SOA-C02 Practice Exam 60 — 20 Questions

Question 1

A company runs a critical web application on EC2 instances behind an Application Load Balancer in a single Availability Zone. To improve reliability, what is the MOST effective design change?

Accepted Answer

Launch EC2 instances across two or more Availability Zones.. The most effective design change to improve reliability is to launch EC2 instances across two or more Availability Zones. This eliminates the single point of failure at the Availability Zone level, ensuring that if one AZ experiences an outage, the Application Load Balancer can route traffic to healthy instances in another AZ. This directly addresses the core reliability principle of fault isolation and high availability.

Answer

Place the RDS database in a Multi-AZ deployment.

Answer

Add a second Application Load Balancer in the same Availability Zone.

Answer

Increase the EC2 instance size to handle more traffic.

Question 2

A company runs a large number of EC2 instances across multiple accounts and regions. The finance team needs to track costs per project and department. Each EC2 instance must be tagged with a ProjectID and Department tag. A SysOps administrator needs to ensure that all newly launched EC2 instances are tagged automatically before they can be used, and that existing untagged instances are retroactively tagged. The tags must be propagated to cost reports in AWS Cost Explorer. Which combination of steps will achieve this with the least operational overhead?

Accepted Answer

Use AWS Config with auto-remediation to tag new instances, and activate the tags as cost allocation tags. For existing instances, run the Tag Editor with a CSV import.. AWS Config with auto-remediation can automatically tag newly launched EC2 instances using a custom Lambda function or SSM document triggered by a Config rule (e.g., 'required-tags'), ensuring compliance before instances are used. Activating the tags as cost allocation tags in AWS Cost Explorer allows the tags to appear in cost reports. For existing untagged instances, the Tag Editor with a CSV import provides a bulk, low-overhead method to retroactively apply tags across accounts and regions.

Answer

Create an AWS Lambda function that tags instances at launch via CloudTrail events, and use AWS Budgets to enforce tagging.

Answer

Use AWS Cost Categories to automatically group costs based on resource tags.

Answer

Ensure all AMIs used have tags that propagate to instances, and enable cost allocation tags.

Question 3

A SysOps administrator is designing a disaster recovery plan for a web application that runs on EC2 instances with data stored in an RDS MySQL database. The application requires a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour. Which solution meets these requirements most cost-effectively?

Accepted Answer

Use RDS Multi-AZ with automated backups and EC2 AMI backups.. RDS Multi-AZ provides automatic synchronous replication to a standby instance in a different Availability Zone, ensuring minimal data loss and a fast failover that meets the 5-minute RPO and 1-hour RTO. Automated backups enable point-in-time recovery within the retention period, and EC2 AMI backups allow quick restoration of the application tier, making this the most cost-effective solution that satisfies both objectives without requiring cross-Region resources.

Answer

Use a single RDS instance with daily snapshots and EC2 instance store.

Answer

Use EC2 Auto Scaling across Regions with an RDS standby instance.

Answer

Use RDS Multi-AZ with read replicas in another Region.

Question 4

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. Which of the following route table configurations is required for the private subnet to enable internet access through the NAT gateway?

Accepted Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the private subnet route table. A private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface (ENI) to forward outbound internet traffic from private instances through the NAT gateway. The NAT gateway, residing in the public subnet, then uses its own route table with a route to the internet gateway (IGW) to reach the internet. Without this route, traffic from the private subnet would have no path to the internet.

Answer

Add a route to 0.0.0.0/0 pointing to the internet gateway in the private subnet route table

Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the public subnet route table

Answer

Add a route to the NAT gateway's private IP in the private subnet route table

Question 5

A company is designing a disaster recovery plan for its critical applications. The plan must minimize data loss and recovery time. Which TWO measures should the SysOps administrator implement?

Accepted Answer

Perform regular backups to Amazon S3.. Regular backups to Amazon S3 are a foundational data protection measure because S3 provides 99.999999999% durability and supports lifecycle policies for cost-effective long-term retention. This directly addresses the requirement to minimize data loss by ensuring point-in-time recovery copies exist independently of the primary infrastructure.

Answer

Set a recovery time objective (RTO) of 24 hours.

Answer

Use manual procedures to restore from backups.

Answer

Run all workloads in a single AWS region.

Question 6

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which step is necessary?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. To enable IPv6 communication in an existing VPC, you must first associate an Amazon-provided IPv6 CIDR block with the VPC. This is a prerequisite for configuring subnets, route tables, and internet gateways to support IPv6 traffic. Without an IPv6 CIDR block assigned to the VPC, no EC2 instance can obtain an IPv6 address or route IPv6 traffic.

Answer

Attach an internet gateway that supports IPv6.

Answer

Create a new VPC with an IPv6 CIDR block and migrate resources.

Answer

Enable DNS64 in the VPC.

Question 7

A company is using Amazon RDS for MySQL. The SysOps administrator needs to monitor the number of database connections and set an alarm when connections exceed 80% of the maximum. Which CloudWatch metric and alarm threshold should be used?

Accepted Answer

Metric: DatabaseConnections; Threshold: 0.8 * max_connections (using a math expression). Amazon RDS for MySQL does not expose a direct 'DatabaseConnections' metric that represents the current connection count relative to the maximum. Instead, you must use the 'DatabaseConnections' CloudWatch metric (which reports the number of client connections) and create a CloudWatch math expression to compare it against the RDS instance's 'max_connections' parameter (e.g., 0.8 * max_connections). This allows you to set an alarm that triggers when connections exceed 80% of the configured maximum, which is the accurate way to monitor connection utilization.

Answer

Metric: DBConnections; Threshold: 80

Answer

Metric: DatabaseConnections; Threshold: 80

Answer

Metric: FreeableMemory; Threshold: 20%

Question 8

A SysOps administrator is investigating a performance issue with an Amazon RDS for PostgreSQL instance. The administrator has enabled Performance Insights. Which TWO metrics from Performance Insights can help identify the root cause of a sudden increase in database load? (Choose TWO.)

Accepted Answer

DB Load by Wait Events.. The correct answers are C and E. DB Load by Wait Events (C) breaks down the total load into wait event categories (e.g., CPU, I/O, locks), directly identifying the resource causing the bottleneck. Top SQL queries by DB Load (E) shows which specific SQL statements contribute the most to the load, enabling targeted optimization. Together, they provide a complete root cause analysis. Options A and D (Read/Write IOPS, CPUUtilization) are infrastructure-level metrics that may indicate resource pressure but do not reveal database-level contention or query-level impact. Option B (Average Active Sessions) is the overall load metric itself, not a breakdown, so it does not pinpoint the cause.

Answer

Read IOPS and Write IOPS.

Answer

Average Active Sessions.

Answer

CPUUtilization percentage.

Question 9

A SysOps administrator is using AWS OpsWorks to manage a stack of web servers. The administrator wants to automate the installation of custom software on all new instances that are added to the layer. What is the best approach?

Accepted Answer

Assign a custom Chef recipe to the layer's Setup lifecycle event.. AWS OpsWorks uses Chef to manage configuration. Assigning a custom Chef recipe to the layer's Setup lifecycle event ensures the recipe runs automatically on every new instance when it boots, installing the custom software consistently. This is the native, best-practice approach within OpsWorks for automating software installation on new instances.

Answer

Use AWS CloudFormation to install software on new instances.

Answer

Create a custom AMI with the software pre-installed and use that in the layer.

Answer

Use EC2 user data scripts in the layer configuration.

Question 10

A SysOps Administrator needs to allow an EC2 instance in a private subnet to access the internet for software updates. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables EC2 instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP of the instance to the NAT Gateway's Elastic IP using Source Network Address Translation (SNAT). This is the correct service because the instance is in a private subnet and requires internet access without being directly reachable.

Answer

VPN Connection

Answer

Internet Gateway

Answer

VPC Peering

Question 11

Which TWO actions should a SysOps administrator take to set up centralized logging from multiple Amazon EC2 instances running Amazon Linux 2 to Amazon CloudWatch Logs?

Accepted Answer

Attach an IAM role to each EC2 instance that includes permission for logs:PutLogEvents.. The EC2 instances need an IAM role with the logs:PutLogEvents permission to authenticate and authorize log delivery to CloudWatch Logs. Without this permission, the CloudWatch agent cannot send log data to the log stream, resulting in authorization failures.

Answer

Create an S3 bucket and configure the EC2 instances to write logs directly to the bucket.

Answer

Create a VPC endpoint for CloudWatch Logs to allow private connectivity.

Answer

Export the logs from CloudWatch Logs to an Amazon S3 bucket for long-term retention.

Question 12

A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 provides private connectivity from a VPC to Amazon S3 without requiring a NAT Gateway, internet gateway, or VPN. Traffic to S3 stays entirely within the AWS network, and the endpoint is added as a target in the route table for the private subnet. This is the only option that satisfies the 'no NAT/IGW' constraint for S3 specifically.

Answer

Set up a NAT Gateway in a public subnet and route traffic through it.

Answer

Use S3 Transfer Acceleration.

Answer

Create a VPC Interface Endpoint for S3.

Question 13

A company is running a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application stores session data on the local instance storage. Users are experiencing session loss during scaling events. What should a SysOps administrator do to maintain session persistence?

Accepted Answer

Move session data to an ElastiCache for Redis cluster.. Session data stored on local instance storage is ephemeral and lost when instances are terminated or replaced during scaling events. Moving session data to ElastiCache for Redis provides a centralized, durable, and low-latency session store that persists independently of EC2 instance lifecycles, ensuring session continuity across scaling operations.

Answer

Increase the EC2 instance size to reduce the frequency of scaling events.

Answer

Attach an Amazon EBS volume to each instance and store session data there.

Answer

Enable sticky sessions on the Application Load Balancer.

Question 14

A SysOps administrator needs to deploy a new application version to an Auto Scaling group without causing any downtime. The application runs on EC2 instances behind an Application Load Balancer. Which deployment method should the administrator use?

Accepted Answer

Use a rolling update with a batch size of 1 instance and enable the health check grace period.. A rolling update with a batch size of 1 instance replaces instances one at a time, ensuring that the Auto Scaling group always maintains the desired capacity minus one, which prevents downtime. Enabling the health check grace period allows the new instance to pass the ALB health checks before the next instance is terminated, ensuring traffic is only sent to healthy instances.

Answer

Perform an in-place update by updating the launch template and manually replacing instances one by one.

Answer

Use a rolling update with a batch size of 100% of the instances.

Answer

Create a new Auto Scaling group with the new launch template and gradually shift traffic using a load balancer target group.

Question 15

Match each AWS service with its primary security compliance function. (Drag each service to its correct function.) (Choose 4.)

Accepted Answer

AWS CloudTrail -> Detect unauthorized API calls. AWS CloudTrail is the service that records API activity in your AWS account, including both management and data events. By enabling CloudTrail, you can detect unauthorized API calls by analyzing the recorded events for actions that were not initiated by authorized users or services, such as an IAM user making a call from an unexpected IP address or using an unknown user agent.

Question 16

A containerized API runs on Amazon ECS with an Application Load Balancer. The team wants to deploy new container versions with zero downtime, automatically route traffic to the new version only after health checks pass, and automatically roll back if error rates spike within 10 minutes of the shift. Which deployment strategy and configuration implements all three requirements?

Accepted Answer

Use CodeDeploy with the ECS blue/green deployment type, configure a Canary or Linear traffic shifting strategy, and attach a CloudWatch alarm for error rate as a deployment alarm. CodeDeploy's ECS blue/green deployment type supports canary or linear traffic shifting, which automatically routes traffic to the new version only after health checks pass. By attaching a CloudWatch alarm for error rate as a deployment alarm, CodeDeploy can automatically trigger a rollback if error rates spike within the specified monitoring period (e.g., 10 minutes), meeting all three requirements: zero downtime, health-check-gated traffic shifting, and automatic rollback on error rate spikes.

Answer

Update the ECS service with a rolling update deployment configuration and set the minimum healthy percent to 100

Answer

Create a second ECS service with the new task definition and use Route 53 weighted routing to shift traffic at the DNS level

Answer

Enable ECS circuit breaker on the service to roll back failed deployments automatically

Question 17

Refer to the exhibit. A SysOps administrator deploys this CloudFormation stack. The EC2 instance launches and the web server starts. However, the CloudWatch alarm does not trigger even when CPU utilization exceeds 80%. What is the MOST likely reason?

Accepted Answer

The alarm statistic should be 'Maximum' instead of 'Average' to catch CPU spikes that may not sustain the average above 80% for 5 minutes.. The alarm is configured with the 'Average' statistic, which smooths out CPU utilization over the 5-minute period. If CPU utilization spikes above 80% but does not sustain an average above that threshold for the entire duration, the alarm will not trigger. Using the 'Maximum' statistic would catch any single data point exceeding 80% within the period, making it appropriate for detecting short-lived spikes.

Answer

The alarm action is missing a valid SNS topic ARN.

Answer

The alarm dimension is incorrect; it should use the instance's private IP.

Answer

The user data script fails to start the web server, causing the instance to be unhealthy.

Question 18

An organization uses AWS OpsWorks to manage a stack of application servers. The stack uses a custom cookbook that is stored in a private GitHub repository. When deploying new instances, the cookbook download fails. What should the administrator do to resolve this?

Accepted Answer

Configure an SSH key in the OpsWorks stack to access the private repository. AWS OpsWorks needs credentials to clone a cookbook from a private GitHub repository. The correct approach is to configure an SSH key (deploy key) in the OpsWorks stack settings so that the instance can authenticate to GitHub during the cookbook download. This allows OpsWorks to securely access the private repository without exposing credentials in the cookbook or making the repository public.

Answer

Upload the cookbook to Amazon S3 and reference the S3 URL

Answer

Make the GitHub repository public

Answer

Store the GitHub credentials in the OpsWorks stack settings

Question 19

A company is using CloudWatch Logs to centralize logs from multiple EC2 instances. The operations team notices that some log entries are missing from CloudWatch Logs. The CloudWatch agent is installed and running on all instances. What is the most likely cause?

Accepted Answer

The IAM role attached to the EC2 instance does not have the 'logs:PutLogEvents' permission.. The most likely cause is that the IAM role attached to the EC2 instance lacks the 'logs:PutLogEvents' permission. Without this permission, the CloudWatch agent can authenticate and connect to CloudWatch Logs but cannot actually write log data to the log stream, resulting in missing entries. The agent may appear to be running and healthy, but API calls to PutLogEvents will fail silently or log errors, leading to gaps in the centralized logs.

Answer

The CloudWatch agent is not configured to send logs to the correct log group.

Answer

The CloudWatch agent is sending logs to a different AWS Region.

Answer

The log group has been encrypted with a KMS key that the agent does not have access to.

Question 20

A company is deploying a new web application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) with specific software pre-installed. The SysOps administrator creates a custom AMI and configures Elastic Beanstalk to use it. However, during deployment, the instances fail to pass the health check. The health check endpoint is a simple 'index.html' file. What is the MOST likely cause?

Accepted Answer

The custom AMI does not have a web server installed and configured to serve the application.. Elastic Beanstalk relies on the platform's web server (Apache, Nginx, IIS) to serve the application and respond to the health check endpoint. When you supply a custom AMI, you must ensure it includes the same web server and configuration that the chosen Beanstalk platform expects. If the AMI lacks a running web server on the expected port (e.g., port 80 for the default health check path '/'), the ELB health check will fail and instances will be marked unhealthy.

Answer

The Elastic Beanstalk environment was created before the custom AMI was registered.

Answer

The custom AMI is not registered with the same account that owns the Elastic Beanstalk environment.

Answer

The custom AMI does not have the latest patches, causing the instance to fail the EC2 status checks.