SOA-C02 Mock Exam 72 — 25 Questions

Question 1

A company has a production environment with multiple EC2 instances that send logs to CloudWatch Logs. The operations team wants to search across all log groups for a specific error pattern. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use CloudWatch Logs Insights to query across all log groups.. CloudWatch Logs Insights allows you to run SQL-like queries across multiple log groups in a single query, making it the most efficient way to search for a specific error pattern across all log groups without needing to set up additional infrastructure or manually query each group individually.

Answer

Set up a subscription filter to stream logs to an Amazon ES domain.

Answer

Use CloudWatch Logs filter patterns on each log group.

Answer

Download all logs to an S3 bucket and use Amazon Athena to query.

Question 2

A SysOps administrator needs to ensure that an Amazon RDS for MySQL database is compliant with PCI DSS requirements. Which THREE configurations should be implemented?

Accepted Answer

Require SSL/TLS connections to the database.. Option B is correct because PCI DSS requires strong cryptography for data in transit, and enforcing SSL/TLS on RDS for MySQL (via the require_secure_transport parameter or rds.force_ssl) ensures all client connections are encrypted. Option D is correct because PCI DSS mandates audit trails and monitoring of access to cardholder data; RDS audit logging (e.g., MySQL audit or general/slow query logs exported to CloudWatch Logs) captures database activity for review and forensics. Option E is correct because PCI DSS requires protection of stored cardholder data, and enabling encryption at rest with AWS KMS encrypts the underlying storage, snapshots, and read replicas. Option A is not a PCI DSS requirement—Multi-AZ provides high availability, not compliance controls. Option C is not required by PCI DSS; while backups support availability and retention, the specific 30-day automated backup retention is not a PCI DSS mandate.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Configure automated backups with a retention period of 30 days.

Question 3

A company wants to use AWS WAF to protect a web application behind an Application Load Balancer. Which of the following can AWS WAF inspect? (Choose all that apply.)

Accepted Answer

HTTP headers. AWS WAF inspects the HTTP request components that reach the Application Load Balancer, and HTTP headers (Option A) are one of the core inspectable request parts used in rules such as header-match statements. Query string parameters (Option B) are also inspectable, allowing rules to match on keys/values in the URL query, which is essential for blocking injection or abuse patterns. The request body of HTTPS requests (Option D) can be inspected because AWS WAF supports body inspection (with size limits and sampling behavior) even though the traffic is TLS-encrypted at the ALB, since WAF evaluates the decrypted HTTP request. The URI path (Option E) is inspectable via URI-path match conditions, enabling rules that target specific endpoints or path patterns. Option C is not correct because AWS WAF does not inspect the client's SSL/TLS certificate; client certificate handling/validation is a function of the load balancer's mutual TLS configuration, not a WAF match condition.

Answer

SSL certificate of the client

Question 4

A company runs a stateless web application on EC2 instances behind an Application Load Balancer. The application is deployed in an Auto Scaling group with a minimum of 2 and maximum of 10 instances. During a traffic spike, the Auto Scaling group launches new instances, but the new instances are immediately marked as unhealthy by the ALB and terminated. What could be the cause? (Choose TWO.)

Accepted Answer

The health check path is misconfigured.. Option A is correct because if the ALB health check path is misconfigured (for example, pointing to a non-existent URL or wrong port), the target group health checks will fail and the ALB will mark the newly launched instances as unhealthy, causing the Auto Scaling group to terminate them. Option D is correct because the ALB must be able to reach the instances on the health check and traffic ports; if the instances' security group does not allow inbound traffic from the ALB's security group (or from the ALB subnet CIDRs), the health checks will time out and the instances will be marked unhealthy. Option B is not correct because insufficient capacity in a target AZ would prevent instances from launching at all, not cause them to launch and then be marked unhealthy by the ALB. Option C is not correct because EC2 instances do not need an IAM role to register with an ALB; target registration is handled by the Auto Scaling group or ELB service itself, not by instance-level IAM permissions. Option E is not correct because a larger instance type does not inherently cause ALB health checks to fail; instance size is unrelated to health check success.

Answer

The Auto Scaling group does not have sufficient capacity in the target AZ.

Answer

The instances do not have the required IAM role to register with the ALB.

Answer

The instances are launched with a larger instance type than expected.

Question 5

Refer to the exhibit. A SysOps administrator reviews the CloudWatch alarm configuration. The alarm is in ALARM state. Which statement accurately describes the alarm's behavior?

Accepted Answer

The alarm triggered because the average CPU utilization over 5 minutes exceeded 80% for one consecutive period.. The alarm configuration shows 'Period: 5 minutes' and 'Statistic: Average' with 'Threshold: 80%' and 'Datapoints to alarm: 1 out of 1'. This means the alarm evaluates the average CPU utilization over a single 5-minute period, and if that average exceeds 80%, the alarm transitions to ALARM state immediately after one period's data point is available.

Answer

The alarm evaluates CPU utilization every 5 minutes and requires 3 consecutive breaches to trigger.

Answer

The alarm will automatically resolve when CPU utilization drops below 80% for one period.

Answer

The alarm sends a notification to the SNS topic every 5 minutes while in ALARM state.

Question 6

A company is using Amazon CloudWatch Logs to monitor application logs from EC2 instances. The operations team wants to receive a notification when a specific error pattern appears in the logs. Which solution requires the least operational overhead?

Accepted Answer

Install the CloudWatch agent on EC2 instances and configure it to stream logs to CloudWatch Logs. Create a metric filter for the error pattern and set a CloudWatch alarm that sends an SNS notification.. It uses native CloudWatch capabilities: the CloudWatch agent streams logs to CloudWatch Logs, a metric filter extracts the error pattern, and a CloudWatch alarm directly sends an SNS notification. This approach requires no additional compute resources like Lambda and no custom code, resulting in the least operational overhead. Option C requires creating and managing a Lambda function, which adds complexity and maintenance. Options B and D are more complex with extra services.

Answer

Use Amazon Kinesis Data Firehose to stream all logs to Amazon S3, then run an AWS Glue job to search for the error pattern and trigger an SNS notification.

Answer

Install the CloudWatch agent on EC2 instances, stream logs to CloudWatch Logs, and use a subscription filter to invoke an AWS Lambda function that publishes a message to an SNS topic.

Answer

Configure the application to write logs to a file, use the CloudWatch agent to send logs to CloudWatch Logs, set a metric filter, and use the filter to send data to Amazon EventBridge, which then triggers a Lambda function to send an SNS notification.

Question 7

A SysOps administrator wants to be alerted when an EC2 instance's status check fails. The instance is part of an Auto Scaling group. What is the BEST approach?

Accepted Answer

Create a CloudWatch alarm on the 'StatusCheckFailed' metric.. The 'StatusCheckFailed' metric is automatically published by EC2 to CloudWatch, and a CloudWatch alarm on this metric can directly trigger an SNS notification or other action when the status check fails. This is the simplest and most reliable method for alerting on instance health, regardless of whether the instance is in an Auto Scaling group.

Answer

Use Amazon EventBridge to detect status check failures.

Answer

Enable CloudTrail to monitor EC2 instance status changes.

Answer

Configure an Auto Scaling lifecycle hook to send a notification.

Question 8

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances do not have the CodeDeploy agent installed. Which THREE actions are required to resolve this issue?

Accepted Answer

Install the CodeDeploy agent on the instances using user data in the launch configuration.. The CodeDeploy agent must be present on every instance that participates in a deployment, so the fix is to ensure it is installed on current and future instances. Option A is correct because adding the agent installation commands to the launch configuration's user data ensures that every new instance launched by the Auto Scaling group automatically installs the CodeDeploy agent at boot. Option B is correct because baking the CodeDeploy agent into a custom AMI and using that AMI in the launch configuration guarantees the agent is already present on all newly launched instances without relying on boot-time scripts. Option C is correct because AWS Systems Manager Run Command can remotely execute the agent installation script on the already-running instances in the Auto Scaling group, fixing the instances that caused the current deployment to fail. Option D is incorrect because changing the deployment configuration to OneAtATime only alters how many instances are updated at a time; it does not install the missing CodeDeploy agent. Option E is incorrect because changing the instance type has no bearing on whether the CodeDeploy agent is installed and will not resolve the failure.

Answer

Change the deployment configuration to 'OneAtATime'.

Answer

Update the Auto Scaling group's launch configuration to use a different instance type.

Question 9

A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.

Answer

Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.

Answer

Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.

Answer

Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.

Question 10

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to send logs to CloudWatch Logs. Which steps are necessary to allow this without traversing the internet? (Select TWO.)

Accepted Answer

Attach an IAM role to the instance with permissions to call PutLogEvents.. The EC2 instance must have an IAM role attached that includes permissions for `logs:PutLogEvents` to authenticate and authorize log delivery to CloudWatch Logs. Without this role, the instance cannot sign API requests, even if network connectivity exists. Option C is correct because a VPC endpoint for CloudWatch Logs (com.amazonaws.region.logs) provides private connectivity via AWS PrivateLink, allowing the instance to send logs without traversing the internet or a NAT gateway.

Answer

Place the instance in a public subnet with a public IP.

Answer

Ensure the instance is in the default VPC.

Answer

Attach a NAT gateway to the private subnet's route table.

Question 11

A company's compliance team requires that all changes to IAM policies be logged and immediately alerted. Which AWS solution should be used?

Accepted Answer

Use AWS CloudTrail to log API calls and Amazon CloudWatch Events to send alerts.. AWS CloudTrail records every IAM API call (CreatePolicy, AttachRolePolicy, PutRolePolicy, etc.) as a management event, and CloudWatch Events (now EventBridge) can match those events with a rule and trigger an SNS notification or Lambda for immediate alerting. This combination satisfies both the logging and the real-time alerting requirements.

Answer

Use AWS Config rules to monitor IAM policy changes and send notifications.

Answer

Use Amazon CloudWatch Logs to capture IAM policy changes and create metric filters.

Answer

Use Amazon GuardDuty to detect unauthorized IAM policy changes.

Question 12

A company uses AWS Global Accelerator to improve performance of a TCP application. Users in Asia report higher latency than users in Europe. The endpoints are all in us-east-1. What is the BEST solution?

Accepted Answer

Deploy additional endpoints in an Asia region and configure Global Accelerator to route traffic to the closest endpoint.. VPC peering does not affect Global Accelerator routing; Global Accelerator uses Anycast IPs and routes to endpoints based on location, not VPC peering. Option B is incorrect because adding more endpoints in us-east-1 does not reduce latency for users in Asia; they still have to travel across the Atlantic and Pacific. Option C is incorrect because CloudFront is designed for HTTP/HTTPS (and WebSockets), not general TCP applications. Global Accelerator supports TCP/UDP. Option D is correct because deploying endpoints in an Asia region and configuring Global Accelerator to route traffic to the closest endpoint reduces latency for Asian users.

Answer

Create a VPC peering connection between us-east-1 and an Asia region.

Answer

Add more endpoints in us-east-1 to distribute load.

Answer

Switch to Amazon CloudFront for the TCP application.

Question 13

A SysOps administrator needs to deploy a new version of a Lambda function while minimizing downtime. The function is behind an API Gateway endpoint. What is the MOST effective approach?

Accepted Answer

Create a new Lambda version, then use an alias with weighted routing to shift traffic gradually. The most effective approach for zero-downtime Lambda deployment behind API Gateway is to publish a new version and use an alias with weighted routing (canary or linear). API Gateway integrates with the alias ARN, so traffic can be shifted gradually from the old version to the new one, allowing rollback if errors spike. This is the native, serverless-safe deployment pattern that minimizes downtime and risk.

Answer

Update the Lambda function code in-place and publish a new version

Answer

Create a new Lambda version and update the API Gateway integration to point to it

Answer

Deploy a new Lambda function and use an Amazon Route 53 weighted record set to distribute traffic

Question 14

A company wants to reduce costs for their Amazon RDS for PostgreSQL database. Which TWO actions would help achieve this?

Accepted Answer

Stop the database instance during non-business hours.. Option B is correct because stopping an RDS for PostgreSQL instance during non-business hours eliminates instance-hour charges while it is stopped (storage charges still apply), directly reducing compute costs for a database that is not needed around the clock. Option E is correct because purchasing a Reserved Instance for the DB instance provides a significant discount (up to roughly 69% versus On-Demand for a 3-year, all-upfront term) in exchange for a commitment to a specific instance family and Region, lowering the effective hourly rate for steady-state workloads. Option A is not cost-reducing because Multi-AZ runs a synchronous standby replica in a second AZ, roughly doubling instance and storage cost in exchange for high availability. Option C is a safety control that prevents accidental deletion and has no positive effect on cost. Option D increases cost, since extending backup retention to 35 days keeps more automated backup storage beyond the free allocation and incurs additional backup storage charges.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Enable deletion protection to prevent accidental deletion.

Answer

Increase the backup retention period to 35 days.

Question 15

A company uses Amazon S3 to store backup data. The SysOps administrator needs to ensure that the data is protected against accidental deletion by users with administrative privileges. Which combination of actions should the administrator take? (Choose TWO.)

Accepted Answer

Enable MFA Delete on the S3 bucket.. Option A is correct because MFA Delete adds an additional authentication factor requirement for permanently deleting object versions or changing the versioning state of the bucket, which specifically protects against accidental deletion even by users with administrative privileges. Option C is correct because enabling versioning ensures that overwritten or deleted objects are retained as noncurrent versions, allowing recovery of data that would otherwise be lost. Together, versioning preserves deleted objects and MFA Delete prevents an administrator from permanently removing them or disabling versioning without an MFA token. Option B is not appropriate because a blanket deny of s3:DeleteObject would break legitimate deletion workflows and can be bypassed or modified by users with administrative privileges who can edit bucket policies. Option D is incorrect because lifecycle transitions to S3 Glacier only change storage class and do not protect against deletion. Option E is incorrect because CloudTrail only records API activity for auditing; it does not prevent or recover from accidental deletion.

Answer

Apply an S3 bucket policy that denies s3:DeleteObject for all users.

Answer

Configure a lifecycle policy to transition objects to S3 Glacier.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 16

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. Which configuration step is required?

Accepted Answer

Configure the target group to use HTTPS protocol and install SSL/TLS certificates on the instances.. Configuring the target group to use the HTTPS protocol ensures that the ALB encrypts traffic to the instances using SSL/TLS. The instances must have valid certificates installed to terminate the HTTPS connection. Option A is incorrect because the ALB listener handles encryption between clients and the ALB, not between the ALB and instances. Option C is incorrect because placing instances in a private subnet and using a NAT gateway affects outbound internet access, not encryption between the ALB and instances. Option D is incorrect because a security group rule can allow only HTTPS traffic, but it does not enforce encryption; the traffic protocol must also be HTTPS.

Answer

Configure the ALB listener to use HTTPS with a security policy.

Answer

Place the instances in a private subnet and use a NAT gateway for outbound traffic.

Answer

Create a security group rule that allows only HTTPS traffic from the ALB to the instances.

Question 17

A SysOps administrator is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which THREE components are required to achieve this?

Accepted Answer

An Internet Gateway attached to the VPC. Option B is correct because an Internet Gateway must be attached to the VPC to provide the public subnet (and the NAT Gateway within it) with a path to the internet; without an IGW, no traffic can reach external destinations. Option C is correct because a NAT Gateway deployed in a public subnet performs source NAT, allowing instances in private subnets to initiate outbound internet traffic while remaining unreachable from the internet. Option E is correct because the private subnet's route table must contain a default route (0.0.0.0/0) targeting the NAT Gateway so that outbound traffic from private instances is forwarded to it. Option A is incorrect because a VPC Gateway Endpoint only provides private access to specific AWS services such as S3 or DynamoDB, not general internet access. Option D is incorrect because a Site-to-Site VPN connects the VPC to an on-premises network, not to the public internet for software updates.

Answer

A VPC Gateway Endpoint

Answer

A Site-to-Site VPN connection

Question 18

Which TWO actions should a SysOps administrator take to secure an AWS account root user? (Choose two.)

Accepted Answer

Enable multi-factor authentication (MFA) for the root user.. Option C is correct because enabling MFA on the root user adds a second authentication factor, so a stolen root password alone cannot be used to sign in to the account. Option E is correct because the root user's access keys grant unrestricted programmatic access that cannot be scoped down by IAM policies, so AWS best practice is to never create them and instead use IAM roles or IAM users. Option A is wrong because the root user cannot be deleted; it is permanently tied to the account and can only have its credentials rotated or removed. Option B is wrong because SCPs apply to member accounts in AWS Organizations and do not restrict the root user of the management account, nor can they meaningfully limit root credentials. Option D is wrong because CloudTrail provides monitoring and audit logging of root activity, not a preventive control that secures the root user.

Answer

Delete the root user after creating an admin IAM user.

Answer

Apply a service control policy (SCP) to restrict the root user.

Answer

Enable CloudTrail to monitor root user activity.

Question 19

A company wants to audit all API calls made in their AWS account for compliance. Which THREE AWS services can be used together to capture and store these logs? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (B) is the service that records API activity in an AWS account, capturing management and data events as audit trails, which is exactly what is needed to audit all API calls. Amazon CloudWatch Logs (A) is used to receive and store those CloudTrail event logs via a trail's CloudWatch Logs integration, enabling centralized monitoring and retention of the API call records. Amazon S3 (D) is the destination where CloudTrail delivers the log files for durable, long-term storage and later compliance analysis. AWS Config (C) evaluates resource configurations and compliance against rules rather than capturing API call logs, and Amazon GuardDuty (E) is a threat-detection service that analyzes findings from sources like CloudTrail but does not itself capture and store the raw API call logs.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 20

Which TWO services can be used to centrally manage cryptographic keys for AWS services? (Choose two.)

Accepted Answer

AWS CloudHSM. AWS CloudHSM (A) is correct because it provides dedicated, single-tenant hardware security modules in the AWS cloud where you can generate, store, and manage cryptographic keys, giving you full control over the key material for AWS services and custom applications. AWS Key Management Service (D) is correct because it is a managed service specifically designed to create, store, and centrally control cryptographic keys used to encrypt data across AWS services and applications, integrating natively with many AWS offerings. AWS Certificate Manager (B) is not a key management service; it provisions, manages, and deploys SSL/TLS certificates, though it can integrate with KMS for private CA keys. AWS Identity and Access Management (C) manages identities, permissions, and access policies, not cryptographic key material. AWS Secrets Manager (E) stores and rotates secrets such as database credentials and API keys, but it is not intended for centrally managing cryptographic keys for AWS services.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Secrets Manager