SOA-C02 Practice Exam 61 — 20 Questions

Question 1

An application running on EC2 instances in an Auto Scaling group uses an SQS queue for decoupling. The application experiences increased latency when the queue has a high number of messages. The SysOps Administrator needs to maintain responsiveness. Which solution is the most cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a CloudWatch alarm on the queue depth to trigger Auto Scaling policies.. Using a CloudWatch alarm on the SQS queue depth (ApproximateNumberOfMessagesVisible) to trigger Auto Scaling policies allows the Auto Scaling group to dynamically add EC2 instances only when the queue grows, directly addressing increased latency by scaling out compute capacity. This is the most cost-effective approach as it scales resources based on actual demand, avoiding over-provisioning.

Answer

Increase the desired capacity of the Auto Scaling group.

Answer

Use a larger instance type for the EC2 instances.

Answer

Increase the visibility timeout of the SQS queue.

Question 2

A SysOps administrator notices that the monthly bill for Amazon S3 has increased significantly. The company uses S3 for storing application logs and user uploads. The logs are accessed rarely but must be retained for 3 years. User uploads are accessed frequently for the first 30 days, then rarely after. Which S3 lifecycle policy will optimize storage costs?

Accepted Answer

Transition logs to S3 Glacier Deep Archive after 30 days, and transition user uploads to S3 Standard-IA after 30 days, then to Glacier Deep Archive after 90 days.. The correct policy matches storage class to access patterns: logs are rarely accessed but retained for three years, so transitioning them to Glacier Deep Archive after 30 days minimizes cost for long-term archival. User uploads are frequently accessed for 30 days, then rarely, so moving them to Standard-IA after 30 days and then to Glacier Deep Archive after 90 days aligns cost with declining access frequency while preserving durability. This combination addresses both data types with the cheapest suitable tiers.

Answer

Transition user uploads to S3 Glacier Deep Archive after 30 days, and transition logs to S3 Glacier after 90 days.

Answer

Move logs to S3 Glacier Deep Archive after 30 days, and delete user uploads after 1 year.

Answer

Transition logs to S3 Standard-IA after 30 days, and transition user uploads to S3 One Zone-IA after 30 days.

Question 3

A company manages multiple AWS accounts under AWS Organizations. The SysOps administrator needs to deploy a baseline set of AWS Config rules and an Amazon SNS topic to each account in the organization. The deployment must be centrally managed from the management account and automatically applied to any new member account added in the future. Which solution should the administrator use?

Accepted Answer

Create an AWS CloudFormation StackSet with the template containing the AWS Config rules and SNS topic. Configure the StackSet to deploy to the organization and enable automatic deployment to new accounts.. AWS CloudFormation StackSets can be deployed to an entire AWS Organizations organization or organizational units (OUs), and they support automatic deployment to new accounts added to the organization. By creating a StackSet with a template that defines the AWS Config rules and SNS topic, and enabling automatic deployment, the administrator ensures that every current and future member account receives the baseline configuration without manual intervention.

Answer

Use AWS Service Catalog to create a product that bundles the AWS Config rules and SNS topic. Grant each account access to launch the product.

Answer

Configure AWS Config conformance packs in the management account and use AWS Resource Access Manager to share them with member accounts.

Answer

Create an AWS Organizations Service Control Policy (SCP) that enforces the creation of AWS Config rules and SNS topics in every account.

Question 4

Which THREE are valid methods to control access to an S3 bucket? (Choose three.)

Accepted Answer

Access control lists (ACLs). Option B (Access control lists, ACLs) is correct because S3 ACLs are a legacy but still supported access-control mechanism that grants read/write permissions on a bucket or object to AWS accounts or predefined groups such as AllUsers or AuthenticatedUsers. Option C (Bucket policies) is correct because an S3 bucket policy is a resource-based JSON policy attached directly to the bucket that can allow or deny principals (IAM users, roles, accounts, or anonymous users) access to the bucket and its objects. Option D (IAM user policies) is correct because identity-based IAM policies attached to users, groups, or roles define what S3 actions (for example s3:GetObject, s3:PutObject) those identities may perform on specified bucket ARNs. Option A (VPC Flow Logs) is not an access-control method; it captures IP traffic metadata for network interfaces for monitoring and troubleshooting. Option E (CloudWatch Logs) is a logging and monitoring service, not an authorization mechanism, so it cannot grant or deny access to an S3 bucket.

Answer

VPC Flow Logs

Answer

CloudWatch Logs

Question 5

A company stores sensitive data in an RDS database. Which AWS service should be used to encrypt the database at rest?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the AWS service that manages the customer master keys (CMKs) used to encrypt RDS databases at rest. When you enable encryption on an RDS instance, you select a KMS key, and RDS uses that key to encrypt the underlying storage, snapshots, and read replicas. KMS integrates natively with RDS, EBS, S3, and most other AWS services for at-rest encryption.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 6

A company runs a critical application on AWS Lambda functions. The functions are invoked by an API Gateway endpoint. The SysOps administrator needs to ensure that the application continues to work if an entire AWS Region becomes unavailable. What should the administrator do?

Accepted Answer

Deploy the same API Gateway and Lambda setup in a second Region and use Route 53 with failover routing.. Deploying the same API Gateway and Lambda setup in a second AWS Region and using Route 53 with failover routing creates an active-passive disaster recovery architecture. Route 53 health checks monitor the primary Region's endpoint, and if it becomes unhealthy (e.g., due to a regional outage), DNS failover automatically routes traffic to the secondary Region, ensuring continuous operation of the application.

Answer

Use AWS Global Accelerator to route traffic to the closest Region.

Answer

Configure Lambda functions with provisioned concurrency in multiple Regions.

Answer

Use Lambda@Edge to run the functions at edge locations.

Question 7

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance. The administrator wants to ensure that if the stack is updated, the EC2 instance is not accidentally replaced if its properties change. The administrator wants the stack update to fail when a property change would require replacement. Which CloudFormation feature should the administrator use?

Accepted Answer

StackPolicy. StackPolicy, is correct because a stack policy is a JSON document that defines which stack resources can be updated or replaced during a stack update. By setting a Deny effect on update actions for the EC2 instance, the administrator can prevent any property change that would cause replacement, causing the update to fail instead of replacing the instance. This directly meets the requirement to block accidental replacement.

Answer

CreationPolicy

Answer

DeletionPolicy

Answer

UpdateReplacePolicy

Question 8

An organization uses AWS OpsWorks for configuration management. The SysOps administrator notices that a stack's instances are not receiving the updated custom cookbooks after a new deployment. The cookbooks are stored in a private GitHub repository. What is the most likely cause?

Accepted Answer

The SSH key for the Git repository is not configured in the stack.. The most likely cause is that the SSH key for the Git repository is not configured in the stack. AWS OpsWorks uses SSH keys to authenticate to private Git repositories when deploying custom cookbooks. Without the correct key, the instances cannot pull the updated cookbooks, resulting in deployment failures or outdated cookbooks.

Answer

The cookbooks are not stored in an S3 bucket.

Answer

The OpsWorks agent is not running on the instances.

Answer

The instances do not have internet access.

Question 9

A SysOps administrator is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises data center connected via AWS Direct Connect. The EC2 instance can reach other instances in the same VPC but cannot reach the on-premises network. The virtual private gateway (VGW) is attached to the VPC and the Direct Connect virtual interface is up. Which configuration step should the administrator verify first?

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway. For an EC2 instance to reach an on-premises network via Direct Connect, the VPC route table must contain a route for the on-premises CIDR block pointing to the virtual private gateway (VGW). Since the instance can reach other VPC instances, local routing works; the missing piece is the route to the on-premises destination. Without this route, traffic has no path to the VGW and is dropped.

Answer

Check the security group rules for the EC2 instance

Answer

Confirm that the Direct Connect virtual interface is associated with the correct VLAN

Answer

Verify the network ACL inbound and outbound rules for the VPC subnet

Question 10

A company wants to receive alerts when its AWS costs exceed a certain threshold. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets and receive alerts when actual or forecasted costs exceed a defined threshold. It directly supports cost-based alerting with actions such as sending an SNS notification or applying an IAM policy to restrict resources when the budget limit is breached.

Answer

Amazon CloudWatch

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 11

A company requires that all access to the AWS Management Console be protected by multi-factor authentication (MFA). The SysOps administrator has enabled an IAM policy that denies all actions if the user does not authenticate with MFA. However, some users report they cannot list their own MFA devices. What is the MOST likely cause?

Accepted Answer

The policy denies the iam:ListMFADevices action without an MFA-authenticated session. The IAM policy that denies all actions unless the user is authenticated with MFA will also block the iam:ListMFADevices action because that API call is made without an MFA-authenticated session. When a user tries to list their own MFA devices, they have not yet passed the MFA challenge, so the session is not MFA-authenticated, and the deny policy applies. This creates a catch-22: the user cannot list their devices to manage MFA because listing requires MFA, but they need to list devices to set up MFA.

Answer

The policy is applied to the root user only

Answer

Users are not using MFA-enabled access keys

Answer

The policy is not applied in the us-east-1 region

Question 12

A SysOps administrator needs to allow traffic from a specific IP address range (203.0.113.0/24) to access an Amazon EC2 instance in a VPC. Which configuration step should be performed?

Accepted Answer

Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.. Security groups are the stateful, instance-level virtual firewalls in AWS that control inbound and outbound traffic to EC2 instances. To permit traffic from a specific CIDR block like 203.0.113.0/24 to reach an EC2 instance, you must add an inbound rule to the security group attached to that instance, specifying the source as the CIDR. This is the most direct and correct configuration step because security groups operate at the ENI level and are required for any inbound traffic to be allowed.

Answer

Create an IAM policy that allows inbound traffic from 203.0.113.0/24.

Answer

Add a rule to the network ACL associated with the subnet to allow inbound traffic from 203.0.113.0/24.

Answer

Modify the route table of the subnet to include a route for 203.0.113.0/24 to the internet gateway.

Question 13

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification. Amazon CloudWatch Events (now Amazon EventBridge) can match AWS API calls recorded by CloudTrail, such as CreateAccessKey, and route them to targets like SNS for alerting. The rule pattern matches the event source (iam.amazonaws.com) and event name (CreateAccessKey), then triggers an SNS notification to the security team. This is the standard serverless approach for real-time alerting on specific API activity.

Answer

CloudWatch Logs Insights query on CloudTrail logs with an alarm

Answer

An AWS Config rule that checks for new access keys and sends an SNS notification

Answer

S3 event notifications to an SNS topic

Question 14

A SysOps administrator is tasked with ensuring that an Amazon S3 bucket can withstand the loss of an entire AWS Region. The bucket stores critical data that must be accessible with minimal latency from multiple regions. Which solution meets these requirements?

Accepted Answer

Configure S3 Cross-Region Replication to a bucket in another AWS Region. Use Amazon CloudFront with multiple origins pointing to both buckets.. S3 Cross-Region Replication (CRR) automatically replicates objects to a bucket in another AWS Region, ensuring data survives a regional failure. Using Amazon CloudFront with multiple origins pointing to both buckets provides low-latency access from any region by routing requests to the nearest healthy origin, meeting both durability and performance requirements.

Answer

Enable S3 Versioning and configure a lifecycle policy to transition objects to S3 Glacier Deep Archive.

Answer

Enable S3 Versioning and MFA Delete on the bucket. Use S3 Object Lock to prevent object deletion.

Answer

Enable S3 Transfer Acceleration on the bucket and use a CloudFront distribution with the bucket as the origin.

Question 15

A company stores application log files in an Amazon S3 bucket. The logs are accessed frequently for the first 30 days, then rarely accessed but must be retrievable within 12 hours. After 1 year, the logs must be archived for compliance with a retention period of 5 years, during which retrievals are expected to be extremely rare (one or two per year) and retrieval time of 12 hours is acceptable. The SysOps administrator wants to minimize storage costs. Which S3 lifecycle policy configuration should be used?

Accepted Answer

After 30 days, transition to S3 Glacier Flexible Retrieval; after 365 days, transition to S3 Glacier Deep Archive; delete after 5 years.. It uses S3 Glacier Flexible Retrieval for the first year after the initial 30 days, which meets the 12-hour retrieval requirement at lower cost than S3 Standard-IA, then transitions to S3 Glacier Deep Archive for the remaining 4 years to minimize storage costs for extremely rare retrievals. The lifecycle policy transitions objects after 30 days to S3 Glacier Flexible Retrieval (retrieval time minutes to 12 hours), then after 365 days to S3 Glacier Deep Archive (retrieval time 12 hours), and deletes after 5 years, aligning with the access patterns and compliance retention.

Answer

After 30 days, transition to S3 Standard-IA; after 365 days, transition to S3 Glacier Deep Archive; delete after 5 years.

Answer

After 30 days, transition to S3 Glacier Flexible Retrieval; delete after 5 years.

Answer

After 30 days, transition to S3 Glacier Deep Archive; delete after 5 years.

Question 16

A SysOps administrator needs to ensure that an Amazon RDS instance is encrypted at rest. The instance is already provisioned unencrypted. What is the correct approach to enable encryption?

Accepted Answer

Create a snapshot of the instance and restore it with encryption enabled. RDS does not allow enabling encryption in place on an existing unencrypted instance. The supported path is to snapshot the instance, then restore that snapshot with encryption enabled, which produces a new encrypted instance. You then repoint applications to the new endpoint.

Answer

Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance

Answer

Enable encryption using the AWS CLI command modify-db-instance

Answer

Modify the RDS instance and enable encryption in the configuration

Question 17

A company is using Amazon RDS for MySQL and needs to encrypt data at rest. Which action should be taken to enable encryption?

Accepted Answer

Create a new RDS DB instance with encryption enabled.. Amazon RDS for MySQL does not support enabling encryption on an existing DB instance. Encryption at rest must be enabled at the time of instance creation. Therefore, the correct action is to create a new RDS DB instance with encryption enabled, and then migrate the data from the unencrypted instance to the new encrypted one.

Answer

Use the RDS console to enable encryption on the existing DB instance.

Answer

Use AWS KMS to create a customer master key and assign it to the existing DB instance.

Answer

Modify the existing RDS DB instance and enable encryption.

Question 18

A company's security team notices that an IAM user has been generating multiple access keys and deleting them within a short period. The SysOps administrator needs to detect and alert on this behavior. Which solution is the MOST effective?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on iam:CreateAccessKey events and sends a notification to an SNS topic.. The behavior described—creating and deleting access keys rapidly—is an API-level event that must be captured in real time. AWS CloudTrail logs all IAM API calls, including CreateAccessKey and DeleteAccessKey. By creating a CloudWatch Events (now Amazon EventBridge) rule that matches the iam:CreateAccessKey event, you can trigger an SNS notification immediately, enabling the security team to detect and respond to the suspicious activity. This solution is the most effective because it provides near-real-time detection and alerting based on the specific API call.

Answer

Enable AWS Trusted Advisor security checks and review the report weekly.

Answer

Enable IAM Access Analyzer to analyze user activity and send alerts.

Answer

Use AWS Config to track IAM user configuration changes and trigger an alert when an access key is created.

Question 19

A SysOps administrator is setting up monitoring for an application that runs on Amazon ECS with Fargate launch type. The application's performance degrades when memory utilization exceeds 80%. The administrator wants to receive a notification when memory usage approaches this threshold. What should the administrator do?

Accepted Answer

Create a CloudWatch alarm on the ECS service's MemoryUtilization metric. Amazon ECS services automatically publish a `MemoryUtilization` metric to CloudWatch for Fargate tasks. By creating a CloudWatch alarm on this metric with a threshold of 80%, the administrator can trigger an SNS notification when memory usage approaches the threshold, enabling proactive remediation before performance degrades.

Answer

Install the CloudWatch agent on each Fargate task

Answer

Use Amazon CloudWatch Container Insights to view ReservedMemory metric

Answer

Enable Service Auto Scaling with a target tracking policy based on MemoryUtilization

Question 20

A SysOps administrator needs to audit all changes to security groups in an AWS account. Which AWS service should be used to capture these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including all CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and DeleteSecurityGroup API actions. By enabling CloudTrail trail logging, the SysOps administrator can capture a complete audit trail of who made changes, when, and from which source IP, which is essential for security group change auditing.

Answer

VPC Flow Logs

Answer

CloudWatch Logs

Answer

AWS Config