SOA-C02 Practice Exam 66 — 20 Questions

Question 1

A company runs a critical web application on EC2 instances behind an ALB. The application experiences unpredictable traffic spikes. The SysOps administrator wants to ensure that the application can handle spikes without performance degradation while minimizing costs. Which TWO actions should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a mix of On-Demand and Spot Instances in the Auto Scaling group.. Spot Instances can reduce costs if the application can handle interruptions. Option D is correct because target tracking scaling adjusts capacity based on load. Option B is wrong because DynamoDB auto scaling is not relevant for EC2. Option C is wrong because scheduled scaling cannot handle unpredictable spikes. Option E is wrong because increasing instance size may not be as cost-effective as scaling out.

Answer

Use Amazon DynamoDB auto scaling to handle the spikes.

Answer

Use scheduled scaling to add instances during expected peak hours.

Answer

Use larger EC2 instance types to handle spikes.

Question 2

A SysOps administrator needs to track changes to security group rules in a VPC. Which AWS services can be used to monitor and log these changes? (Choose TWO.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to the Amazon EC2 service, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and CreateSecurityGroup. These events capture the identity, source IP, and timestamp of every change to security group rules, providing an audit trail for compliance and troubleshooting.

Answer

VPC Flow Logs.

Answer

AWS Trusted Advisor.

Answer

Amazon CloudWatch Logs.

Question 3

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances in the Auto Scaling group are not registered with the target group of an Application Load Balancer. The SysOps administrator needs to ensure that new instances launched by the Auto Scaling group are automatically registered with the target group. What should the administrator do?

Accepted Answer

Attach the target group to the Auto Scaling group.. To ensure that instances launched by an Auto Scaling group are automatically registered with an Application Load Balancer target group, the target group must be attached to the Auto Scaling group. This is done by specifying the target group ARN in the Auto Scaling group's configuration (via the console, CLI, or CloudFormation). When attached, the Auto Scaling group automatically registers new instances with the target group and deregisters terminated ones.

Answer

Use Amazon Inspector to automatically register instances with the target group.

Answer

Create a lifecycle hook in the Auto Scaling group to register instances with the target group.

Answer

Configure the Auto Scaling group to launch instances with a user data script that registers the instance with the target group.

Question 4

A company wants to automatically start and stop an EC2 instance on a schedule to reduce costs. The instance runs a critical application that must be available from 8 AM to 6 PM weekdays. Which AWS service should be used to implement this scheduling?

Accepted Answer

AWS Instance Scheduler. AWS Instance Scheduler is a purpose-built solution (deployed via CloudFormation) that uses Lambda, DynamoDB, and EventBridge to start and stop EC2 instances and RDS databases on customizable schedules. It supports period-based and schedule-based tagging, making it the correct choice for automatically starting/stopping an instance on a weekday 8 AM–6 PM schedule. The other services can be cobbled together to achieve scheduling, but none is designed specifically for this cost-optimization use case.

Answer

AWS OpsWorks

Answer

AWS Systems Manager Automation

Answer

AWS CloudFormation

Question 5

An organization needs to enforce that all Amazon EC2 instances launched in a specific AWS account are created from a baseline Amazon Machine Image (AMI) that includes required security patches. The AMI ID is ami-0abcdef1234567890. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use an IAM policy that denies the ec2:RunInstances action unless the AMI ID matches the approved one.. An IAM policy with a condition that denies ec2:RunInstances unless the AMI ID matches the approved one (ami-0abcdef1234567890) prevents non-compliant instances from being launched at all. This is the most efficient approach as it enforces the requirement proactively at the API level, avoiding the need for reactive detection or termination.

Answer

Use an AWS Config rule to mark non-compliant instances and automatically terminate them.

Answer

Use an AWS Lambda function that is triggered by EC2 launch events to terminate non-compliant instances.

Answer

Use AWS CloudTrail to monitor and alert on any instance launched with a different AMI.

Question 6

A SysOps administrator is troubleshooting a CloudFormation stack that failed to create. The stack includes an Amazon RDS DB instance. The error message indicates that the DB instance name already exists. The stack uses a parameter for the DB instance identifier. What should the administrator do to resolve this issue and create the stack?

Accepted Answer

Delete the failed stack, change the DB instance identifier parameter to a unique name, and recreate the stack.. When a CloudFormation stack creation fails due to a naming conflict (e.g., DB instance identifier already exists), the failed stack must be deleted because it cannot be updated or continued. Changing the parameter to a unique name and recreating the stack resolves the conflict. Option B is incorrect because, while deleting the conflicting DB instance would resolve the name conflict, the failed stack still exists and must be deleted before recreating the stack; in addition, deleting an existing DB instance is not the recommended approach — you should use a unique identifier. Option C is incorrect because `update-stack` cannot be applied to a failed stack creation; the stack is in a failed state and must be recreated. Option D is incorrect because `ContinueUpdateRollback` is used for update rollbacks, not for failed creations.

Answer

Manually delete the DB instance from the AWS Management Console and then retry the stack creation.

Answer

Use the AWS CLI command aws cloudformation update-stack with a new parameter value.

Answer

Execute ContinueUpdateRollback on the stack to retry the creation.

Question 7

A company hosts a critical web application on Amazon EC2 instances in a single AWS Region (us-east-1). The SysOps administrator needs to implement a Disaster Recovery (DR) solution using a different AWS Region (us-west-2). The DR plan requires a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The application uses an Amazon Aurora MySQL DB cluster and static assets stored in an Amazon S3 bucket. Which combination of actions should the administrator take to meet these requirements?

Accepted Answer

Create an Aurora cross-Region read replica in us-west-2. Configure S3 Cross-Region Replication from the source bucket to a destination bucket in us-west-2. During DR, promote the read replica to a primary cluster and update DNS.. Aurora cross-Region read replicas provide asynchronous replication with an RPO typically under 1 second, easily meeting the 15-minute RPO requirement. Promoting the read replica to a primary cluster in us-west-2 can be completed within minutes, satisfying the 1-hour RTO. S3 Cross-Region Replication (CRR) automatically replicates static assets to the destination bucket in us-west-2 with near-real-time latency, ensuring the S3 data is also current within the RPO window.

Answer

Take a manual snapshot of the Aurora DB cluster every 15 minutes and copy it to us-west-2. Use S3 batch operations to copy assets to us-west-2 daily.

Answer

Enable Aurora Multi-AZ in us-east-1 and configure S3 transfer acceleration to us-west-2.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to a DB instance in us-west-2. Use S3 versioning to keep previous object versions.

Question 8

A company's application running on EC2 instances is experiencing intermittent errors. The SysOps team needs to collect and analyze application logs from all instances centrally. The logs must be stored durably and searchable with minimal latency. Which solution meets these requirements?

Accepted Answer

Install the CloudWatch Logs agent on each EC2 instance and stream logs to Amazon CloudWatch Logs.. The CloudWatch Logs agent (or unified CloudWatch agent) installed on each EC2 instance can stream application logs in near real-time to Amazon CloudWatch Logs, which provides durable storage, automatic encryption at rest, and a searchable interface via the console, CLI, or API with minimal latency. This centralized logging solution meets the requirements for collecting logs from all instances, storing them durably, and enabling immediate querying without additional infrastructure.

Answer

Enable AWS CloudTrail and store logs in an S3 bucket.

Answer

Use Amazon Kinesis Data Firehose to send logs directly from each instance to Amazon Redshift.

Answer

Store logs locally on each instance and periodically copy them to Amazon S3.

Question 9

A company wants to protect its data in Amazon S3 from accidental deletion. Which TWO methods should the SysOps administrator use? (Choose TWO.)

Accepted Answer

Enable S3 Versioning on the bucket.. Enabling S3 Versioning preserves all versions of an object, including overwrites and deletes. When versioning is enabled, a delete operation does not permanently remove the object; instead, it adds a delete marker, allowing the object to be restored by removing the marker. This directly protects against accidental deletion.

Answer

Set up cross-Region replication.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure S3 event notifications.

Question 10

Refer to the exhibit. A SysOps administrator deployed the CloudFormation template. Which statement is true about data protection?

Accepted Answer

Deleted objects become noncurrent versions and are retained for 30 days.. The CloudFormation template likely configures an S3 bucket with versioning enabled and a lifecycle policy that transitions noncurrent versions to the 'ExpiredObjectDeleteMarker' or retains them for a specified period. By default, when versioning is enabled, deleted objects are not permanently removed but become noncurrent versions, and the lifecycle rule can be set to permanently delete these noncurrent versions after 30 days, as indicated in the template.

Answer

Deleted objects are immediately and permanently removed.

Answer

The bucket cannot be deleted by anyone.

Answer

Objects cannot be deleted from the bucket.

Question 11

A company runs a stateful application on EC2 instances behind a Network Load Balancer (NLB). The application uses sticky sessions (session affinity) to maintain client state. During a deployment, the SysOps administrator needs to replace instances without disrupting active sessions. Which approach should be used?

Accepted Answer

Deregister the old instances from the target group with connection draining enabled, then register new instances. Deregistering instances from the target group with connection draining enabled allows existing connections to complete gracefully before the instances are removed. The Network Load Balancer (NLB) continues to route new connections to the remaining healthy instances, and once draining finishes, new instances can be registered without disrupting active sessions. This approach maintains session affinity (sticky sessions) by ensuring that in-flight requests are completed before the instance is taken out of service.

Answer

Stop the NLB, replace instances, and restart the NLB

Answer

Update the target group health check to remove old instances faster

Answer

Terminate the old instances immediately and launch new ones

Question 12

A company uses AWS Organizations to manage multiple accounts. The security team wants to restrict all accounts from using specific AWS services unless explicitly allowed. Which feature should be used?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) in AWS Organizations define the maximum permissions for member accounts, allowing the security team to restrict which AWS services and actions are available across all accounts unless explicitly allowed. SCPs are applied at the organization, OU, or account level and act as a permissions guardrail that even account administrators cannot override.

Answer

Resource-based policies

Answer

IAM permissions boundaries

Answer

AWS Config rules

Question 13

An organization is using AWS CloudFormation to deploy infrastructure. The SysOps administrator needs to ensure that if a stack update fails, the stack automatically rolls back to the last known good state. Which stack update option should be configured?

Accepted Answer

Rollback on failure. CloudFormation's 'Rollback on failure' option, enabled by default, automatically reverts a stack to its last known good state if a stack update fails. This ensures that failed updates do not leave the infrastructure in an inconsistent or partially deployed state, maintaining reliability and business continuity.

Answer

Disable rollback

Answer

Change sets

Answer

Stack policy

Question 14

A company uses AWS OpsWorks to manage a stack of web servers. They need to deploy a configuration change that updates the /etc/nginx/nginx.conf file on all instances. Which OpsWorks feature should be used?

Accepted Answer

Custom Chef recipes. Custom Chef recipes are the correct choice because OpsWorks uses Chef to manage configuration, and deploying a specific file change like /etc/nginx/nginx.conf requires a custom recipe that directly modifies the file using Chef resources (e.g., template or file resource). This allows precise, idempotent configuration management across all instances in the stack.

Answer

OpsWorks layers

Answer

Lifecycle events

Answer

Custom cookbooks

Question 15

A company wants to ensure that only specific IAM roles within the same AWS account can encrypt and decrypt data using an AWS KMS customer managed key. Which type of policy must be configured to achieve this restriction?

Accepted Answer

KMS key policy. A KMS key policy is the primary mechanism to control access to a customer managed key. By default, a KMS key policy must explicitly grant the necessary permissions (kms:Encrypt, kms:Decrypt) to IAM roles, and it can restrict those permissions to specific roles within the same account using the `aws:PrincipalArn` condition key. This ensures that only the designated IAM roles can encrypt and decrypt data with that key.

Answer

IAM policy attached to the roles

Answer

Service control policy (SCP)

Answer

Resource policy attached to the KMS key

Question 16

A company wants to distribute content globally with low latency and high transfer speeds. The content is stored in S3 buckets in multiple regions. Which AWS service should be used to accelerate content delivery?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is AWS's content delivery network (CDN), designed to cache and serve content from edge locations worldwide with low latency and high transfer speeds. It integrates natively with S3 origins across regions and can use origin groups or multiple origins for failover. This directly matches the requirement to accelerate global content delivery.

Answer

Amazon Route 53

Answer

AWS Global Accelerator

Answer

S3 Transfer Acceleration

Question 17

A company uses AWS Elastic Beanstalk to deploy a web application. After updating the environment configuration, the deployment fails and the environment health turns red. The SysOps administrator checks the logs and finds a permission error related to the EC2 instance profile. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM instance profile associated with the environment to include the required permissions.. Elastic Beanstalk uses an IAM instance profile for the EC2 instances. The instance profile must have the necessary permissions to access resources like S3 buckets or DynamoDB tables. Updating the instance profile with the required permissions resolves the issue. Option A is wrong because rebuilding the environment from scratch using a saved configuration template does not address the underlying permission issue; it would only recreate the same problem. Option C is wrong because the security group controls network access, not IAM permissions; modifying it would not resolve the permission error. Option D is wrong because updating the application version does not fix permission issues; the application version itself does not grant or modify IAM permissions.

Answer

Rebuild the environment from scratch using a saved configuration template.

Answer

Modify the security group attached to the environment to allow outbound traffic.

Answer

Update the application version to the latest build.

Question 18

A company has a production RDS for PostgreSQL instance with Multi-AZ enabled. During a recent failover test, the application experienced a 5-minute downtime. The company requires that failover be completed within 2 minutes. Which action should be taken to meet this requirement?

Accepted Answer

Configure an RDS Proxy in front of the database.. RDS Proxy reduces failover time by maintaining database connections and connection pooling, allowing the application to reconnect quickly without waiting for DNS propagation or new connection setup. In a Multi-AZ failover, RDS Proxy can typically complete failover in under 60 seconds, meeting the 2-minute requirement by minimizing connection disruption.

Answer

Migrate the database to Amazon Aurora with Multi-AZ.

Answer

Enable automated backups with a short retention period.

Answer

Increase the DB instance class to a larger size.

Question 19

Which TWO actions can a SysOps administrator take to secure an Amazon S3 bucket that contains sensitive data? (Choose TWO.)

Accepted Answer

Enable default encryption using AWS KMS (SSE-KMS) on the bucket.. Enabling default encryption with SSE-KMS ensures that all objects uploaded to the S3 bucket are automatically encrypted at rest using AWS KMS-managed keys. This protects sensitive data even if the uploader forgets to specify encryption, meeting security and compliance requirements for data-at-rest protection.

Answer

Configure a cross-origin resource sharing (CORS) policy.

Answer

Enable cross-region replication for the bucket.

Answer

Enable MFA Delete on the bucket to require multi-factor authentication for delete operations.

Question 20

A company has a web application running on EC2 instances behind an Application Load Balancer. The application experiences latency spikes during peak hours. Amazon CloudWatch metrics show that CPU and memory are not fully utilized. The SysOps administrator suspects the bottleneck is the database. The database is an RDS for MySQL instance. Which action should the administrator take to improve performance without over-provisioning?

Accepted Answer

Enable RDS Performance Insights to analyze database load and identify slow queries.. The administrator needs to diagnose the database bottleneck before making changes. RDS Performance Insights provides detailed visibility into database load, wait events, and top SQL statements, allowing identification of slow queries or resource contention. This aligns with the goal of improving performance without over-provisioning, as it enables targeted optimization rather than guessing at scaling. The other options either add unnecessary resources or don't address the root cause.

Answer

Add a Read Replica to offload read queries.

Answer

Convert the RDS instance to a Multi-AZ deployment.

Answer

Increase the RDS instance size to the next tier.