SOA-C02 Practice Exam 68 — 20 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. During a deployment, the environment's health turns from Green to Red, and the deployment fails. The logs show 'ERROR: Failed to download the application version from Amazon S3.' What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EC2 instance profile does not have an IAM policy granting s3:GetObject on the application version. The error 'Failed to download the application version from Amazon S3' indicates that the EC2 instances in the Elastic Beanstalk environment cannot access the S3 bucket where the application version is stored. The most likely cause is that the EC2 instance profile (IAM role) lacks the necessary s3:GetObject permission on the application version object. Elastic Beanstalk uses the instance profile to download the application from S3 during deployment.

Answer

The Elastic Beanstalk service role does not have permissions to access S3

Answer

The S3 bucket is in a different AWS Region

Answer

The S3 bucket containing the application version has public read access disabled

Question 2

A sysadmin needs to block specific IP addresses from accessing an Application Load Balancer. Which approach is MOST efficient?

Accepted Answer

Create an AWS WAF web ACL with IP set rules and associate it with the ALB.. AWS WAF is the most efficient and appropriate service for blocking specific IP addresses from accessing an Application Load Balancer. You can create an IP set with the addresses to block and associate a web ACL with the ALB. WAF operates at Layer 7 and is designed for this purpose, providing granular control and scalability.

Answer

Modify the security group for the ALB to deny traffic from those IPs.

Answer

Add a route in the VPC route table to drop traffic from those IPs.

Answer

Update the network ACL for the ALB subnets.

Question 3

A SysOps administrator is investigating a performance issue where an Amazon RDS for MySQL instance's ReadIOPS metric is consistently high. The database is used by a web application. Which THREE actions should the administrator take to improve performance?

Accepted Answer

Increase the InnoDB buffer pool size to cache more data in memory.. Increasing the InnoDB buffer pool size allows more data and indexes to be cached in memory, reducing the need for disk reads and thus lowering ReadIOPS. This is a direct and effective tuning action for MySQL on RDS when read I/O is the bottleneck.

Answer

Change the storage type to Provisioned IOPS for better performance.

Answer

Enable Multi-AZ deployment for high availability.

Question 4

An organization has a production AWS environment with multiple VPCs and hundreds of EC2 instances. The security team wants to be alerted when any security group is modified. Which approach should a SysOps administrator use to meet this requirement with minimal overhead?

Accepted Answer

Use AWS Config rules to detect security group changes and trigger an SNS notification.. AWS Config rules can continuously evaluate security group configurations against desired settings and trigger an SNS notification when a change is detected. This approach provides automated, event-driven monitoring with minimal operational overhead, as it does not require custom scripts or manual log analysis.

Answer

Enable CloudTrail and create a CloudWatch alarm for each security group modification event.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena for security group changes.

Answer

Deploy Amazon GuardDuty to monitor for security group modifications.

Question 5

Which TWO actions should a SysOps administrator take to secure an S3 bucket that stores sensitive data? (Choose two.)

Accepted Answer

Enable S3 Block Public Access settings on the bucket.. Option A is correct because enabling S3 Block Public Access on the bucket applies the four block-public-access settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) that prevent sensitive objects from ever being exposed through public ACLs or bucket policies. Option D is correct because S3 server access logging records detailed, request-level records (requester, bucket, key, operation, response status, source IP) to a target bucket, giving the audit trail needed to detect and investigate unauthorized access to sensitive data. Option B is not appropriate because CORS only controls which web origins may make cross-origin browser requests to the bucket; it is a browser-enforcement mechanism, not an access-control or data-protection control. Option C is not appropriate because S3 Versioning only preserves multiple object versions to aid recovery from overwrites or deletes; it does not restrict who can read the data. Option E is not appropriate because S3 Transfer Acceleration merely speeds up uploads/downloads via AWS edge locations and provides no security benefit.

Answer

Enable cross-origin resource sharing (CORS) on the bucket.

Answer

Enable S3 Versioning.

Answer

Enable S3 Transfer Acceleration.

Question 6

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Amazon Linux 2. Which of the following is required to publish memory metrics to CloudWatch?

Accepted Answer

Install and configure the CloudWatch agent on the instance.. The CloudWatch agent is specifically designed to collect custom metrics, such as memory utilization, from EC2 instances and publish them to CloudWatch. Unlike the default EC2 monitoring, which only captures hypervisor-level metrics (CPU, network, disk), memory utilization requires an in-guest agent to read from the operating system's /proc/meminfo or similar interfaces. The CloudWatch agent can be configured via a JSON file to collect memory metrics and send them to CloudWatch using the PutMetricData API.

Answer

Use the CloudWatch Logs agent to parse memory usage from system logs.

Answer

Enable detailed monitoring on the instance.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and configure it to send metrics.

Question 7

An organization requires that all Amazon S3 buckets block public access entirely. A SysOps administrator needs to ensure that no bucket can be made public, even accidentally. Which approach enforces this control at the organizational level?

Accepted Answer

Enable S3 Block Public Access at the account level and attach an SCP to deny changes to it.. S3 Block Public Access at the account level provides a centralized, immutable control that prevents any bucket in the account from being made public, regardless of bucket policies or ACLs. Attaching an SCP (Service Control Policy) to deny changes to these settings ensures that even administrators with full IAM permissions cannot disable the block, enforcing the control at the organizational level across all accounts in the organization.

Answer

Apply an S3 Bucket Policy on each bucket that denies public access.

Answer

Use an AWS Config managed rule 's3-bucket-public-read-prohibited' to detect and remediate public buckets.

Answer

Create an IAM policy that denies s3:PutBucketPolicy for all users.

Question 8

A company wants to monitor the health of its web application running on EC2 instances behind an Application Load Balancer (ALB). Which CloudWatch metric from the ALB can indicate that requests are failing due to server errors?

Accepted Answer

HTTPCode_Target_5XX_Count. The HTTPCode_Target_5XX_Count metric from the Application Load Balancer (ALB) specifically counts the number of HTTP response codes in the 5xx range returned by the target (EC2 instances). A 5xx status code indicates a server-side error, such as an internal server error (500), gateway timeout (504), or service unavailable (503), which directly reflects that requests are failing due to issues on the EC2 instances themselves.

Answer

HTTPCode_Target_4XX_Count

Answer

HTTPCode_Target_2XX_Count

Answer

HTTPCode_Target_3XX_Count

Question 9

A company runs a web application on Amazon EC2 instances that run 24/7. The application has a predictable and steady load. The SysOps administrator wants to minimize compute costs while ensuring the required capacity is always available. Which purchasing option should be used?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) are the correct choice because the workload runs 24/7 with a predictable and steady load. By committing to a 1- or 3-year term, the company can achieve a significant discount (up to 72%) compared to On-Demand pricing, while ensuring capacity is always available. This aligns with the goal of minimizing compute costs without sacrificing availability.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts

Question 10

A company wants to receive an alert when its AWS spending exceeds $5,000 in a month. The SysOps administrator needs to set up a proactive alert that monitors actual costs. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets is the correct service because it allows you to set a cost budget that proactively sends alerts when actual costs exceed a specified threshold (e.g., $5,000 per month). Unlike Cost Explorer, which is an analytical tool, Budgets provides real-time notifications via Amazon SNS when costs reach or are forecasted to exceed the budgeted amount, enabling proactive monitoring of actual spending.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 11

A company runs a web application on Amazon EC2 instances that have variable traffic patterns. The application experiences steady baseline traffic with occasional spikes. The SysOps administrator wants to optimize costs while ensuring performance during spikes. Which pricing model should be used for the baseline capacity and for the burst capacity?

Accepted Answer

Reserved Instances for baseline, Spot Instances for burst capacity. Reserved Instances provide a significant discount (up to 72%) over On-Demand for steady-state workloads, making them ideal for baseline capacity. Spot Instances offer the lowest cost (up to 90% discount) but can be interrupted with a 2-minute warning, which is acceptable for burst capacity that can tolerate interruptions or be designed to failover gracefully. This combination minimizes cost while ensuring the baseline always runs and burst capacity can be added during spikes.

Answer

On-Demand Instances for baseline, Reserved Instances for burst capacity

Answer

Spot Instances for baseline, On-Demand Instances for burst capacity

Answer

Dedicated Hosts for baseline, Spot Instances for burst capacity

Question 12

A SysOps administrator manages a fleet of Amazon EC2 instances that run critical software. The administrator needs to automatically apply security patches every Tuesday at 2 AM. The instances are part of an Auto Scaling group and must be patched without downtime. Which AWS Systems Manager feature should be used?

Accepted Answer

Maintenance Windows. Maintenance Windows is the correct choice because it allows you to schedule a recurring window (every Tuesday at 2 AM) during which Systems Manager actions, such as patching, can be executed on EC2 instances. This feature is specifically designed to coordinate patching across Auto Scaling groups without downtime by ensuring instances are patched in a controlled manner, often using a patching rate or concurrency limit to maintain availability.

Answer

State Manager

Answer

Patch Manager

Answer

Run Command

Question 13

A company has an Amazon DynamoDB table with on-demand capacity mode. The SysOps administrator needs to ensure that the table can survive a regional outage. The table is currently in us-east-1. Which feature should be configured to achieve regional resilience with minimal data loss?

Accepted Answer

DynamoDB global tables. DynamoDB global tables provide multi-Region, fully replicated tables that automatically propagate writes to all configured Regions, enabling the table to survive a regional outage with minimal data loss. This feature uses DynamoDB Streams to replicate data asynchronously across Regions, offering recovery point objectives (RPO) of typically under one second. For the requirement of regional resilience, global tables are the correct choice because they maintain active copies in multiple AWS Regions.

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB point-in-time recovery

Answer

DynamoDB auto scaling

Question 14

A SysOps administrator needs to monitor AWS CloudTrail logs for any calls to the 'CreateUser' API in AWS Identity and Access Management (IAM). When such an API call is detected, the administrator wants to receive a notification within a few minutes and also log the event to a central log group in Amazon CloudWatch Logs. The solution should use minimal custom code. Which combination of services should be used?

Accepted Answer

Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.. Amazon EventBridge can directly consume CloudTrail events in near-real time via the 'aws.cloudtrail' event source, allowing you to create a rule that matches the 'CreateUser' API call. This rule can then target both an Amazon SNS topic for immediate notification and a CloudWatch Logs log group for centralized logging, all without custom code.

Answer

Configure AWS CloudTrail to deliver logs to Amazon CloudWatch Logs, create a metric filter for the 'CreateUser' API call, and set up a CloudWatch alarm that sends an Amazon SNS notification.

Answer

Write an AWS Lambda function that is triggered by Amazon S3 events when a new CloudTrail log is delivered to S3. The Lambda parses the log file for 'CreateUser' and if found, sends an SNS notification.

Answer

Enable AWS Config and create a custom rule that evaluates CloudTrail trail configurations for events.

Question 15

A company uses Amazon CloudFront to deliver content from an Application Load Balancer (ALB) origin. The SysOps administrator needs to restrict access to the content so that only users from a specific geographic location can view it. Which CloudFront feature should be used?

Accepted Answer

Geographic restrictions (geo-blocking) in CloudFront. CloudFront's geographic restrictions (geo-blocking) feature allows you to restrict access to content based on the geographic location of the viewer's IP address. This is the simplest and most direct method to ensure only users from a specific country or region can access the content delivered through CloudFront, without requiring any changes to the origin or additional authentication mechanisms.

Answer

Origin Access Identity (OAI)

Answer

Signed URLs

Answer

AWS WAF web ACL associated with the CloudFront distribution

Question 16

A company has two Amazon VPCs in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

Accepted Answer

VPC peering. VPC peering is the correct solution because it establishes private connectivity between two VPCs in the same AWS Region using the AWS backbone network, with no bandwidth limits and no single point of failure. It incurs no additional cost beyond data transfer charges, making it the most cost-effective option for high-throughput connectivity between two VPCs with non-overlapping CIDR blocks.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub

Question 17

A company uses AWS CodeDeploy to deploy a new version of an application to EC2 instances in an Auto Scaling group behind an Application Load Balancer. The company requires zero downtime during the deployment. Which deployment configuration should be used?

Accepted Answer

Create a blue/green deployment by configuring CodeDeploy to launch new instances and shift traffic after validation.. A blue/green deployment with CodeDeploy, where new instances are launched and traffic is shifted only after validation, ensures zero downtime by keeping the old environment (blue) fully serving traffic until the new environment (green) is verified healthy. This approach avoids any in-place updates that could temporarily reduce capacity or cause service disruption, meeting the requirement for zero downtime during deployment.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.OneAtATime

Answer

CodeDeployDefault.EC2/OnPremises: BlueGreenDeployment

Question 18

Operators have been making direct changes to AWS resources (security group rules, IAM policy modifications) that were originally created by CloudFormation stacks. The team wants to identify which stacks and specific resources have drifted from their template definitions. What is the correct tool and operation sequence?

Accepted Answer

Run drift detection on each CloudFormation stack; review the results in the Drift status panel to see which resources have MODIFIED or DELETED status. AWS CloudFormation drift detection is the correct tool because it directly compares the current state of resources in a stack (including security group rules and IAM policies) against the stack's template definitions. Running drift detection on each stack and reviewing the Drift status panel reveals which resources have been modified or deleted outside of CloudFormation, providing the exact identification the team needs.

Answer

Enable AWS Config conformance packs that check CloudFormation stack compliance against desired template states

Answer

Re-deploy all stacks with the original templates using CloudFormation update-stack to overwrite any manual changes

Answer

Use AWS Trusted Advisor to identify resources that have been modified outside of their originating CloudFormation stacks

Question 19

A company runs a gaming application that uses Amazon EC2 instances to handle real-time multiplayer sessions. The application requires low-latency communication with users around the world. The SysOps administrator needs to accelerate content delivery for non-cacheable, dynamic content (such as real-time game state updates) and also provide static asset delivery. The solution must support both TCP and UDP traffic. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network and Anycast IPs to route TCP and UDP traffic to the optimal endpoint, providing low-latency performance for non-cacheable dynamic content like real-time game state updates. It also supports static asset delivery by directing traffic to origins such as Application Load Balancers or EC2 instances, and it handles both TCP and UDP protocols natively, which is essential for real-time multiplayer gaming.

Answer

Amazon CloudFront with origins configured for both dynamic and static content

Answer

AWS Shield Advanced

Answer

AWS App Mesh

Question 20

A company runs a stateless web application on Amazon EC2 instances behind an Application Load Balancer. The application usage is consistent throughout the day and is expected to grow steadily over the next year. The SysOps administrator wants to minimize compute costs while ensuring capacity is available. Which purchasing option should the administrator use for the EC2 instances?

Accepted Answer

Reserved Instances (Standard, 1-year or 3-year). The application has a steady, predictable usage pattern and is expected to grow steadily, making Reserved Instances (Standard) the most cost-effective option. By committing to a 1-year or 3-year term, the administrator can receive a significant discount (up to 72% compared to On-Demand) while ensuring capacity is always available. This aligns with the requirement to minimize compute costs without sacrificing availability for a stateless, load-balanced workload.

Answer

On-Demand Instances

Answer

Spot Instances

Answer

Dedicated Hosts