SOA-C02 Practice Exam 67 — 20 Questions

Question 1

A company uses AWS KMS to encrypt EBS volumes. Which TWO statements about using KMS with EBS are correct? (Choose two.)

Accepted Answer

AWS managed KMS keys are automatically rotated each year. Option B is correct because AWS managed KMS keys (aws/ebs) are automatically rotated every year (approximately 365 days) with no manual action required. Option C is correct because EBS encryption can use either an AWS managed key (aws/ebs) or a customer managed KMS key that you create and control. Option A is incorrect because EBS encryption requires a symmetric KMS key, and imported key material is not supported for EBS volume encryption. Option D is incorrect because EBS encryption requires symmetric KMS keys; asymmetric KMS keys are not supported for EBS volume encryption. Option E is incorrect because when you create a snapshot, the encryption key is inherited from the source volume (or from the default EBS KMS key if the volume is unencrypted), so you are not required to specify a KMS key at snapshot creation time.

Answer

You can import key material for EBS encryption

Answer

EBS supports asymmetric KMS keys

Answer

You must specify a KMS key when creating a snapshot

Question 2

A SysOps administrator is tasked with setting up a solution that automatically terminates EC2 instances that have been running for more than 24 hours. Which steps should the administrator take? (Select THREE.)

Accepted Answer

Tag each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp).. Tagging each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp) provides a reliable, queryable metadata point that a Lambda function can use to calculate instance age. This approach avoids reliance on the EC2 instance's launch time attribute, which can be altered or unavailable in certain scenarios (e.g., stopped/started instances). The tag serves as a deterministic reference for the Lambda function to compare against the current time and decide termination.

Answer

Configure an Auto Scaling group lifecycle hook to terminate instances after 24 hours.

Answer

Create a CloudWatch alarm on the InstanceAge metric and set it to trigger the Lambda function.

Question 3

A company uses AWS Systems Manager to automate patching of EC2 instances. The instances are in an Auto Scaling group. The company wants to ensure that patching does not affect application availability. Which feature should be used?

Accepted Answer

Maintenance Windows. Systems Manager Maintenance Windows allow scheduling patching during specific time windows, and can be configured to work with Auto Scaling to maintain availability by ensuring instances are patched without affecting the overall application availability. Option A is wrong because State Manager is used for maintaining consistent configuration of instances, not for scheduling patching. Option C is wrong because Patch Manager is the service that applies patches, but it is typically run within a Maintenance Window to control timing and availability. Option D is wrong because Run Command is for executing ad-hoc commands and scripts, not for scheduled patching with availability considerations.

Answer

State Manager

Answer

Patch Manager

Answer

Run Command

Question 4

A SysOps Administrator is configuring a Network Load Balancer (NLB) for a TCP-based application. The application requires that clients see the original source IP address of the request. Which configuration should the Administrator use?

Accepted Answer

Use the NLB default behavior; no additional configuration needed.. Network Load Balancers (NLBs) preserve the original source IP address of clients by default when forwarding TCP traffic to targets. This is because NLBs operate at Layer 4 and do not terminate the TCP connection; instead, they pass packets directly to the backend, allowing the target to see the client's IP. No additional configuration is required for this behavior.

Answer

Use an Application Load Balancer instead, which preserves the source IP.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Enable Proxy Protocol v2 on the target group.

Question 5

A SysOps administrator deploys the CloudFormation template shown in the exhibit. The stack creation fails with a security group error. What is the most likely cause?

Accepted Answer

The template uses 'SecurityGroups' instead of 'SecurityGroupIds' for a VPC instance.. When launching an EC2 instance into a VPC subnet, CloudFormation's AWS::EC2::Instance resource requires the SecurityGroupIds property (a list of security group IDs), not SecurityGroups (which is only valid for EC2-Classic). Using SecurityGroups with a VPC subnet causes the stack to fail with a security group error.

Answer

The AMI ID is incorrect.

Answer

The security group ingress rule uses an invalid CIDR.

Answer

The security group ingress rule allows SSH from all IPs.

Question 6

A SysOps administrator needs to route traffic for a domain name 'example.com' to an Application Load Balancer. Which AWS service should be used to create the DNS record?

Accepted Answer

Amazon Route 53. Amazon Route 53 is AWS's DNS service and is used to create DNS records such as A or alias records that point a domain like example.com to an Application Load Balancer's DNS name. It supports alias records that map directly to ALB endpoints, enabling health checks and failover.

Answer

Amazon EC2

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 7

A company uses AWS OpsWorks for configuration management. The SysOps administrator needs to deploy a new application version to a stack. What is the recommended way to update the application on the instances?

Accepted Answer

Update the custom cookbook and run the 'deploy' recipe on the stack.. AWS OpsWorks uses recipes and custom cookbooks to manage application deployment. To deploy a new version, the SysOps administrator should update the custom cookbook with the new application code or configuration and then run the 'deploy' recipe on the stack. This triggers the deployment process on all instances automatically. Option A is incorrect because creating a new CloudFormation stack is not the recommended approach for updating an existing OpsWorks stack; CloudFormation is a different service for infrastructure as code. Option C is incorrect because the OpsWorks built-in 'deploy' command is meant for straightforward deployments and may not support custom cookbooks or complex application logic. Option D is incorrect because manually SSH-ing into each instance is not scalable and defeats the purpose of automation.

Answer

Create a new CloudFormation stack to replace the OpsWorks stack.

Answer

Use the OpsWorks built-in 'deploy' command on each instance.

Answer

SSH into each instance and manually update the application files.

Question 8

Refer to the exhibit. The alarm has been in INSUFFICIENT_DATA state for several hours. What is the most likely cause?

Accepted Answer

The EC2 instance is stopped or terminated.. The INSUFFICIENT_DATA state for several hours indicates that CloudWatch has not received any metric data points for the specified period. If the EC2 instance is stopped or terminated, the CloudWatch agent stops sending metrics, and the default CPU utilization metric (which is published by AWS, not the agent) also ceases because the instance is no longer running. This causes the alarm to remain in INSUFFICIENT_DATA indefinitely until the instance is started again or the metric resumes.

Answer

The alarm evaluation period is too long.

Answer

The instance has no CloudWatch agent installed.

Answer

The instance is running but the CPU utilization is below the threshold.

Question 9

A company stores log files in Amazon S3. The logs are accessed frequently for the first 30 days, then rarely after that. The company wants to automatically transition objects to a lower-cost storage class after 30 days. Which S3 feature should be configured?

Accepted Answer

S3 Lifecycle rule. An S3 Lifecycle rule is the correct feature because it allows you to define a transition action that automatically moves objects from a higher-cost storage class (e.g., S3 Standard) to a lower-cost storage class (e.g., S3 Standard-IA or S3 Glacier) after a specified number of days. This directly meets the requirement to transition logs after 30 days without manual intervention, optimizing storage costs based on access patterns.

Answer

S3 Versioning

Answer

S3 Transfer Acceleration

Answer

S3 Object Lock

Question 10

A SysOps administrator needs to route traffic to multiple AWS regions for disaster recovery using Amazon Route 53. The primary region should receive all traffic unless it becomes unhealthy. Which routing policy should be used?

Accepted Answer

Failover routing policy. Failover routing policy is correct because it allows you to configure an active-passive setup where all traffic is directed to a primary resource (e.g., an Elastic Load Balancer in the primary region) unless Route 53 health checks determine that the primary is unhealthy. When the primary fails, Route 53 automatically routes traffic to the secondary (disaster recovery) resource in another region. This directly meets the requirement of sending all traffic to the primary region unless it becomes unhealthy.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 11

A company uses AWS Lambda functions that process data from an Amazon SQS queue. The Lambda function is failing intermittently due to timeouts. The SysOps administrator needs to be notified immediately when the function times out. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch alarm on the Lambda Errors metric that sends an SNS notification. A CloudWatch alarm on the Lambda Errors metric directly monitors function invocations that result in errors, including timeouts. When the alarm state changes to ALARM, it can immediately trigger an SNS notification, providing the fastest and most efficient notification mechanism without requiring code changes or additional infrastructure.

Answer

Modify the Lambda function to catch the timeout exception and log it to CloudWatch Logs

Answer

Set up a CloudWatch Logs subscription filter to send error logs to an SNS topic

Answer

Configure an Amazon SNS topic as a Lambda destination for the function

Question 12

A SysOps administrator wants to deploy a serverless application using AWS Lambda functions, Amazon API Gateway, and Amazon DynamoDB. The deployment must be automated and repeatable. Which AWS service should the administrator use to define and manage this infrastructure as code?

Accepted Answer

AWS CloudFormation with the AWS Serverless Application Model (SAM). AWS CloudFormation with the AWS Serverless Application Model (SAM) is the correct choice for defining and managing serverless infrastructure as code, as SAM extends CloudFormation with shorthand syntax for Lambda, API Gateway, and DynamoDB. Option A is wrong because AWS CodeDeploy automates code deployment to running instances, not infrastructure provisioning. Option B is wrong because AWS OpsWorks manages Chef/Puppet-based application stacks. Option C is wrong because AWS Elastic Beanstalk is designed for deploying web applications on EC2, not serverless architectures.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Question 13

A CloudFormation template launches an EC2 instance with the user data script shown. The instance launches successfully but the web server does not serve PHP pages. What is the MOST likely reason?

Accepted Answer

The script does not install PHP.. The user data script installs Apache (httpd) and starts the service but never installs PHP or the PHP module for Apache. Without PHP installed, Apache cannot serve .php files — it will either download them as plain text or return a 500 error. This makes option A the most likely reason.

Answer

The script does not have execute permissions.

Answer

The CloudFormation template is missing a DependsOn clause for the instance.

Answer

The user data script is not base64 encoded correctly.

Question 14

A SysOps administrator wants to be notified when an Auto Scaling group launches a new instance. Which AWS service can be used to capture the Auto Scaling lifecycle events and send a notification?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS is the correct choice because it can receive lifecycle notifications from Auto Scaling groups via Amazon EventBridge (formerly CloudWatch Events) and then deliver those notifications to subscribers (e.g., email, SMS, HTTP endpoints). Auto Scaling groups emit lifecycle events (e.g., `EC2 Instance-launch Lifecycle Action`) that can be captured by EventBridge rules, which then invoke an SNS topic to send the notification.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 15

A company uses Amazon CloudWatch Logs to store application logs. The SysOps administrator needs to detect when the number of log entries containing the string 'ERROR' exceeds 100 in any 5-minute window. When this threshold is breached, an email should be sent to the operations team. Which combination of AWS services should be used with the least operational overhead?

Accepted Answer

Create a metric filter on the log group for 'ERROR', then create a CloudWatch alarm on that metric with an SNS action to send email.. It uses CloudWatch metric filters to extract the count of 'ERROR' log entries as a custom metric, then a CloudWatch alarm on that metric triggers an SNS topic to send email notifications. This approach requires no custom code or additional infrastructure, minimizing operational overhead while meeting the requirement of detecting >100 errors in any 5-minute period.

Answer

CloudWatch Logs Insights scheduled query with SNS action.

Answer

Use a Lambda function that reads the log stream and sends an email via Amazon Simple Email Service (SES) when errors exceed 100.

Answer

Install an agent on the application server that sends logs to Amazon SQS, then poll the queue with a Lambda function to trigger an email.

Question 16

A SysOps administrator has deployed an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances. The administrator notices that the ALB is sending all traffic to instances in a single Availability Zone (AZ), ignoring instances in other AZs. The ALB was created with default settings. Which action should the administrator take to ensure traffic is distributed evenly across all AZs?

Accepted Answer

Configure health checks on the target group to ensure unhealthy instances are not used.. By default, an Application Load Balancer has cross-zone load balancing always enabled, so traffic can be sent to healthy targets in any enabled Availability Zone. If traffic is not reaching instances in other AZs, the likely cause is that targets in those AZs are failing health checks or are not registered. Configuring accurate health checks on the target group will allow the ALB to mark those targets healthy and distribute traffic across all AZs. Connection draining and sticky sessions do not affect AZ-level distribution.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Enable connection draining on the target group.

Answer

Enable sticky sessions (session stickiness) on the target group.

Question 17

Refer to the exhibit. A SysOps administrator creates this CloudFormation template. The stack creation fails with the error: 'The security group 'default' does not exist'. What is the most likely cause?

Accepted Answer

The instance is launched in a VPC, but the security group is specified by name instead of group ID.. The error occurs because the template launches the instance in a VPC, where security groups must be referenced by their GroupId, not by name. The template uses 'default' (a name), but CloudFormation interprets it as a GroupId, which does not exist, causing the failure. Option C correctly identifies this issue.

Answer

The VPC does not have a default security group.

Answer

The instance is launched in EC2-Classic, which does not support security groups.

Answer

The 'default' security group is not present in the account.

Question 18

A company wants to provide temporary credentials to an application running on an on-premises server so it can access AWS resources. The credentials must be rotated automatically. Which IAM feature should be used?

Accepted Answer

Use IAM Roles Anywhere with a certificate authority to issue temporary credentials.. IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to assume IAM roles and obtain temporary credentials using X.509 certificates. The credentials are automatically rotated by the service. Option A is wrong because an EC2 instance profile can only be used for EC2 instances, not on-premises servers. Option B is wrong: SAML 2.0 federation is typically used for federating user identities (e.g., SSO), not for application or machine identities. Option C is wrong because IAM users with programmatic access have long-term access keys that do not rotate automatically.

Answer

Use an EC2 instance profile and attach it to the on-premises server.

Answer

Configure a SAML 2.0 identity provider and federate the application.

Answer

Create an IAM user with programmatic access and share the access key.

Question 19

An organization is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS DB instance. The update requires changing the DB instance class. However, the administrator wants to minimize downtime. What should the administrator do?

Accepted Answer

Enable Multi-AZ on the DB instance (if not already enabled) before performing the stack update.. Enabling Multi-AZ allows the RDS instance to have a standby in a different Availability Zone. When updating the DB instance class, CloudFormation can modify the standby first, then fail over to it, minimizing downtime. Options A, C, and D are incorrect: A (DeletionPolicy) controls resource retention on stack deletion, not updates; C (ApplyImmediately) may cause a brief outage; D (read replica promotion) is for scaling reads, not for minimizing downtime during instance class changes.

Answer

Use CloudFormation's 'DeletionPolicy' attribute to retain the database during updates.

Answer

Update the stack directly with 'ApplyImmediately' set to true.

Answer

Create a read replica, promote it, and then delete the original DB instance.

Question 20

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive user data in an S3 bucket. The security team requires that traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Currently, the ALB terminates HTTPS and forwards HTTP to the instances. The SysOps administrator needs to implement the required security controls. Which solution should the administrator implement?

Accepted Answer

Configure the target group to use HTTPS protocol, install a TLS certificate on the EC2 instances, and update the security group on the instances to allow inbound traffic only from the ALB's security group.. Configuring the target group to use HTTPS protocol ensures encryption between the ALB and EC2 instances. Installing a TLS certificate on the instances enables the ALB to establish a secure connection. Restricting the instances' security group to allow inbound traffic only from the ALB's security group ensures that only the ALB can reach the instances, meeting the requirement.

Answer

Use an AWS Global Accelerator to route traffic to the instances and enable encryption.

Answer

Create a network ACL that allows inbound HTTPS traffic from the ALB subnet and outbound HTTPS responses. Use AWS Certificate Manager to install a certificate on the instances.

Answer

Enable S3 VPC endpoint and configure the ALB to forward traffic to the instance via the endpoint.