SOA-C02 Practice Exam 65 — 20 Questions

Question 1

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered using a VPC Peering connection. The instances in VPC A can ping the private IP of instances in VPC B, but not the DNS names. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC Peering connection does not have 'Enable DNS Resolution' enabled.. The 'Enable DNS Resolution' setting on a VPC Peering connection allows instances in one VPC to resolve the private DNS hostnames of instances in the peered VPC. Without this setting enabled, the DNS resolver in the requester VPC will not return the private IP of the peered instance, causing DNS name resolution to fail even though direct ICMP (ping) to the private IP works. This setting must be enabled on both sides of the peering connection for cross-VPC DNS resolution to function.

Answer

The route tables in VPC A do not have a route to VPC B's CIDR.

Answer

The security groups in VPC B block DNS traffic (port 53).

Answer

The VPCs have overlapping CIDR blocks.

Question 2

A SysOps administrator manages a CloudFormation stack that deploys a web application. The stack includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to update the stack to change the EC2 instance type. The administrator wants to ensure that the update does not accidentally replace the RDS database. Which CloudFormation feature should the administrator use to protect the RDS resource from being replaced during the stack update?

Accepted Answer

Use a stack policy that denies updates to the RDS resource.. A stack policy is an AWS CloudFormation feature that explicitly denies update or replacement actions on specified resources. By applying a stack policy that denies updates to the RDS resource, the administrator prevents any stack update operation (including changing the EC2 instance type) from modifying or replacing the database, even if the template changes would otherwise affect it. This is the correct approach because it provides a guardrail specifically against accidental replacement during updates.

Answer

Use a DeletionPolicy of Retain on the RDS resource.

Answer

Use the Resource Signal and CreationPolicy attributes.

Answer

Use a Change Set to review changes before executing.

Question 3

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. The most common cause of private instances failing to reach the internet via a NAT Gateway is a missing or incorrect route in the private subnet's route table. The private subnet must have a route for 0.0.0.0/0 pointing to the NAT Gateway; otherwise, traffic has no path out. This is the first thing to verify because it is the fundamental routing requirement for NAT Gateway functionality.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.

Question 4

Which TWO features are provided by Amazon CloudFront to secure content delivery? (Choose two.)

Accepted Answer

AWS WAF integration to filter requests based on rules. AWS WAF can be associated with a CloudFront distribution to filter incoming HTTP(S) requests based on rules such as IP addresses, HTTP headers, URI strings, or SQL injection patterns. This allows you to block malicious traffic at the edge before it reaches your origin, providing a layer of security for content delivery.

Answer

Default support for custom SSL certificates without additional configuration

Answer

AWS Shield Advanced for DDoS protection

Answer

VPN connection between CloudFront and the origin

Question 5

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The SysOps administrator checks the deployment logs and finds that the application installation script exits with a non-zero exit code. What is the MOST likely cause?

Accepted Answer

The AppSpec file contains a lifecycle hook that fails.. A non-zero exit code from an AppSpec lifecycle hook (e.g., ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService) during the deployment process causes the overall deployment to fail. The error message indicates that individual instances failed deployment, and the installation script exiting with a non-zero exit code is a direct sign of a lifecycle hook failure. Option A is incorrect because insufficient instances in the Auto Scaling group would trigger a different error related to minimum capacity, not a script exit code. Option B is incorrect because the security group blocking outbound traffic would prevent the CodeDeploy agent from communicating with the service, resulting in a connection error, not a script exit code issue. Option D is incorrect because an outdated CodeDeploy agent would typically produce agent-specific errors or version mismatch warnings, not a non-zero exit code from the installation script.

Answer

The Auto Scaling group does not have enough instances to meet the minimum capacity.

Answer

The security group for the instances blocks outbound traffic to CodeDeploy endpoints.

Answer

The CodeDeploy agent is outdated on the instances.

Question 6

A SysOps administrator is investigating a security incident where an EC2 instance was used to launch an attack. The administrator needs to determine the source IP addresses that were used to access the instance prior to the attack. Which AWS service and feature should be used to capture this information?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including the source IP address, destination IP address, port, protocol, and timestamps. This allows the administrator to identify the source IP addresses that accessed the EC2 instance prior to the attack, as the logs record all accepted and rejected traffic at the network interface level.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail with data events enabled for EC2

Answer

AWS Config with recording of security groups

Question 7

A company has an S3 bucket that stores millions of small objects (1-10 KB) and uses S3 Standard storage. The bucket receives frequent PUT requests and occasional GET requests. The monthly bill shows high costs for S3 PUT requests. Which action would reduce costs?

Accepted Answer

Aggregate small objects into larger files (e.g., 1 MB) before uploading to S3.. S3 PUT request charges are per-request, so uploading millions of tiny objects incurs millions of PUT charges. Aggregating small objects into larger files (e.g., 1 MB) before upload dramatically reduces the number of PUT requests and therefore the request cost. This directly targets the line item the bill shows as high.

Answer

Move the objects to S3 Glacier Deep Archive to reduce storage cost.

Answer

Move the objects to S3 Intelligent-Tiering to optimize storage costs.

Answer

Use S3 Lifecycle policies to transition objects to S3 Standard-IA after 30 days.

Question 8

A company runs a production web application on AWS using Auto Scaling groups (ASGs) behind an Application Load Balancer (ALB). The application state is stored in an Amazon RDS for MySQL Multi-AZ DB instance. The application experiences periodic traffic spikes, and the current ASG uses a simple scaling policy based on average CPU utilization. Recently, during a spike, the application became unresponsive for several minutes. The CloudWatch metrics show that the CPU utilization on the RDS instance peaked at 80%, and the DB Connections metric reached the maximum allowed. The read replica lag increased to over 10 seconds during the spike. The web servers are stateless and scale out quickly. The operations team needs to improve the reliability and performance of the application to handle future spikes. Which solution should the team implement?

Accepted Answer

Increase the DB instance size to a larger instance class and implement an Amazon ElastiCache cluster to cache frequent database queries.. The RDS instance is hitting connection limits and high CPU, causing unresponsiveness. Increasing the DB instance size provides more CPU and memory, allowing it to handle more connections and process queries faster. Adding an ElastiCache cluster offloads frequent read queries from the database, reducing the load on RDS. This combination addresses both the connection exhaustion and CPU bottleneck, improving performance during spikes.

Answer

Increase the desired capacity of the ASG and add more read replicas to distribute the database load.

Answer

Migrate the database to Amazon DynamoDB with auto scaling and rewrite the application to use a serverless architecture with AWS Lambda.

Answer

Reduce the maximum connections parameter on the RDS instance to prevent connection exhaustion and modify the application code to reduce the number of database queries.

Question 9

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered using a VPC Peering connection. The instances in VPC A can ping the private IP of instances in VPC B, but not the DNS names. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement RDS Read Replicas to offload read traffic.. Implementing RDS Read Replicas offloads read traffic from the primary instance to one or more replicas, reducing CPU utilization on the primary. This improves performance for read-heavy applications and can also reduce costs because you can potentially use a smaller primary instance or fewer replicas than scaling up the primary. Read Replicas are asynchronous and can be in different AZs or regions.

Answer

Delete unused indexes from the database.

Answer

Increase the allocated storage size.

Answer

Enable Multi-AZ deployment for failover support.

Question 10

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to ensure that the application stack can be recreated in another AWS Region in the event of a disaster. The stack includes an RDS MySQL database and an EC2 instance running a web server. The administrator wants to automate the backup of the RDS database and the EC2 instance configuration. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Backup to create backup plans that include the RDS instance and EC2 instance, and copy backups to the secondary region.. AWS Backup provides a centralized, automated way to create backup plans that include both RDS and EC2 instances, and it supports cross-region backup copies. This meets the requirement to automate backups and ensure they are available in a secondary region for disaster recovery. It is the most efficient because it eliminates manual scripting and snapshot management.

Answer

Use S3 to store database dump files and instance configuration scripts.

Answer

Create manual snapshots of the RDS database and EC2 instance every day and copy them to the secondary region.

Answer

Store the CloudFormation template in S3 and use it to recreate the stack in the secondary region.

Question 11

A company has two VPCs in different AWS regions (us-east-1 and eu-west-1) that are peered. Applications in both VPCs need to communicate using private IP addresses. The ping tests are successful, but the latency is significantly higher than expected. Which change is most likely to improve the latency between the VPCs?

Accepted Answer

Enable DNS resolution for the VPC peering connection.. Enabling DNS resolution for the VPC peering connection allows instances to resolve public DNS hostnames to the private IP addresses of the peered VPC. Without this, DNS queries may return public IP addresses, forcing traffic to traverse the internet or NAT gateways, which adds significant latency. By resolving to private IPs, traffic stays within the AWS backbone, reducing latency.

Answer

Use a Transit Gateway instead of VPC Peering for cross-region connectivity.

Answer

Increase the MTU on the instances' network interfaces to 9001.

Answer

Configure ECMP (Equal-Cost Multi-Path) routing on the VPC peering connection.

Question 12

A SysOps administrator is investigating a security incident and needs to determine who deleted an S3 bucket. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across AWS services, including S3 bucket deletion events. When a user or role deletes an S3 bucket, CloudTrail logs the `DeleteBucket` API call with details such as the IAM user or role, source IP address, and timestamp, enabling the administrator to identify the responsible entity.

Answer

AWS Trusted Advisor

Answer

S3 server access logs

Answer

CloudWatch Logs for the S3 service

Question 13

A company has a single AWS account with multiple IAM users. The security team wants to ensure that no IAM user can create or modify VPC resources. The SysOps administrator creates a managed policy that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions. The policy is attached to all IAM users via a group. However, after a week, a user reports that they were able to create a VPC. The administrator checks CloudTrail and confirms that the user created the VPC. What is the most likely cause?

Accepted Answer

The user created the VPC using AWS CloudFormation with a service role that had full EC2 access.. The most likely cause is that the user created the VPC using AWS CloudFormation with a service role that had full EC2 access (including ec2:CreateVpc). IAM policies applied to a user do not affect actions taken by AWS services like CloudFormation when a service role is used, because the service role itself grants permissions. Even though the user's group policy denies VPC creation, the CloudFormation service role bypasses the user's IAM policies. This is a known pitfall: service roles can allow users to perform actions that their own IAM policies deny, if they have permission to pass the role.

Answer

The user used the AWS Management Console, which does not enforce IAM policies.

Answer

The user had an inline policy that allowed ec2:CreateVpc, overriding the group policy.

Answer

The policy was attached to the user's group, but the user was not a member of that group.

Question 14

A company runs a critical application on EC2 instances in an Auto Scaling group. The group uses a dynamic scaling policy based on CPU utilization. The SysOps administrator wants to ensure that the application remains available during a planned maintenance event that will take down one of the Availability Zones. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Update the Auto Scaling group to remove the affected Availability Zone from the list of enabled AZs.. Removing the affected Availability Zone from the Auto Scaling group prevents the group from launching new instances in a zone that will become unavailable during maintenance. This ensures that any new instances are launched only in the remaining healthy Availability Zones, maintaining application availability. Option C is correct because increasing the desired capacity temporarily compensates for the instances that will be terminated or become unreachable in the affected zone, ensuring the group has enough running instances to handle the load.

Answer

Manually terminate all instances in the affected Availability Zone.

Answer

Create a new launch configuration with a different AMI.

Answer

Disable the dynamic scaling policy to prevent scaling.

Question 15

An EC2 Auto Scaling group runs a stateless web application with predictable daily peaks. Which two actions can reduce cost while preserving capacity during peak periods? (Choose 2.)

Accepted Answer

Configure scheduled scaling actions for the known peak window.. Scheduled scaling allows you to proactively increase capacity before the predictable daily peak and reduce it afterward, ensuring you only pay for the resources needed during the peak window. This avoids over-provisioning for the entire day, directly reducing costs while maintaining performance during high-demand periods.

Answer

Run all instances as On-Demand at maximum peak size all day.

Answer

Disable health checks to avoid instance replacement.

Question 16

A company is using Amazon S3 to store data for analytics. The data is accessed frequently for the first 30 days, then rarely after that. The company wants to optimize storage costs. Which THREE actions should the SysOps administrator recommend?

Accepted Answer

Use S3 Intelligent-Tiering to automatically optimize storage costs.. The correct actions are A, C, D. Option A: S3 Intelligent-Tiering automatically moves data between tiers based on access patterns, optimizing costs for data with changing access patterns. Option C: A lifecycle policy to transition objects to S3 Glacier Deep Archive after 90 days is appropriate for data that is rarely accessed after the initial 30 days. Option D: A lifecycle policy to transition objects to S3 Standard-IA after 30 days is a good cost-saving measure for data that is accessed infrequently after the first 30 days. Option B is incorrect because S3 One Zone-IA is not durable enough for analytics data that may need availability, and it does not automatically optimize costs like Intelligent-Tiering. Option E is incorrect because using S3 Standard for all data would be more expensive than using the lifecycle policies or Intelligent-Tiering.

Answer

Use S3 One Zone-IA for all data after 30 days to reduce costs.

Answer

Use S3 Standard storage for all data to ensure high performance.

Question 17

A company is using Amazon Route 53 for DNS and wants to route traffic to multiple endpoints based on the geographic location of the user. Which routing policy should the SysOps Administrator use?

Accepted Answer

Geolocation routing. Geolocation routing (Option A) is correct because it allows Route 53 to route traffic based on the geographic location of the DNS query's source IP address. This is ideal for scenarios where you need to direct users to specific endpoints based on their country, continent, or even US state, such as complying with data sovereignty laws or delivering localized content.

Answer

Weighted routing

Answer

Failover routing

Answer

Latency routing

Question 18

A company runs a critical web application on a single Amazon EC2 instance with a 100 GiB gp2 EBS volume. The SysOps administrator needs to ensure data durability by taking automated snapshots of the root volume every hour. The snapshots should be retained for 7 days. Which AWS service can be used to automate this task with minimal configuration?

Accepted Answer

Amazon Data Lifecycle Manager (DLM). Amazon Data Lifecycle Manager (DLM) is the correct choice because it is specifically designed to automate the creation, retention, and deletion of EBS snapshots with minimal configuration. It supports custom schedules (e.g., every hour) and retention policies (e.g., 7 days) directly on EBS volumes, making it ideal for this task without requiring additional scripting or infrastructure.

Answer

AWS Backup

Answer

Amazon CloudWatch Events

Answer

AWS Systems Manager

Question 19

A SysOps Administrator attempted to update a CloudFormation stack. The stack update failed and is now in UPDATE_ROLLBACK_IN_PROGRESS state as shown in the exhibit. What should the administrator do to recover the stack to a stable state?

Accepted Answer

Wait for the rollback to complete and then investigate the failure reason.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_IN_PROGRESS, AWS CloudFormation is automatically rolling back the stack to its last known stable state. The administrator should wait for this rollback to complete, which will result in the stack returning to UPDATE_ROLLBACK_COMPLETE (or UPDATE_ROLLBACK_FAILED if rollback fails). After that, they can investigate the failure reason using stack events and then retry the update with corrections.

Answer

Delete the stack and recreate it.

Answer

Manually update the Auto Scaling group to correct the issue.

Answer

Execute a change set to fix the failed resource.

Question 20

A company runs a production Amazon DynamoDB table with provisioned capacity of 1000 write capacity units (WCU). The table experiences unpredictable spikes up to 2000 WCU, causing throttling. The SysOps administrator wants to minimize cost while handling the spikes. Which solution should be used?

Accepted Answer

Switch to on-demand capacity mode.. Switching to on-demand capacity mode eliminates throttling during unpredictable spikes by automatically scaling write capacity up to the required 2000 WCU without any manual intervention or pre-provisioning. This minimizes cost because you pay only for the actual reads and writes consumed, avoiding the fixed cost of over-provisioning for peak capacity that may be rarely used.

Answer

Increase provisioned WCU to 2000 to cover the peak.

Answer

Enable DynamoDB Auto Scaling with minimum 1000, maximum 2000 WCU.

Answer

Use a DynamoDB Accelerator (DAX) cache.