SOA-C02 Practice Exam 63 — 20 Questions

Question 1

A SysOps administrator is automating the creation of Amazon RDS instances using AWS CloudFormation. The template includes a DBInstance resource with a DBSubnetGroupName property referencing a subnet group created in the same template. The stack creation fails with the error 'DBSubnetGroup not found'. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A DependsOn clause is missing between the DBInstance and the DBSubnetGroup.. In AWS CloudFormation, resource creation order is not guaranteed unless explicitly defined. When a DBInstance resource references a DBSubnetGroup by name, CloudFormation may attempt to create the DBInstance before the DBSubnetGroup is fully created, resulting in a 'DBSubnetGroup not found' error. Adding a DependsOn clause to the DBInstance resource ensures the DBSubnetGroup is created first, resolving the dependency.

Answer

The VPC ID is incorrect or does not exist.

Answer

The DBSubnetGroup is not associated with a public subnet.

Answer

The DBSubnetGroup is defined in a different CloudFormation stack.

Question 2

A company has multiple AWS accounts and wants to centrally track costs and usage across all accounts. Which AWS service should the SysOps administrator use?

Accepted Answer

AWS Organizations. AWS Organizations enables centralized management of multiple AWS accounts, including consolidated billing and cost tracking. By using the management account, you can view aggregated costs and usage across all member accounts through AWS Cost Explorer and Cost & Usage Reports, making it the correct service for this requirement.

Answer

AWS Budgets

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 3

A SysOps administrator needs to automatically restart an Amazon RDS DB instance when the 'DatabaseConnections' metric exceeds a threshold of 200 for 5 consecutive minutes. The administrator wants a solution that uses minimal custom code and leverages AWS managed services. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch alarm with an AWS Systems Manager Automation action.. AWS Systems Manager Automation provides a built-in 'AWSSupport-StartRDSInstance' or 'AWSSystemsManager-RestartRDSInstance' runbook that can be triggered directly by a CloudWatch alarm action, requiring no custom code. This leverages a managed service to restart the RDS instance automatically when the 'DatabaseConnections' metric exceeds 200 for 5 consecutive minutes, meeting the minimal custom code requirement.

Answer

Amazon CloudWatch alarm with an Auto Scaling policy.

Answer

Amazon CloudWatch alarm with an Amazon Simple Notification Service (SNS) topic that triggers an AWS Lambda function to restart the instance.

Answer

Amazon RDS event subscription that triggers an AWS Lambda function.

Question 4

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to existing EC2 instances managed by OpsWorks. Which OpsWorks lifecycle event should the administrator trigger to install the new application?

Accepted Answer

Deploy. The 'Deploy' lifecycle event is specifically designed for deploying applications. Option B (Deploy) is correct because it triggers the deploy recipes to install the new application version. Option A (Configure) is incorrect because it runs when instances come online or leave the stack, not for application deployment. Option C (Shutdown) is incorrect because it runs when an instance is terminated. Option D (Setup) is incorrect because it runs only once when the instance is first booted, not for ongoing deployments.

Answer

Configure

Answer

Shutdown

Answer

Setup

Question 5

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application stores session data locally on each instance. During a traffic spike, the Auto Scaling group launches new instances, but users report that they are logged out and lose session data. Which solution addresses this issue without modifying the application?

Accepted Answer

Enable sticky sessions (session affinity) on the Application Load Balancer.. The application stores session data locally on each EC2 instance, so when new instances are launched during a traffic spike, the load balancer may route a user's subsequent request to a different instance that does not have their session data, causing them to be logged out. Enabling sticky sessions (session affinity) on the Application Load Balancer ensures that all requests from a user during a session are sent to the same instance, preserving the locally stored session data without requiring any application modifications.

Answer

Modify the application to use ElastiCache for session storage.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Use larger EC2 instance types to handle the traffic spike.

Question 6

A company wants to receive an email notification when an EC2 instance's status check fails. What AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarm. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending an email via Amazon SNS, when a status check fails. This is the correct service because it directly integrates with EC2 metrics and supports alarm-based notifications for status check failures.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 7

Refer to the exhibit. A SysOps administrator runs the CloudWatch Logs Insights query shown. What does this query do?

Accepted Answer

Counts the number of ERROR and FATAL log entries per 5-minute interval and displays them in descending order by time.. The CloudWatch Logs Insights query uses `stats count(*) by bin(5m)` to aggregate log events into 5-minute time buckets, then filters with `filter @message like /ERROR|FATAL/` to include only those severity levels. The `sort @timestamp desc` orders the resulting time buckets in descending chronological order, producing a count of ERROR and FATAL entries per 5-minute interval. This matches option B exactly.

Answer

Groups ERROR and FATAL entries by log stream name.

Answer

Displays the full log messages of all ERROR and FATAL entries.

Answer

Deletes all log entries containing ERROR or FATAL older than 5 minutes.

Question 8

A company is using AWS Organizations and wants to delegate administration of a specific member account to a user in the management account. Which TWO steps are required?

Accepted Answer

Grant the user in the management account permissions to assume the role in the member account.. To delegate administration of a member account to a user in the management account, you must create an IAM role in the member account with a trust policy that allows the management account (or a specific user/role in it) to assume that role. Then, the user in the management account must be granted permissions (e.g., via an IAM policy) to call sts:AssumeRole on that role. This cross-account access pattern is the standard AWS mechanism for delegating administrative access without sharing long-term credentials.

Answer

Create an IAM user in the member account with the same name as the management account user.

Answer

Enable AWS Single Sign-On (SSO) for the member account.

Answer

Create a service control policy (SCP) that allows the member account to be administered.

Question 9

A SysOps administrator is troubleshooting an issue where an EC2 instance in a private subnet cannot connect to the internet via a NAT Gateway. Which TWO components must be correctly configured for this to work? (Select TWO.)

Accepted Answer

The NAT Gateway must be placed in a public subnet with a route to an Internet Gateway.. The NAT Gateway must reside in a public subnet because it needs a direct route to an Internet Gateway (IGW) to translate private IP addresses to the NAT Gateway's Elastic IP for outbound internet traffic. Without this placement and route, the NAT Gateway cannot forward traffic to the internet, breaking connectivity for instances in private subnets.

Answer

The network ACL for the private subnet must have a rule allowing inbound traffic from the NAT Gateway.

Answer

The EC2 instance must have a public IP address.

Answer

The security group for the EC2 instance must allow inbound traffic on port 80.

Question 10

A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template references the secret using a dynamic reference. However, the stack creation fails with an error that the secret cannot be retrieved. What is the most likely cause?

Accepted Answer

The CloudFormation service role lacks permissions to read the secret.. To use dynamic references, the CloudFormation service role must have permission to read the secret. The stack name and parameters are not related to secret retrieval. The secret must be in the same region. The template syntax might be incorrect, but the most common issue is missing permissions.

Answer

The secret is in a different AWS Region.

Answer

The stack name does not match the secret name.

Answer

The template uses the wrong dynamic reference syntax.

Question 11

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application is deployed across multiple Availability Zones. The SysOps administrator wants to ensure that the application remains available even if an entire Availability Zone fails. What is the MOST effective way to achieve this?

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones.. By configuring the Auto Scaling group to launch instances in at least two Availability Zones, the application can survive the failure of an entire AZ because the Auto Scaling group will automatically replace failed instances in the remaining healthy AZs. This design ensures that the stateless web application remains available as long as at least one AZ is operational, leveraging the fault isolation that AWS Availability Zones provide. The Auto Scaling group distributes instances across the specified AZs and will maintain the desired capacity even if one AZ becomes completely unavailable.

Answer

Create a CloudWatch alarm to reboot instances when they become unhealthy.

Answer

Use a single Availability Zone to reduce complexity.

Answer

Use a larger instance type to handle more traffic.

Question 12

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume. The SysOps administrator needs to implement a backup strategy that ensures data can be recovered in the event of an AZ failure. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure automated snapshots using Amazon Data Lifecycle Manager.. Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots, providing a scheduled backup mechanism that protects against data loss. Option C is correct because copying snapshots to another region ensures data is recoverable even if an entire AWS Availability Zone (AZ) fails, as the snapshots are stored independently in a different geographic region.

Answer

Increase the EBS volume size to maximize I/O performance.

Answer

Enable EBS encryption using AWS KMS.

Answer

Enable EBS Multi-Attach to allow the volume to be attached to instances in another AZ.

Question 13

Which TWO AWS services can be used to provide a static IP address for an Application Load Balancer? (Choose two.)

Accepted Answer

Network Load Balancer (with Elastic IP). Option C is correct because an Application Load Balancer cannot have an Elastic IP directly, but you can place a Network Load Balancer in front of it; the NLB supports Elastic IP addresses (one per subnet/AZ), giving the ALB a static IP entry point. Option D is correct because AWS Global Accelerator provides two static anycast IPv4 addresses (and optionally IPv6) that route traffic to the ALB, effectively giving it fixed IP addresses. Option A is incorrect because a Route 53 static DNS name is still a DNS name, not a static IP address. Option B is incorrect because Elastic IP addresses cannot be assigned directly to an Application Load Balancer. Option E is incorrect because Application Load Balancers do not support Elastic IP addresses; their IPs are dynamic and can change.

Answer

Amazon Route 53 with static DNS name

Answer

Elastic IP address assigned to the ALB

Answer

Application Load Balancer (with Elastic IP)

Question 14

A SysOps administrator wants to automate the creation of an Amazon RDS MySQL instance using AWS CloudFormation. Which CloudFormation resource type should be used?

Accepted Answer

AWS::RDS::DBInstance. AWS CloudFormation uses resource types to define infrastructure components. For an Amazon RDS MySQL instance, the correct resource type is `AWS::RDS::DBInstance`, which directly maps to creating and configuring a relational database instance, including engine selection (MySQL), allocated storage, and backup settings. This resource type supports all RDS engines and is the standard way to provision RDS databases via CloudFormation. Option A is correct because `AWS::RDS::DBInstance` is the appropriate resource for creating an RDS MySQL instance. Option B is incorrect because `AWS::DynamoDB::Table` is for Amazon DynamoDB, a NoSQL database service, not a relational MySQL database. Option C is incorrect because `AWS::AppStream::DirectoryConfig` is used for Amazon AppStream 2.0 directory configuration, unrelated to RDS. Option D is incorrect because `AWS::Redshift::Cluster` is for Amazon Redshift, a data warehouse service, not a relational MySQL database.

Answer

AWS::DynamoDB::Table

Answer

AWS::AppStream::DirectoryConfig

Answer

AWS::Redshift::Cluster

Question 15

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB) in a single Availability Zone. The application stores session data in an RDS MySQL DB instance. To improve reliability, the company wants to deploy the application across multiple Availability Zones. Which combination of actions should the company take to achieve this? (Choose the correct course of action.)

Accepted Answer

Deploy EC2 instances in two Availability Zones and place them behind an Application Load Balancer. Enable Multi-AZ for the RDS MySQL DB instance.. Deploying EC2 instances across two Availability Zones behind an Application Load Balancer (ALB) provides high availability for the web tier, while enabling Multi-AZ for RDS MySQL ensures synchronous replication to a standby instance in a different AZ, providing automatic failover and data durability. This combination addresses the requirement to improve reliability by eliminating single points of failure at both the compute and database layers.

Answer

Deploy EC2 instances in a single Availability Zone behind an Application Load Balancer. Enable Multi-AZ for the RDS MySQL DB instance.

Answer

Deploy EC2 instances in two Availability Zones and place them behind a Network Load Balancer. Keep RDS MySQL as a single-AZ deployment.

Answer

Deploy EC2 instances in two Availability Zones. Configure an RDS MySQL Read Replica in a second Availability Zone and route read traffic to it.

Question 16

Which TWO options are best practices for automating deployments using AWS CodeDeploy? (Choose two.)

Accepted Answer

Use a blue/green deployment strategy. A blue/green deployment strategy minimizes downtime and risk by running two identical environments (blue for current, green for new) and shifting traffic after validation. This approach allows instant rollback by switching traffic back to the blue environment if issues arise, making it a best practice for critical production deployments.

Answer

Use a single deployment group for all environments

Answer

Deploy to all instances simultaneously

Answer

Require manual approval for every deployment

Question 17

Drag and drop the steps to set up an AWS Site-to-Site VPN connection into the correct order.

Accepted Answer

Create and attach virtual private gateway, then define customer gateway, then create VPN connection, then configure on-premises router, then verify tunnel. First create and attach the virtual private gateway, then define the customer gateway, then create the VPN connection, configure the on-premises router, and verify the tunnel.

Answer

Define customer gateway, then create and attach virtual private gateway, then create VPN connection, then configure on-premises router, then verify tunnel

Answer

Create and attach virtual private gateway, then create VPN connection, then define customer gateway, then configure on-premises router, then verify tunnel

Answer

Create and attach virtual private gateway, then define customer gateway, then configure on-premises router, then create VPN connection, then verify tunnel

Question 18

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) across three Availability Zones. The application stores session data in memory on the EC2 instances. During a deployment, a new version of the application is released by terminating and replacing instances. Users report that they are unexpectedly logged out during the deployment. What should a SysOps administrator do to improve the reliability of the application during deployments?

Accepted Answer

Use an ElastiCache cluster to store session state externally.. Storing session state externally in an ElastiCache cluster decouples session data from individual EC2 instances. When instances are terminated and replaced during deployment, the new instances can retrieve session state from the shared ElastiCache cluster, preventing users from being logged out. This approach ensures that session data persists independently of the EC2 instance lifecycle, maintaining application reliability during rolling updates.

Answer

Reduce the deployment to a single Availability Zone to minimize instance churn.

Answer

Store session data in an RDS Multi-AZ database.

Answer

Enable sticky sessions (session affinity) on the ALB.

Question 19

A company runs a stateless web application on EC2 instances behind an Application Load Balancer. The company wants to improve the application's availability and fault tolerance. Which TWO actions should the SysOps administrator take?

Accepted Answer

Configure Auto Scaling to maintain a minimum number of instances.. Auto Scaling can maintain a minimum number of EC2 instances, ensuring that if an instance fails, a replacement is automatically launched to keep the application running. This directly improves availability by providing automatic recovery from instance failures without manual intervention.

Answer

Use Amazon CloudFront as an origin for the ALB.

Answer

Disable termination protection on EC2 instances.

Answer

Use larger EC2 instance types.

Question 20

A company has an Amazon RDS for PostgreSQL DB instance with Multi-AZ deployment in us-east-1. The SysOps administrator must design a disaster recovery strategy to recover from a regional outage. The Recovery Time Objective (RTO) is 1 hour and the Recovery Point Objective (RPO) is 5 minutes. Which solution meets these requirements at the lowest cost?

Accepted Answer

Create a Read Replica in a different region and promote it during a disaster.. A cross-region Read Replica meets the RPO of 5 minutes because replication is continuous (asynchronous) with minimal lag, and the RTO of 1 hour is achievable by promoting the replica during a disaster. This is the lowest-cost option because it uses a single standby instance in another region without the overhead of a full Multi-AZ deployment or frequent snapshot transfers.

Answer

Take daily snapshots and copy them to another region.

Answer

Use cross-region automated backups.

Answer

Deploy a second Multi-AZ DB instance in another region.