SOA-C02 Practice Exam 70 — 20 Questions

Question 1

A SysOps administrator needs to detect unauthorized changes to security groups and automatically notify the operations team. Which two AWS services should be part of the solution? (Choose 2.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to create, modify, or delete security groups, providing the audit trail needed to detect unauthorized changes. By enabling CloudTrail on the account and configuring a trail to deliver logs to Amazon S3, the administrator can monitor security group events such as AuthorizeSecurityGroupIngress or RevokeSecurityGroupEgress. This log data is essential for identifying when a change occurred, who made it, and from which source IP.

Answer

Amazon S3 Transfer Acceleration.

Answer

AWS Snowball Edge.

Question 2

A SysOps administrator needs to monitor a custom application metric 'OrdersPerMinute' published to Amazon CloudWatch. The metric should trigger an alarm when the count exceeds 100 for more than 2 consecutive data points, but only during business hours (9 AM to 5 PM weekdays). The alarm must evaluate the metric as a rate per minute. How should the administrator configure the alarm?

Accepted Answer

Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and disable the alarm outside business hours using a Lambda function triggered by CloudWatch Events.. To trigger when 'OrdersPerMinute' exceeds 100 for more than 2 consecutive data points, the alarm must require 3 consecutive breaching data points. This is achieved by setting evaluation periods to 3 and datapoints to alarm to 3. The Lambda/EventBridge approach to disable the alarm outside business hours is correct, but option B's evaluation period settings are incorrect. As written, no option fully satisfies the requirement.

Answer

Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and use a math expression to filter time range.

Answer

Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and use a metric math expression 'IF(IN_BUSINESS_HOURS(), OrdersPerMinute, 0)' but CloudWatch does not have IN_BUSINESS_HOURS function.

Answer

Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 1, datapoints to alarm of 2 (impossible).

Question 3

A SysOps administrator needs to receive alerts when an S3 bucket is publicly accessible. Which TWO AWS services can be used to monitor and detect this configuration?

Accepted Answer

AWS Security Hub. AWS Security Hub (B) is correct because it aggregates security findings from multiple AWS services, including Amazon GuardDuty and AWS Config, and can detect publicly accessible S3 buckets via its built-in security standards (e.g., CIS AWS Foundations Benchmark). AWS Config (D) is correct because it can evaluate S3 bucket configurations against rules, such as the managed rule 's3-bucket-public-read-prohibited' or 's3-bucket-public-write-prohibited', and trigger alerts when a bucket becomes publicly accessible.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Question 4

A SysOps administrator is setting up a CloudWatch dashboard to monitor an application. The application runs on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The administrator wants to track the number of healthy hosts and the request count per target group. Which two metrics should be used? (Choose TWO.)

Accepted Answer

HealthyHostCount (per TargetGroup). `HealthyHostCount` (per TargetGroup) is a CloudWatch metric that reports the number of healthy EC2 instances in a specific target group, which directly indicates the health of the backend fleet. Option D is correct because `RequestCount` (per TargetGroup) tracks the number of requests routed to that target group, allowing the administrator to correlate traffic load with host health. Together, these two metrics provide the exact visibility needed for an Auto Scaling group behind an ALB.

Answer

RequestCount (per ALB)

Answer

ActiveConnectionCount

Answer

HealthyHostCount (per ALB)

Question 5

A company wants to receive alerts when an Auto Scaling group launches or terminates instances. They already have a CloudTrail trail enabled. What is the simplest way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches Auto Scaling event patterns and sends notifications to an SNS topic.. CloudWatch Events (now part of Amazon EventBridge) can automatically capture Auto Scaling group state changes (launch and terminate) via CloudTrail API calls. By creating a rule that matches the specific event pattern for Auto Scaling events (e.g., 'EC2 Instance Launch Successful' and 'EC2 Instance Terminate Successful'), you can directly route those events to an SNS topic, which then sends notifications (e.g., email or SMS). This requires no custom code, lifecycle hooks, or additional monitoring configuration, making it the simplest solution.

Answer

Write a script on each EC2 instance to call the CloudWatch Logs API on launch/termination.

Answer

Configure the Auto Scaling group to publish lifecycle hooks and use Lambda to send notifications.

Answer

Enable CloudWatch detailed monitoring on the Auto Scaling group and create alarms.

Question 6

An application uses Amazon Route 53 weighted routing to distribute traffic across two AWS regions. After a deployment, users in one region are experiencing errors. What should the administrator do to mitigate the issue immediately?

Accepted Answer

Set the weight of the affected region's record to 0 and verify health checks are configured.. Setting the weight of the affected region's Route 53 record to 0 immediately removes that region from the weighted routing rotation, diverting all traffic to the healthy region. Verifying that health checks are configured ensures Route 53 can automatically fail over if the region becomes unhealthy again, providing both immediate mitigation and ongoing resilience.

Answer

Update the alias record to point to a different load balancer.

Answer

Change the routing policy from weighted to latency-based.

Answer

Restart the EC2 instances in the affected region.

Question 7

A SysOps administrator is deploying a CloudFormation stack that includes an AWS::ECS::Service resource. The service uses a task definition that references a container image stored in Amazon ECR. The stack creation fails with the error: 'Unable to assume the service-linked role.' What is the MOST likely cause?

Accepted Answer

The ECS service-linked role does not exist in the account.. The error 'Unable to assume the service-linked role' indicates that the ECS service-linked role (AWSServiceRoleForECS) does not exist in the account. CloudFormation attempts to create the ECS service, which requires this role to manage resources on your behalf. If the role is missing, the stack creation fails. The most likely cause is that the role has not been created, perhaps because ECS was never used in this account before.

Answer

The task execution role does not have permissions to pull the container image from ECR.

Answer

The CloudFormation service role does not have permission to create ECS resources.

Answer

The ECR repository policy does not grant access to the ECS service.

Question 8

A company hosts a web application on Amazon EC2 instances in two AWS regions: us-east-1 and eu-west-1. The application is behind an Application Load Balancer (ALB) in each region. The SysOps administrator wants to direct users to the region that provides the lowest latency, automatically routing traffic away from a region if it becomes unhealthy. Which Amazon Route 53 routing policy should be used?

Accepted Answer

Latency routing. Latency routing (B) is correct because it directs users to the region with the lowest network latency based on real-time measurements between the user and the AWS endpoints. When a region becomes unhealthy, Route 53 automatically stops routing traffic to that region's ALB, ensuring failover to the next lowest-latency healthy region. This meets the requirement of both low-latency and automatic health-based rerouting.

Answer

Geolocation routing

Answer

Weighted routing

Answer

Failover routing

Question 9

A company runs a development Amazon EC2 instance that is only used during business hours (9 AM to 5 PM). The SysOps administrator wants to reduce compute costs. Which action should be taken?

Accepted Answer

Schedule the instance to automatically stop during off-hours and start before business hours. The instance is only needed during business hours (9 AM to 5 PM), so automatically stopping it during off-hours and starting it before business hours eliminates compute charges for idle time. Stopped instances incur no EC2 instance running costs (only storage and EBS volume costs), directly reducing the compute bill. AWS Instance Scheduler or a simple cron-based Lambda function can enforce this schedule reliably.

Answer

Use On-Demand instances

Answer

Use a Reserved Instance

Answer

Use a Spot instance

Question 10

A SysOps administrator needs to deploy a new version of an application to an Auto Scaling group using a blue/green deployment strategy. The application runs on EC2 instances behind an Application Load Balancer. Which AWS service should be used to automate this deployment?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is the service designed to automate application deployments, including blue/green deployments to EC2 Auto Scaling groups behind an Application Load Balancer. It supports the blue/green deployment type natively for EC2/on-premises compute, allowing traffic to shift from the original (blue) environment to a replacement (green) environment with configurable traffic rerouting and rollback. This directly matches the SysOps requirement.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CloudFormation

Question 11

A SysOps administrator is designing a disaster recovery plan for a critical application that runs on EC2 instances with data stored on EBS volumes. The application requires an RPO of 15 minutes and an RTO of 2 hours. The current solution uses EBS snapshots taken every 6 hours. The administrator needs to improve the backup strategy to meet the RPO. What is the most cost-effective way to achieve this?

Accepted Answer

Increase the snapshot frequency to every 15 minutes.. Increasing the snapshot frequency to every 15 minutes directly reduces the recovery point objective (RPO) from 6 hours to 15 minutes, meeting the requirement without incurring additional infrastructure costs. EBS snapshots are incremental and cost-effective, as only changed blocks are stored after the initial snapshot, making frequent snapshots a practical approach for achieving a low RPO.

Answer

Enable EBS Recycle Bin with a retention rule of 15 minutes.

Answer

Change the EBS volume type to io2 Block Express.

Answer

Use EBS Multi-Attach to attach volumes to multiple instances for redundancy.

Question 12

A company runs a stateful web application on a single Amazon EC2 instance with an Elastic IP address. The SysOps administrator needs to increase availability so that if the instance fails, a new instance can be launched quickly with the same configuration and the same IP address. The administrator also needs to ensure data is not lost. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an AMI from the instance, store data on an Amazon EFS file system, and use an Auto Scaling group with a lifecycle hook to associate the Elastic IP. It separates the stateful data (stored on Amazon EFS) from the compute instance, ensuring data persistence even if the instance fails. Creating an AMI from the instance captures the configuration, and an Auto Scaling group with a lifecycle hook can associate the Elastic IP to the new instance automatically, providing a quick failover with minimal operational overhead.

Answer

Use an Application Load Balancer with an Auto Scaling group and a launch configuration that includes the Elastic IP

Answer

Create a CloudFormation template that launches a new instance and associates the Elastic IP

Answer

Place the instance in an Auto Scaling group with a minimum of 1 and a maximum of 1, and set the health check to replace unhealthy instances

Question 13

A SysOps administrator is troubleshooting a high error rate on an Application Load Balancer (ALB). The ALB is configured with two target groups: one for EC2 instances and one for Lambda functions. The administrator notices that the EC2 target group is unhealthy. Which THREE steps should the administrator take to resolve the issue?

Accepted Answer

Verify that the EC2 instances' security groups allow traffic from the ALB.. The ALB communicates with EC2 instances using the private IP addresses of the instances. If the EC2 instances' security groups do not explicitly allow inbound traffic from the ALB's security group (or the ALB's VPC CIDR), the health checks and actual traffic will be blocked, causing the target group to be marked unhealthy. This is a common misconfiguration when the ALB and instances are in the same VPC.

Answer

Review the ALB's DNS resolution for the target instances.

Answer

Increase the size of the Auto Scaling group to distribute load.

Question 14

An application writes logs to a file on an EC2 instance. The SysOps team needs to send these logs to Amazon CloudWatch Logs in real time. The logs must be encrypted at rest in CloudWatch Logs using a customer-managed KMS key. Which steps are required?

Accepted Answer

Install the CloudWatch Logs agent and associate a KMS key with the log group using the 'associate-kms-key' API.. The CloudWatch Logs agent can send log data from an EC2 instance to CloudWatch Logs in real time, and the 'associate-kms-key' API (or the equivalent AWS CLI command 'put-log-group-encryption') allows you to associate a customer-managed KMS key with a log group, encrypting the logs at rest. This meets both the real-time delivery and customer-managed KMS encryption requirements without additional services or workarounds.

Answer

Use AWS CloudTrail to deliver logs to CloudWatch Logs with KMS encryption.

Answer

Store logs in S3 with KMS encryption and use S3 event notifications to trigger Lambda to put logs in CloudWatch Logs.

Answer

Install the CloudWatch Logs agent and enable encryption on the EC2 instance volume using KMS.

Question 15

A SysOps administrator is automating the deployment of an application across multiple AWS accounts using AWS CodePipeline. The pipeline must deploy to different environments (dev, test, prod) sequentially. Which deployment approach should be used?

Accepted Answer

Use separate CodePipeline stages with cross-account actions using IAM roles.. Cross-account deployment in CodePipeline is achieved by defining separate stages (or actions) that assume an IAM role in the target account, allowing the pipeline in the tooling account to deploy into dev, test, and prod accounts sequentially. This uses sts:AssumeRole with a trust policy on the target account's role, and the stages run in order with manual approval gates as needed.

Answer

Use AWS CodeCommit repositories in each account and trigger builds.

Answer

Use AWS CLI scripts with cross-region replication.

Answer

Create a single pipeline with all deployment stages in the same account.

Question 16

A company has an S3 bucket that stores sensitive data. The security team requires that all data be encrypted at rest and that all access be logged. Which TWO actions should the SysOps administrator take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable default encryption on the S3 bucket.. Option C is correct because enabling default encryption on the S3 bucket (using SSE-S3 or SSE-KMS) ensures that every object is automatically encrypted at rest when written, satisfying the requirement that all stored data be encrypted. Option E is correct because enabling S3 server access logs delivers detailed records of every request made to the bucket to a target logging bucket, which fulfills the requirement that all access be logged. Option A is incorrect because S3 Transfer Acceleration only speeds up uploads/downloads over long distances using edge locations; it does not provide encryption or logging. Option B is incorrect because S3 Replication copies objects to another bucket for durability, latency, or compliance purposes but does not itself encrypt data at rest or log access. Option D is incorrect because S3 Object Lock enforces WORM protection to prevent deletion or modification of objects, which is unrelated to encryption at rest or access logging.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Replication to replicate objects to another bucket.

Answer

Enable S3 Object Lock.

Question 17

A SysOps administrator needs to ensure that all API calls made to AWS are logged for auditing purposes. Which AWS service should be enabled to capture management events?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service specifically designed to record API activity in an AWS account, including management events (control plane operations) such as creating, modifying, or deleting resources. It captures the identity of the caller, the time of the call, the source IP address, and other details, making it the correct choice for auditing API calls. CloudTrail logs can be delivered to an S3 bucket and optionally to CloudWatch Logs for further analysis.

Answer

S3 server access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 18

A DevOps engineer is designing a CI/CD pipeline for a microservices application hosted on Amazon ECS with Fargate. The team wants to deploy updates to the services without downtime. The current pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service using AWS CodeDeploy with a blue/green deployment. However, during the deployment, the new tasks fail to start due to an incorrect environment variable. The engineer wants to validate the task definition before the actual deployment. What should the engineer do?

Accepted Answer

Configure CodeDeploy to use a validation hook with an AWS Lambda function that tests the new task definition before shifting traffic.. AWS CodeDeploy for ECS supports lifecycle event hooks, including a BeforeAllowTraffic hook that runs an AWS Lambda function before traffic is shifted to the replacement task set. The Lambda can inspect the new task definition, verify environment variables, and fail the deployment if validation fails, preventing the bad configuration from ever receiving production traffic. This directly addresses the requirement to validate the task definition before the actual deployment.

Answer

Use Amazon CloudWatch Synthetics canaries to monitor the health of the new tasks after deployment.

Answer

Run the Docker container locally using 'docker run' with the same environment variables to verify the configuration.

Answer

Use Amazon ECS Service Auto Scaling to gradually increase the number of tasks and monitor CPU utilization.

Question 19

Which TWO actions should a SysOps administrator take to automate the deployment of a multi-tier application with AWS CloudFormation? (Choose two.)

Accepted Answer

Use nested stacks to separate concerns such as network, app, and database. Option B is correct because nested stacks let you decompose a multi-tier application into reusable, independently managed templates (for example, a network stack, an application stack, and a database stack), which CloudFormation deploys as a parent stack with AWS::CloudFormation::Stack resources and promotes separation of concerns and reuse. Option D is correct because cross-stack references via Export in an Outputs section and Fn::ImportValue allow one stack to consume another stack's outputs (such as a VPC ID or subnet IDs), enabling modular, loosely coupled templates that pass values between stacks without hardcoding. Option A is wrong because hardcoding CIDR blocks and instance types reduces reusability and portability; parameters (with defaults and constraints) are the proper mechanism for environment-specific inputs. Option C is wrong because AWS::Include is a transform for inserting template snippets from S3 at deployment time, not a substitute for parameters, and it does not by itself provide the modular stack separation needed here. Option E is wrong because defining every resource in a single template creates a monolithic, hard-to-maintain stack and prevents the independent lifecycle management that nested stacks and cross-stack references provide.

Answer

Hardcode CIDR blocks and instance types to avoid parameter input

Answer

Use AWS::Include to reuse snippets instead of parameters

Answer

Define all resources in a single template to simplify management

Question 20

A SysOps administrator needs to track changes made to an Amazon S3 bucket policy and receive notifications when changes occur. Which AWS service should be used?

Accepted Answer

AWS Config. AWS Config is designed to record configuration changes to AWS resources, including S3 bucket policies, and can evaluate them against desired configurations. It can send notifications via Amazon SNS when changes occur, and it provides a history of configuration changes. This directly meets the requirement to track changes and receive notifications.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Events

Answer

AWS CloudTrail