational database that can scale read capacity. The administrator needs to ensure that the database is highly available and can handle read replicas. The administrator creates an Elastic Beanstalk environment and adds an Amazon RDS DB instance. However, the database is deployed in a single Availability Zone. The administrator wants to modify the environment to use a Multi-AZ deployment for high availability and add read replicas. The administrator has the following options. Which option should the administrator choose?

Accepted Answer

Create a new Multi-AZ RDS DB instance with read replicas outside of Elastic Beanstalk. Update the environment's environment properties to point to the new database. Then delete the old DB instance.. Elastic Beanstalk does not support converting an existing single-AZ RDS instance to Multi-AZ or adding read replicas through environment configuration changes. The supported approach is to create a new Multi-AZ RDS instance (with read replicas) outside of Elastic Beanstalk, then repoint the environment's connection properties to the new database and decommission the old one. This gives the administrator full control over the RDS configuration while keeping the Beanstalk application connected.

Answer

Increase the DB instance class size to improve performance and then create a read replica.

Answer

Create a read replica of the existing DB instance and then modify the environment to use the replica.

Answer

Modify the Elastic Beanstalk environment configuration to enable Multi-AZ for the existing DB instance.

Question 7

The finance team was surprised by a $12,000 spike in EC2 costs last month caused by a runaway Auto Scaling group. They want to receive an email alert within hours whenever any AWS service cost behaves unexpectedly, without manually setting fixed dollar thresholds for each service. Which AWS cost management feature provides this?

Accepted Answer

Enable Cost Anomaly Detection with an AWS services monitor and create an alert subscription to email the finance team when an anomaly is detected. Cost Anomaly Detection uses machine learning to model historical spending patterns for each AWS service and automatically detects unusual spikes without requiring manual thresholds. By creating an AWS services monitor and linking an alert subscription, the finance team receives email notifications within hours when any service deviates from its expected cost behavior, directly addressing the need for service-agnostic, threshold-free alerts.

Answer

Create an AWS Budget with a monthly EC2 cost threshold of $10,000 and an alert at 80 percent of the threshold

Answer

Enable AWS Cost Explorer and review the daily cost breakdown each morning to spot unexpected charges

Answer

Configure CloudWatch Billing alarms with a static threshold for each AWS service individually

Question 8

A SysOps administrator needs to ensure that an EC2 instance can access an S3 bucket without storing AWS credentials on the instance. What should the administrator do?

Accepted Answer

Create an IAM role with S3 access and attach it to the instance profile.. The correct approach is to create an IAM role with the required S3 permissions and attach it to the EC2 instance profile, so the instance's SDK/CLI can retrieve temporary credentials from the instance metadata service (IMDS). This eliminates the need to store long-term AWS credentials on the instance and follows AWS best practices for least privilege and credential hygiene.

Answer

Create a bucket policy that allows access from the instance's public IP.

Answer

Store the access key and secret key in a file on the instance.

Answer

Configure the security group to allow outbound traffic to S3.

Question 9

A company uses AWS CodeBuild to compile code and run unit tests. The build environment requires a specific version of Java that is not available in the default build images. What should the administrator do?

Accepted Answer

Create a custom build image with the required Java version and push it to Amazon ECR.. CodeBuild allows you to specify a custom Docker image for the build environment, which can include any required software such as a specific Java version. By creating a custom image, installing the needed Java version, and pushing it to Amazon ECR, the administrator ensures the build environment meets the exact requirements. This approach is flexible and repeatable, and CodeBuild natively supports pulling images from ECR.

Answer

Request AWS Support to add the Java version to the default build image.

Answer

Use an AWS Lambda function to set up the build environment before CodeBuild runs.

Answer

Install the required Java version in the buildspec file using a command.

Question 10

A SysOps administrator is responsible for an Auto Scaling group that runs a critical application. The administrator wants to ensure that the application can recover from an AZ failure. Which THREE steps should the administrator take? (Choose three.)

Accepted Answer

Place subnets in each Availability Zone used by the Auto Scaling group.. Placing subnets in each Availability Zone (AZ) used by the Auto Scaling group allows the group to launch EC2 instances in multiple AZs, which is essential for fault isolation. If one AZ fails, the Auto Scaling group can still launch and maintain instances in the other AZs, ensuring application availability. Without subnets in each AZ, the Auto Scaling group cannot distribute instances across AZs, defeating the purpose of high availability.

Answer

Use EC2 instances in a single Availability Zone to reduce latency.

Answer

Use a single subnet in one Availability Zone to simplify network design.

Question 11

A SysOps administrator needs to audit all API calls made in the AWS account, including actions performed by the root user. Which service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made in an AWS account, including those made by the root user, IAM users, roles, and AWS services. It provides a detailed audit trail of actions taken, which is essential for security and compliance auditing. Enabling CloudTrail in all regions ensures comprehensive coverage.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 12

A SysOps administrator monitors a custom business metric published to Amazon CloudWatch. The metric exhibits irregular spikes that are not predictable. The administrator needs to be alerted when the metric deviates significantly from its normal pattern. Which CloudWatch feature should be used to set up the alarm with the least manual tuning?

Accepted Answer

CloudWatch Anomaly Detection. CloudWatch Anomaly Detection uses machine learning to automatically establish a baseline for a metric's normal pattern and create a band of expected values. When the metric deviates outside this band, it triggers an alarm without requiring manual threshold tuning, making it ideal for unpredictable, irregular spikes.

Answer

CloudWatch Logs metric filter

Answer

CloudWatch Metric Math with standard deviation

Answer

AWS CloudTrail Insights

Question 13

A SysOps administrator needs to share an encrypted AMI with a different AWS account. The AMI uses an AWS KMS key (customer managed key) for EBS encryption. What must be done to allow the target account to launch EC2 instances from the AMI?

Accepted Answer

Modify the AMI launch permissions and add the target account as a principal in the KMS key policy with kms:Decrypt permission.. When an AMI is encrypted with a customer managed KMS key, sharing the AMI launch permissions alone is insufficient because the target account cannot decrypt the underlying EBS snapshots without KMS permissions. The key policy must explicitly grant the target account (or its principals) kms:Decrypt (and typically kms:DescribeKey, kms:CreateGrant, kms:ReEncrypt*) so EC2 can use the key on the target account's behalf. Combining the AMI launch permission modification with the KMS key policy grant is what actually enables cross-account launches.

Answer

Share the underlying EBS snapshot with the target account.

Answer

Re-encrypt the AMI using a new KMS key that is shared with the target account.

Answer

Modify the AMI launch permissions to include the target account.

Question 14

A SysOps administrator is deploying a new application using AWS CloudFormation. The template includes an EC2 instance with a UserData script that installs software from a private S3 bucket. What is the BEST way to ensure the EC2 instance can access the S3 bucket without storing long-term credentials on the instance?

Accepted Answer

Create an IAM role with S3 access and associate it with the instance profile.. Creating an IAM role with S3 access and associating it with the instance profile allows the EC2 instance to obtain temporary credentials automatically via the instance metadata service. This avoids storing long-term credentials on the instance, which is a security best practice.

Answer

Create an IAM user with S3 access and attach the access key to the instance profile.

Answer

Store the access key ID and secret access key in the UserData script.

Answer

Configure a security group rule that allows the instance to reach S3 via VPC endpoint.

Question 15

A SysOps administrator needs to ensure that an Amazon S3 bucket is not publicly accessible. Which THREE actions should be taken to prevent public access?

Accepted Answer

Configure the bucket to block new public ACLs using S3 Object Ownership.. Enabling S3 Object Ownership allows you to disable ACLs on the bucket, which prevents new public ACLs from being applied. This is a key step in ensuring that no objects can be made publicly accessible via ACLs, as ACLs are an older access control mechanism that can grant public read/write access.

Answer

Enable versioning on the bucket.

Answer

Delete the bucket policy if it exists.

Question 16

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download software patches from the internet. Which component should be used to provide internet access to the instance?

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections. The NAT Gateway uses an Elastic IP and routes traffic from the private subnet through the internet gateway attached to the VPC, translating the private IP to the public IP of the NAT Gateway.

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway attached to the VPC

Answer

VPC Endpoint for Amazon S3

Question 17

A company wants to enforce that all Amazon S3 buckets in their AWS account are encrypted at rest. They have enabled AWS CloudTrail and want to automatically remediate any non-compliant bucket created by users. Which AWS service should they use to achieve this?

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously evaluates AWS resource configurations against desired rules and can trigger automatic remediation. For S3 encryption, you can use the managed rule 's3-bucket-server-side-encryption-enabled' to detect non-compliant buckets. When a bucket is created without encryption, AWS Config can invoke an AWS Lambda function or SSM Automation document to enable default encryption, achieving automatic remediation. This directly meets the requirement to enforce encryption at rest across all S3 buckets.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Service Catalog

Question 18

A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application experiences steady traffic during business hours and very low traffic overnight. The SysOps administrator wants to optimize costs by using a mix of On-Demand and Spot Instances. The administrator also requires that the total capacity never falls below the baseline level needed during business hours, even if Spot Instances are reclaimed. Which combination of Auto Scaling features should be used?

Accepted Answer

Use a mixed instances policy and set the 'On-Demand Base' capacity to the minimum number of instances required during business hours, and 'On-Demand percentage above base' to 0% so that any additional capacity is Spot.. A mixed instances policy allows the Auto Scaling group to use both On-Demand and Spot Instances. By setting the 'On-Demand Base' capacity to the minimum number of instances required during business hours, you guarantee that baseline capacity is always fulfilled by On-Demand Instances, which are not subject to interruption. Setting 'On-Demand percentage above base' to 0% ensures that any additional capacity beyond the base is fulfilled by Spot Instances, optimizing cost while maintaining the required capacity floor.

Answer

Use a launch template that specifies a Spot Instance type and set the total capacity to the desired level, relying on capacity rebalance to replace interrupted Spot Instances.

Answer

Purchase Compute Savings Plans to cover the entire Auto Scaling group, and use only Spot Instances for all capacity.

Answer

Configure the Auto Scaling group with a launch template that sets the instance market to 'spot' and use a scaling policy that always maintains the minimum capacity.

Question 19

A company uses AWS CloudTrail to log API calls. The SysOps team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and triggers an automated response. Which combination of services should be used? (Choose two.)

Accepted Answer

AWS Lambda. Amazon EventBridge (CloudWatch Events) can monitor CloudTrail API calls in real time and trigger an AWS Lambda function when a `StopLogging` or `UpdateTrail` API call is detected. Lambda then executes the automated response, such as re-enabling logging or sending an alert. This combination provides event-driven detection and remediation without manual intervention.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon Simple Queue Service (SQS)

Question 20

A company uses AWS Organizations with multiple accounts. The SysOps administrator needs to centralize the monitoring of all API calls made in any account for security analysis. The solution must collect logs from all accounts, both existing and future, and deliver them to a centralized S3 bucket in the management account. Which AWS service should the administrator use?

Accepted Answer

AWS CloudTrail organization trail. AWS CloudTrail organization trails allow you to log all API calls across all accounts in an AWS Organization from a single management account. When you create an organization trail, it automatically applies to all existing and future accounts, delivering logs to a centralized S3 bucket in the management account without requiring per-account configuration.

Answer

AWS Config aggregator

Answer

Amazon CloudWatch Logs with cross-account subscription

Answer

Amazon Detective