SOA-C02 Mock Exam 71 — 25 Questions

Question 1

A company has an application running on EC2 instances behind an Application Load Balancer. Users report intermittent timeout errors. The ALB target group shows healthy instances, and CloudWatch metrics show no spikes in CPU or memory. Which configuration is most likely causing the timeouts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ALB idle timeout is set too low. The ALB idle timeout is the period the load balancer waits for data on an idle connection before closing it. If it is set lower than the application's processing time (e.g., a long-running request), the ALB closes the connection and the client sees a timeout, even though targets are healthy and CPU/memory are normal. This matches the symptom of intermittent timeouts with no resource spikes.

Answer

Connection draining is set too low

Answer

The target group health check interval is too long

Answer

Cross-zone load balancing is disabled

Question 2

A SysOps administrator needs to allow an EC2 instance in a private subnet to download patches from the internet. Which AWS service should be used to achieve this securely?

Accepted Answer

NAT Gateway. A NAT Gateway is a managed AWS service deployed in a public subnet that allows instances in private subnets to initiate outbound connections to the internet (such as downloading patches) while preventing inbound connections from the internet. It provides the secure, one-way egress path the scenario requires.

Answer

Internet Gateway (IGW)

Answer

AWS VPN

Answer

VPC Peering

Question 3

A company has an S3 bucket that contains sensitive customer data. The security team requires that all data in transit to and from the bucket must be encrypted. Which bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The aws:SecureTransport condition key in an S3 bucket policy checks whether the request was sent using SSL/TLS. Setting it to 'true' denies any requests that are not encrypted in transit, enforcing HTTPS for all access to the bucket. This directly meets the requirement that all data in transit must be encrypted.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Answer

aws:TLSSupport

Question 4

A SysOps administrator is tasked with automating the provisioning of EC2 instances that must be able to access an Amazon S3 bucket. The administrator needs to ensure that the instances have the necessary permissions without using long-term access keys. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Attach the IAM role to the EC2 instances using an instance profile.. Option D is correct because an IAM role is the identity that carries the S3 permission policy, and it is the prerequisite for granting temporary credentials to EC2. Option B is correct because the role must be delivered to the instances through an instance profile, which lets the EC2 instance metadata service (IMDS) vend rotating temporary credentials via AWS STS, satisfying the no-long-term-keys requirement. Option A is wrong because storing AWS access keys in a configuration file uses long-term credentials, which the scenario explicitly forbids. Option C is wrong because an S3 bucket policy cannot meaningfully grant access based on an instance's private IP address, which is not a valid principal identifier for EC2. Option E is wrong because Systems Manager Parameter Store is a secrets storage mechanism, not an automatic credential provider, so instances would still need long-term keys to retrieve the values.

Answer

Store AWS access keys in a configuration file on the instances.

Answer

Create an S3 bucket policy that allows access from the instances' private IP addresses.

Answer

Store the access keys in AWS Systems Manager Parameter Store.

Question 5

A SysOps administrator wants to monitor the cost and usage of AWS resources for different departments. Which AWS service should they use to tag resources and generate cost allocation reports?

Accepted Answer

AWS Cost Explorer with cost allocation tags. AWS Cost Explorer with cost allocation tags is the correct answer because it allows you to activate user-defined or AWS-generated tags as cost allocation tags, then filter and group cost and usage data by those tags to produce per-department reports. Cost Explorer is the native billing tool for visualizing spend over time and supports tag-based breakdowns directly. Trusted Advisor, Budgets, and Config do not generate cost allocation reports by tag.

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Answer

AWS Config

Question 6

A SysOps administrator is troubleshooting a failed AWS CloudFormation stack update. The error message indicates that a resource failed to create due to insufficient IAM permissions. The administrator used a service role for CloudFormation. What should the administrator do to resolve the issue?

Accepted Answer

Update the IAM policy attached to the CloudFormation service role to include the necessary permissions.. When CloudFormation assumes a service role to perform stack operations, all API calls made on behalf of the stack use that role's permissions — not the administrator's user permissions. The fix is to attach or update the IAM policy on the CloudFormation service role to grant the missing permissions (e.g., ec2:CreateInstance, s3:CreateBucket). This is the least-privilege, correct remediation.

Answer

Add the required permissions to the administrator's IAM user.

Answer

Request a limit increase for IAM roles in the AWS account.

Answer

Modify the resource's IAM policy to allow CloudFormation to create it.

Question 7

A SysOps administrator ran a CloudFormation stack update that failed and rolled back. The stack status is UPDATE_ROLLBACK_FAILED. The administrator needs to fix the issue and bring the stack to a stable state. What should the administrator do FIRST?

Accepted Answer

Identify and resolve the resource issue that caused the rollback failure, then continue the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED, the rollback itself failed because a resource could not be reverted. The administrator must first identify and resolve the underlying resource issue (e.g., a deleted S3 bucket, a modified IAM role, or a resource in an inconsistent state), then use the ContinueUpdateRollback API to resume the rollback and bring the stack to UPDATE_ROLLBACK_COMPLETE.

Answer

Wait for CloudFormation to automatically retry the rollback.

Answer

Execute a new stack update to overwrite the failed resources.

Answer

Delete the stack and recreate it from the template.

Question 8

A DevOps engineer wants to automate the creation of an Amazon EC2 instance with a specific security group and IAM role. Which AWS service should be used to define the infrastructure as code?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the infrastructure-as-code (IaC) service that allows you to define AWS resources such as EC2 instances, security groups, and IAM roles in declarative JSON or YAML templates. It automates provisioning and management of the entire stack, ensuring consistent and repeatable deployments. This directly matches the requirement to define infrastructure as code.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Question 9

A company deploys a web application on EC2 instances behind an Application Load Balancer. The SysOps administrator needs to allow inbound traffic only from the ALB to the EC2 instances. Currently, the EC2 security group allows inbound HTTP from 0.0.0.0/0. Which security group configuration should the administrator apply?

Accepted Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's security group.. Security groups can reference other security groups as sources, so allowing inbound HTTP on the EC2 instances' security group from the ALB's security group automatically permits traffic from all current and future ALB nodes. This is the AWS-recommended pattern because ALB IP addresses change dynamically and cannot be reliably hardcoded. It also ensures only traffic that passed through the load balancer reaches the instances.

Answer

Keep the existing rule that allows inbound HTTP from 0.0.0.0/0, but add a network ACL to block traffic from the internet.

Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's private IP addresses.

Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's public IP addresses.

Question 10

A company is using AWS CloudFormation to deploy a multi-tier web application. After updating the stack template, the update fails with a stack creation rollback in progress error. The SysOps administrator needs to identify the specific resource that caused the failure. What is the MOST efficient way to accomplish this?

Accepted Answer

Run the AWS CLI command aws cloudformation describe-stack-events --stack-name <stack-name> and review the resource status reason.. The describe-stack-events command returns a chronological list of every stack event, including each resource's status and the 'ResourceStatusReason' field that contains the exact error message from the failed resource. This is the fastest, most direct way to pinpoint which resource caused the rollback without digging through unrelated logs.

Answer

Use the AWS Management Console to view the stack status and check the stack policy.

Answer

Use the aws cloudformation describe-change-set command to review the proposed changes.

Answer

Check the CloudTrail logs for the UpdateStack API call to see the error message.

Question 11

A SysOps administrator is troubleshooting an issue where an IAM user cannot launch an EC2 instance. The user has a policy that allows ec2:RunInstances. What is the most likely cause of the failure?

Accepted Answer

The user does not have permissions for supporting actions like CreateNetworkInterface.. Launching an EC2 instance requires more than just ec2:RunInstances — the principal also needs permissions for dependent actions such as ec2:CreateNetworkInterface, ec2:DescribeImages, ec2:DescribeSubnets, and ec2:DescribeSecurityGroups, depending on the launch configuration. If the policy only grants ec2:RunInstances, the launch fails with an UnauthorizedOperation error on the supporting action. This is the most likely cause given the scenario.

Answer

The user is not using multi-factor authentication (MFA).

Answer

The user does not have permission to use the KMS key for encryption.

Answer

The policy is attached to a group instead of the user.

Question 12

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The SysOps team wants to reduce costs by ensuring that idle capacity is minimized. Which configuration should they implement?

Accepted Answer

Configure an Auto Scaling group with a target tracking scaling policy based on ALB request count per target.. A target tracking scaling policy based on ALB request count per target automatically adjusts the number of EC2 instances to keep the request count per instance at a specified target value. This directly ties scaling to actual traffic demand, minimizing idle capacity while maintaining performance. It is the most cost-efficient and responsive configuration for an ALB-fronted workload.

Answer

Configure an Auto Scaling group with a step scaling policy based on CPU utilization.

Answer

Increase the number of EC2 instances in the Auto Scaling group to handle peak load.

Answer

Set the Auto Scaling group desired capacity to the maximum expected load.

Question 13

A company is using AWS Elastic Beanstalk to deploy a web application. The application uses a custom Amazon Machine Image (AMI) that must be updated periodically. The SysOps administrator creates a new AMI and updates the Elastic Beanstalk environment's configuration. However, new instances are still launched with the old AMI. What is the most likely cause?

Accepted Answer

The environment is configured to use a launch template, and the AMI was not updated in the launch template.. When an Elastic Beanstalk environment is configured to use a launch template, the AMI ID is specified in the launch template, not in the environment's configuration. Updating the environment configuration alone does not change the launch template, so new instances continue to use the old AMI. The administrator must update the launch template with the new AMI ID.

Answer

The environment is using an immutable update policy.

Answer

The environment's platform version is pinned to an older version.

Answer

The old AMI was not deregistered.

Question 14

A company is using AWS CloudTrail to log all API calls. The security team wants to ensure that logs are tamper-proof and stored securely. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Encrypt the CloudTrail log files with SSE-KMS.. Option B is correct because enabling SSE-KMS encryption on the S3 bucket that receives CloudTrail logs protects the log files at rest with AWS KMS keys, ensuring confidentiality and helping meet the requirement that logs are stored securely. Option E is correct because CloudTrail log file validation creates a digitally signed digest file for each log, allowing you to verify that logs have not been altered or deleted after delivery, which directly addresses tamper-proofing. Option A is not required for tamper-proofing or secure storage; while a separate account can improve isolation, it is not one of the two actions that specifically ensure integrity and encryption. Option C (MFA Delete) adds protection against accidental or unauthorized deletion but does not itself make log contents tamper-proof or encrypted. Option D (S3 server access logs) only records access requests to the bucket and does not provide integrity validation or encryption of CloudTrail logs.

Answer

Write logs to a different AWS account.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Enable S3 server access logs.

Question 15

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance. The database is in a VPC with public and private subnets. The DB instance is in a private subnet. When the stack is created, the DB instance is not accessible from an EC2 instance in the same VPC. What is the most likely cause?

Accepted Answer

The security group for the DB instance does not allow inbound traffic from the EC2 instance.. The most likely cause is that the security group attached to the RDS DB instance does not permit inbound traffic from the EC2 instance's security group or IP address on the database port. In a VPC, security groups act as virtual firewalls, and even if the DB is in the same VPC, traffic is blocked unless explicitly allowed. CloudFormation stack creation would succeed, but connectivity would fail.

Answer

The DB subnet group does not include the correct subnets.

Answer

The VPC does not have an internet gateway attached.

Answer

The DB instance does not have a public IP address.

Question 16

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The administrator wants to ensure that the DB instance is not deleted when the stack is deleted. Which property should the administrator set in the CloudFormation template?

Accepted Answer

DeletionPolicy: Retain. The DeletionPolicy: Retain property ensures that the RDS DB instance is not deleted when the CloudFormation stack is deleted. It preserves the resource, allowing it to continue running independently of the stack. This is the correct choice to prevent accidental data loss.

Answer

DeletionPolicy: Delete

Answer

DeletionPolicy: Snapshot

Answer

DeletionPolicy: Replace

Question 17

A SysOps administrator is planning a VPC design with high availability for an application that must tolerate the failure of an entire Availability Zone. Which TWO configurations should be implemented? (Select TWO.)

Accepted Answer

Deploy a NAT Gateway in each Availability Zone.. Option B is correct because a NAT Gateway is an AZ-scoped resource, so deploying one in each Availability Zone ensures that private subnet egress continues to function if a single AZ fails; a single NAT Gateway would become a single point of failure. Option C is correct because launching EC2 instances in at least two Availability Zones provides the actual compute redundancy needed to tolerate the loss of an entire AZ, allowing traffic to be served from the surviving AZ. Option A is incorrect because one NAT Gateway shared by all private subnets concentrates the egress path in a single AZ and fails during an AZ outage. Option D is incorrect because placement groups (cluster, spread, or partition) do not by themselves guarantee multi-AZ resilience and are not the mechanism for AZ-level failover. Option E is incorrect because a single public and single private subnet confines resources to one AZ, directly contradicting the high-availability requirement.

Answer

Use a single NAT Gateway for all private subnets.

Answer

Use a placement group to ensure instances are in different AZs.

Answer

Use only one public subnet and one private subnet.

Question 18

A company uses CloudFront to distribute content globally. They want to reduce data transfer costs and improve performance for users. What feature should they enable?

Accepted Answer

Enable Origin Shield to create a central caching layer.. Origin Shield adds an additional caching layer between CloudFront edge locations and the origin, consolidating origin fetches through a single regional cache. This reduces the number of requests that reach the origin, lowering data transfer costs and improving cache hit ratios and latency for users. It is the specific CloudFront feature designed for this cost-and-performance goal.

Answer

Configure multiple origins with failover.

Answer

Enable Lambda@Edge to modify requests and responses.

Answer

Increase the TTL for cache behaviors to the maximum allowed value.

Question 19

A company has deployed a web application across multiple Availability Zones using an Application Load Balancer. The application experiences increased latency during peak hours. Which action would be MOST effective in reducing latency?

Accepted Answer

Add more EC2 instances to the target group.. Adding more EC2 instances to the target group increases aggregate capacity, distributing the request load across more targets and reducing per-instance queueing and response time. During peak-hour latency spikes, horizontal scaling is the most direct and effective remedy because the bottleneck is typically compute or connection saturation on existing targets.

Answer

Update the health check to use a more frequent interval.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay for the target group.

Question 20

A company uses Amazon S3 for static website hosting. The website serves thousands of users globally, and the company wants to reduce latency and lower data transfer costs. Which solution should the SysOps administrator implement?

Accepted Answer

Set up Amazon CloudFront as a content delivery network (CDN) in front of the S3 bucket.. Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations closer to users, reducing latency and lowering data transfer costs by minimizing direct requests to the S3 origin. By serving cached objects from edge locations, CloudFront also reduces the amount of data transferred from S3, which can significantly decrease S3 data transfer egress charges.

Answer

Use S3 Intelligent-Tiering storage class.

Answer

Enable cross-region replication and serve from multiple buckets.

Answer

Enable S3 Transfer Acceleration on the bucket.