SOA-C02 Practice Exam 64 — 20 Questions

Question 1

A company runs a web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group. The SysOps administrator wants to ensure that the application can handle a sudden increase in traffic without downtime. Which THREE actions should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Auto Scaling group to launch instances in multiple Availability Zones.. Launching instances in multiple Availability Zones (AZs) ensures high availability and fault tolerance. If one AZ experiences a failure, the Auto Scaling group can still serve traffic from instances in other AZs, preventing downtime during sudden traffic spikes or infrastructure issues.

Answer

Configure a scheduled scaling policy to add instances during known peak hours.

Answer

Use Spot Instances to reduce costs.

Question 2

A SysOps administrator needs to deploy a CloudFormation stack across multiple AWS accounts in an organization using AWS Organizations. The administrator wants to use a single template and a single deployment operation. Which AWS service should be used to centrally manage the deployment?

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple AWS accounts and regions with a single operation. It is designed for centralized management of stacks in an organization, leveraging AWS Organizations for automatic deployment to member accounts. This meets the requirement of using one template and one deployment operation across multiple accounts.

Answer

AWS Systems Manager

Answer

AWS OpsWorks Stacks

Answer

AWS CodePipeline

Question 3

A company needs to deploy a new version of an application to an Auto Scaling group. The deployment must ensure that the new version is deployed to all instances, and if any instance fails, the deployment should roll back. Which deployment strategy should be used?

Accepted Answer

Rolling deployment with rollback. A rolling deployment with rollback is the correct choice because it updates instances incrementally, replacing the old version with the new one across the Auto Scaling group while monitoring for failures. If any instance fails to become healthy (e.g., failing an ELB health check), the deployment automatically rolls back to the previous version, ensuring no partial or failed deployment persists. This strategy balances safety and speed, directly meeting the requirement to deploy to all instances with automatic rollback on failure.

Answer

Blue/green deployment

Answer

All-at-once deployment

Answer

Canary deployment

Question 4

An application logs user authentication attempts to Amazon CloudWatch Logs. The SysOps administrator needs to create a custom metric that counts the number of failed authentication attempts every 5 minutes and trigger an alarm when the count exceeds 5. Which combination of actions should the administrator take?

Accepted Answer

Create a metric filter on the log group for the string 'FAILED_AUTH', set the metric value to 1, then create an alarm on the resulting metric.. CloudWatch Logs metric filters allow you to extract a numeric value from log events and publish it as a custom metric. By creating a filter that matches the string 'FAILED_AUTH' and setting the metric value to 1, each failed attempt increments the metric. You can then set the metric's period to 5 minutes and create an alarm that triggers when the sum exceeds 5, meeting the requirement without modifying the application code.

Answer

Use the PutMetricData API in the application to publish the number of failed attempts as a custom metric, then create an alarm.

Answer

Use AWS CloudTrail to track authentication events and create a metric filter on the CloudTrail log group.

Answer

Use Amazon Athena to query the logs every 5 minutes and publish results to a CloudWatch metric.

Question 5

A SysOps administrator needs to analyze application logs stored in Amazon CloudWatch Logs to find specific error patterns across multiple log groups. The administrator wants to run queries to filter and parse the logs. Which feature should the administrator use?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is the correct feature because it enables you to interactively search and analyze log data stored in CloudWatch Logs using a purpose-built query language. It allows you to run queries across multiple log groups, filter, parse, and aggregate logs to identify specific error patterns, making it ideal for ad-hoc log analysis and troubleshooting.

Answer

CloudWatch Logs subscriptions

Answer

CloudWatch Metric Filters

Answer

CloudWatch Contributor Insights

Question 6

A company wants to provide low-latency access to a web application for users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. Which AWS service should be used to route users to the nearest region?

Accepted Answer

Amazon Route 53 with latency-based routing. Amazon Route 53 with latency-based routing directs user traffic to the AWS region that provides the lowest latency for the end user. By configuring latency records for the EC2 instances in us-east-1 and eu-west-1, Route 53 responds to DNS queries with the IP address of the region that offers the best network performance, effectively routing users to the nearest region.

Answer

Application Load Balancer with cross-region load balancing

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 7

A company uses CloudWatch Logs to monitor application logs. The SysOps administrator wants to search for specific error patterns across multiple log groups. Which THREE AWS services can be used to achieve this?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is correct because it is a native AWS service designed specifically for querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) across multiple log groups to search for specific error patterns, making it a direct and efficient solution for this use case without requiring data export or additional infrastructure.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group. The SysOps administrator wants to ensure that the application can handle a sudden increase in traffic without downtime. Which THREE actions should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The target instances are not passing health checks.. A 502 Bad Gateway error from an ALB occurs when the load balancer cannot successfully forward a request to a healthy target. If the target group has unhealthy targets, the ALB may have no healthy targets to route to, resulting in 502 errors. The most likely cause is that the target instances are failing health checks, so the ALB marks them as unhealthy and cannot serve requests.

Answer

The SSL certificate on the ALB is expired.

Answer

The ALB does not have enough capacity to handle the traffic.

Answer

The client request exceeds the idle timeout.

Question 9

A company runs a critical database on an Amazon RDS for MySQL DB instance. The SysOps administrator needs to ensure that the database can survive a single Availability Zone failure with minimal downtime. Which configuration should the administrator implement?

Accepted Answer

Enable Multi-AZ deployment.. Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, minimizing downtime without manual intervention. This meets the requirement for surviving a single AZ failure with minimal downtime.

Answer

Enable automatic backups.

Answer

Deploy a read replica in a different AZ.

Answer

Take a manual snapshot and copy it to another AZ.

Question 10

An application uploads files to an S3 bucket. The SysOps administrator needs to ensure that the files are automatically replicated to another bucket in a different AWS Region for disaster recovery. Which action should be taken?

Accepted Answer

Enable Cross-Region Replication on the source bucket.. Cross-Region Replication (CRR) is the correct AWS feature to automatically replicate objects from a source S3 bucket to a destination bucket in a different AWS Region. CRR requires versioning to be enabled on both the source and destination buckets, and it copies every object uploaded to the source bucket asynchronously to the destination bucket, providing disaster recovery across regions.

Answer

Use S3 Transfer Acceleration for faster uploads.

Answer

Enable versioning on the source bucket.

Answer

Configure a lifecycle policy to transition objects to Glacier.

Question 11

A company runs a mix of Amazon EC2 instances and AWS Fargate tasks that are used for both production and development workloads. The usage is steady and predictable. The SysOps administrator wants to maximize cost savings across both compute services without having to manage specific instances or sizes. Which purchasing option should the administrator recommend?

Accepted Answer

Purchase Compute Savings Plans for a 1-year or 3-year term with a commitment that covers the expected compute spend.. Compute Savings Plans offer the most flexibility, automatically applying to EC2 instances (regardless of instance family, size, or region) and Fargate tasks. Since the company has a mix of both services and wants to maximize savings without managing specific instances or sizes, a 1-year or 3-term Compute Savings Plan with a commitment matching expected spend provides up to 66% savings while covering all compute usage. This aligns with the steady and predictable workload described.

Answer

Purchase EC2 Instance Savings Plans for the most commonly used instance family and region.

Answer

Purchase Standard Reserved Instances for the EC2 instances and convert Fargate tasks to use Spot Instances.

Answer

Use On-Demand instances for both EC2 and Fargate because the administrator does not want to make a commitment.

Question 12

Refer to the exhibit. An IAM policy allows a user to run instances only of type t2.micro. What happens when the user tries to run a t2.small instance?

Accepted Answer

The request is denied because t2.small does not match the condition.. The IAM policy includes a condition that restricts ec2:RunInstances to the t2.micro instance type. When the user attempts to launch a t2.small instance, the condition evaluates to false, so the statement does not apply and the request is implicitly denied. IAM policies are deny-by-default, so the absence of an allow results in denial.

Answer

The request is allowed because the policy allows ec2:RunInstances.

Answer

The request is denied because there is an explicit deny on ec2:RunInstances.

Answer

The request is allowed because the condition only applies to the resource ARN, not the instance type.

Question 13

Which TWO options are valid ways to send custom metrics to Amazon CloudWatch?

Accepted Answer

Use the CloudWatch agent to collect and publish custom metrics.. The CloudWatch agent can be installed on EC2 instances or on-premises servers to collect system-level metrics (like memory and disk usage) and custom application metrics, then publish them to CloudWatch. Option B is correct because the PutMetricData API call allows direct programmatic ingestion of custom metrics into CloudWatch, supporting up to 1,000 metrics per call with a maximum payload of 1 MB.

Answer

Use Amazon SQS to send metric data to CloudWatch.

Answer

Use AWS CloudTrail to log custom metrics.

Answer

Use Amazon Kinesis Data Firehose to deliver metrics to CloudWatch.

Question 14

A company wants to enforce that all Amazon EC2 instances launched in the AWS account must have a specific termination protection setting enabled. The SysOps administrator needs to automatically remediate any instances that are launched without termination protection. Which AWS service should be used to achieve this?

Accepted Answer

AWS Config with a custom rule using AWS Lambda to evaluate and enable termination protection.. AWS Config can evaluate resources against desired configurations using managed or custom rules. A custom AWS Config rule can invoke a Lambda function to check if termination protection is enabled on EC2 instances and automatically enable it if missing, providing the required remediation. This approach directly addresses the requirement to enforce termination protection on all launched instances.

Answer

AWS Config with a managed rule ec2-instance-no-public-ip and an SSM Automation remediation.

Answer

Amazon Inspector to scan instances and trigger a remediation action.

Answer

AWS Systems Manager Patch Manager to apply a policy for termination protection.

Question 15

Refer to the exhibit. A security group is attached to an Application Load Balancer (ALB) that serves HTTPS traffic on port 443. Users can access the application via HTTPS. However, the ALB's health checks to targets on port 80 are failing. What is the reason?

Accepted Answer

The security group for the target instances does not allow HTTP traffic from the ALB's security group.. ALB health checks originate from the ALB's nodes and are sent to the target's health-check port (here port 80/HTTP). For the check to succeed, the target instance's security group must allow inbound HTTP from the ALB's security group. Since users can reach the app over HTTPS on 443, the ALB listener and its security group are fine — the failure is on the target-side SG not permitting the health-check traffic.

Answer

The ALB's security group does not allow HTTPS traffic from the internet.

Answer

The ALB's security group does not allow HTTP traffic from the target's IP range.

Answer

The health check is configured to use HTTPS, but the target only supports HTTP.

Question 16

A SysOps administrator is designing a disaster recovery plan for a critical RDS MySQL database. The database must be available with a Recovery Point Objective (RPO) of less than 1 hour and a Recovery Time Objective (RTO) of less than 2 hours. The primary region is us-east-1. Which solution meets these requirements?

Accepted Answer

Create a cross-Region read replica in us-west-2 and promote it during a disaster. A cross-Region read replica in us-west-2 can be promoted to a standalone primary database in under 2 hours, and the replication lag is typically less than 1 hour, meeting both RPO and RTO requirements. This solution provides continuous asynchronous replication from the primary region, ensuring minimal data loss and fast failover without needing to restore from backups.

Answer

Enable Multi-AZ deployment in the primary region

Answer

Enable automated backups and restore to a new region when needed

Answer

Take daily manual snapshots and copy them to another region

Question 17

A company uses AWS CloudFormation to deploy a three-tier web application. The SysOps administrator wants to update a critical parameter, such as the instance type, and ensure that the change is applied without recreating the EC2 instance, if possible. Which CloudFormation stack update feature should be used to achieve this?

Accepted Answer

Change sets. Change sets allow you to preview the changes that will be made to your stack resources before executing them. For an update that modifies an instance type, the change set will show whether the change causes replacement. In this case, AWS::EC2::Instance does not support in-place updates for InstanceType and will require replacement, so the change set would confirm that. By using a change set, you can review the impact before applying the update.

Answer

Stack policy

Answer

Update with drift detection

Answer

Directly edit the stack template and use the update stack action

Question 18

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and send an alert when it exceeds 90% for 5 consecutive minutes. Which combination of AWS services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch metric (CPUUtilization), a CloudWatch alarm, and an Amazon SNS topic.. The correct approach is to use a CloudWatch metric for CPUUtilization, which is automatically published by EC2 instances. A CloudWatch alarm can be configured to evaluate this metric over a period of 5 consecutive minutes with a threshold of 90%, and when the alarm state is triggered, it publishes to an SNS topic to send notifications. This is the native, efficient, and recommended method for monitoring and alerting on EC2 CPU utilization.

Answer

Amazon CloudWatch Logs, a metric filter to extract CPU utilization from logs, and an alarm on that metric.

Answer

A CloudWatch dashboard and an AWS Lambda function that checks the dashboard periodically.

Answer

Amazon EventBridge (CloudWatch Events) and a Lambda function that calls the EC2 DescribeInstances API.

Question 19

A company runs a web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group. The SysOps administrator wants to ensure that the application can handle a sudden increase in traffic without downtime. Which THREE actions should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ALB and the CloudWatch alarm are in different AWS Regions.. CloudWatch alarms can only evaluate metrics from the same AWS Region in which the alarm is created. If the ALB and the CloudWatch alarm are in different Regions, the alarm will never receive metric data points, causing it to remain in INSUFFICIENT_DATA state. This is a common cross-Region limitation for CloudWatch metrics.

Answer

The HTTPCode_ELB_5XX_Count metric is not available for ALBs.

Answer

The IAM role for CloudWatch does not have permission to read the ALB metrics.

Answer

The alarm's period is set to 1 minute, but the metric is published every 5 minutes.

Question 20

A SysOps administrator needs to deploy a set of AWS Lambda functions and an Amazon API Gateway API using infrastructure as code. The administrator wants to manage the deployment across multiple environments (dev, test, prod) with consistent resource configurations. Which AWS service should the administrator use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an Infrastructure as Code (IaC) service that allows you to define and provision AWS resources, including Lambda functions and API Gateway APIs, using templates. It supports managing deployments across multiple environments (dev, test, prod) by using parameters, mappings, and stacks, ensuring consistent resource configurations through repeatable, version-controlled templates.

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks