SOA-C02 Mock Exam 75 — 25 Questions

Question 1

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

Accepted Answer

AWS Config with a custom rule and AWS Lambda. AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Answer

AWS CloudTrail and Amazon CloudWatch Events

Answer

AWS Service Catalog and AWS Organizations

Answer

Amazon Inspector and AWS Systems Manager

Question 2

A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.. Option C is correct because a VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.

Answer

Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.

Answer

Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.

Answer

Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.

Question 3

A company uses AWS Lambda functions that process data from an Amazon SQS queue. The Lambda function is failing intermittently due to timeouts. The SysOps administrator needs to be notified immediately when the function times out. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch alarm on the Lambda Errors metric that sends an SNS notification. Option B is correct because a CloudWatch alarm on the Lambda Errors metric directly monitors function invocations that result in errors, including timeouts. When the alarm state changes to ALARM, it can immediately trigger an SNS notification, providing the fastest and most efficient notification mechanism without requiring code changes or additional infrastructure.

Answer

Modify the Lambda function to catch the timeout exception and log it to CloudWatch Logs

Answer

Set up a CloudWatch Logs subscription filter to send error logs to an SNS topic

Answer

Configure an Amazon SNS topic as a Lambda destination for the function

Question 4

Which THREE AWS services can be used to monitor and optimize costs? (Choose THREE.)

Accepted Answer

AWS Trusted Advisor. AWS Trusted Advisor provides cost optimization recommendations by analyzing your AWS environment and identifying idle resources, underutilized instances, and reserved instance opportunities. It offers specific checks like 'Low Utilization Amazon EC2 Instances' and 'Idle Load Balancers' that directly help reduce spending.

Answer

AWS Shield

Answer

AWS CloudFormation

Question 5

A company uses Amazon CloudFront to deliver static content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which solution should be used?

Accepted Answer

Configure an origin access control (OAC) and update the S3 bucket policy to allow CloudFront access.. Option D is correct because Origin Access Control (OAC) is the recommended method to restrict S3 bucket access exclusively to CloudFront. OAC uses a CloudFront-owned service principal to sign requests, and the S3 bucket policy must explicitly grant the `s3:GetObject` action to that principal, ensuring no direct S3 access from other sources.

Answer

Use pre-signed URLs for all objects.

Answer

Use an S3 bucket policy that allows access from any AWS service.

Answer

Generate CloudFront key pairs and configure signed URLs.

Question 6

A company has a web application deployed in a VPC with both public and private subnets. The web servers are in public subnets and the database servers are in private subnets. The web servers need to access the internet for updates. Which configuration is required to provide internet access to the web servers while keeping the database servers private?

Accepted Answer

Attach an Internet Gateway to the VPC and add a route to it only in the route tables for the public subnets.. Option C is correct because an Internet Gateway (IGW) is required for any subnet that needs direct internet access. By attaching an IGW to the VPC and adding a default route (0.0.0.0/0) pointing to the IGW only in the public subnet route tables, web servers in those subnets can reach the internet. Database servers in private subnets remain isolated because their route tables lack the IGW route, preventing direct inbound or outbound internet traffic.

Answer

Place both web and database servers in private subnets and use a NAT Gateway for outbound internet access.

Answer

Attach an Internet Gateway to the VPC and add a route to it in the route tables for both public and private subnets.

Answer

Use a VPC Gateway Endpoint to provide internet access to the web servers.

Question 7

A company is using Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is configured with HTTPS listeners. Users report that some requests are failing with a 502 error. Which THREE steps should the SysOps administrator take to troubleshoot the issue? (Choose three.)

Accepted Answer

Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.. The ALB's security group must allow inbound traffic from CloudFront's IP ranges, because CloudFront forwards requests to the ALB using its own IP addresses. Without this rule, the ALB will reject the connection, resulting in a 502 error (Bad Gateway) as CloudFront cannot reach the origin. You can obtain the current CloudFront IP ranges from the AWS IP Address Ranges list and update the security group accordingly.

Answer

Configure the CloudFront distribution to use a custom error response for 502 errors.

Answer

Verify that the ALB is configured to use the X-Forwarded-For header to route requests.

Question 8

A company is using AWS CloudTrail to log API activity in their account. The security team needs to be alerted when an IAM user creates a new access key. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and targets an SNS topic.. Option C is correct because Amazon EventBridge can directly match the `CreateAccessKey` API call from CloudTrail and trigger an SNS topic to send an alert in real time, requiring no custom code or polling. This provides the least operational overhead by using a fully managed, event-driven rule.

Answer

Enable CloudTrail email notifications for management events.

Answer

Configure the IAM user's permissions to require MFA for access key creation.

Answer

Write a Lambda function that periodically scans CloudTrail logs in S3 and sends alerts.

Question 9

A SysOps administrator needs to audit all changes to security groups in an AWS account. Which AWS service should be used to capture these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including all CreateSecurityGroup, AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and DeleteSecurityGroup API actions. By enabling CloudTrail trail logging, the SysOps administrator can capture a complete audit trail of who made changes, when, and from which source IP, which is essential for security group change auditing.

Answer

VPC Flow Logs

Answer

CloudWatch Logs

Answer

AWS Config

Question 10

An application is running on an EC2 instance and is experiencing intermittent connection timeouts. The SysOps administrator wants to capture network traffic to analyze the issue. Which AWS service should be used?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including accepted and rejected connection attempts. This allows the SysOps administrator to analyze the source/destination IPs, ports, protocols, and whether the traffic was allowed or denied, which is essential for diagnosing intermittent connection timeouts.

Answer

CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 11

A company is using Amazon Route 53 as its DNS service. The SysOps team needs to route traffic to multiple resources based on the geographic location of the users. Which THREE routing policies can achieve this? (Select THREE.)

Accepted Answer

Geoproximity routing. Geoproximity routing (Option A) is correct because it allows traffic to be routed based on the geographic location of users and their resources, with the ability to shift traffic using a bias value. This policy is ideal for scenarios where you want to route users to the nearest resource but also have the flexibility to send more traffic to a specific region, such as for load balancing or disaster recovery.

Answer

Simple routing

Answer

Failover routing

Question 12

A SysOps administrator is troubleshooting an issue where an EC2 instance in a private subnet cannot connect to the internet via a NAT Gateway. Which TWO components must be correctly configured for this to work? (Select TWO.)

Accepted Answer

The NAT Gateway must be placed in a public subnet with a route to an Internet Gateway.. The NAT Gateway must reside in a public subnet because it needs a direct route to an Internet Gateway (IGW) to translate private IP addresses to the NAT Gateway's Elastic IP for outbound internet traffic. Without this placement and route, the NAT Gateway cannot forward traffic to the internet, breaking connectivity for instances in private subnets.

Answer

The network ACL for the private subnet must have a rule allowing inbound traffic from the NAT Gateway.

Answer

The EC2 instance must have a public IP address.

Answer

The security group for the EC2 instance must allow inbound traffic on port 80.

Question 13

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for EC2 instances to download updates. Which THREE components are required to achieve this? (Choose three.)

Accepted Answer

Route table in the private subnets with a default route pointing to the NAT Gateway. Option A is correct because a route table associated with private subnets must have a default route (0.0.0.0/0) pointing to a NAT Gateway to direct outbound internet traffic from EC2 instances through the NAT device. This allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet.

Answer

Egress-only Internet Gateway

Answer

AWS Site-to-Site VPN connection

Question 14

A company is using Amazon Route 53 for DNS and wants to route traffic to multiple endpoints based on the geographic location of the user. Which routing policy should the SysOps Administrator use?

Accepted Answer

Geolocation routing. Geolocation routing (Option A) is correct because it allows Route 53 to route traffic based on the geographic location of the DNS query's source IP address. This is ideal for scenarios where you need to direct users to specific endpoints based on their country, continent, or even US state, such as complying with data sovereignty laws or delivering localized content.

Answer

Weighted routing

Answer

Failover routing

Answer

Latency routing

Question 15

An application running on EC2 instances occasionally throws 'Connection refused' errors when connecting to an RDS database. The SysOps administrator needs to determine if the issue is due to database connection limits or network security groups. Which metrics and logs should the administrator examine?

Accepted Answer

Examine the RDS CloudWatch metric DatabaseConnections and analyze VPC Flow Logs for the EC2 instance's network interface.. Option D is correct because 'Connection refused' errors typically stem from either the database exhausting its maximum connections or network-level security groups blocking traffic. The RDS CloudWatch metric `DatabaseConnections` directly shows the current number of active connections against the instance's `max_connections` limit, while VPC Flow Logs capture whether packets are being accepted or rejected by security groups or network ACLs, pinpointing network blockages.

Answer

Check CloudWatch RDS CPUUtilization and CloudTrail logs for RDS API calls.

Answer

Review RDS error logs in CloudWatch Logs and check the EC2 instance's system log.

Answer

Look at the EC2 instance's CloudWatch NetworkIn and NetworkOut metrics and RDS FreeableMemory metric.

Question 16

A company needs to resolve DNS names for on-premises servers from AWS. They have set up a DHCP options set with the on-premises DNS server IP. Which additional step is required?

Accepted Answer

Configure Route 53 Resolver inbound endpoint to forward DNS queries from on-premises to AWS.. Option D is correct because the scenario requires resolving DNS names for on-premises servers from AWS. A Route 53 Resolver inbound endpoint allows on-premises DNS servers to forward queries to AWS, enabling resolution of AWS-hosted DNS names from on-premises. The DHCP options set already provides the on-premises DNS server IP to AWS resources, but the missing step is the reverse path: allowing on-premises to query AWS DNS, which the inbound endpoint facilitates.

Answer

Create a VPC peering connection and use the on-premises DNS IP as the DHCP option set.

Answer

Configure Route 53 Resolver outbound endpoint to forward queries to on-premises DNS.

Answer

Create a VPC peering connection to the on-premises network.

Question 17

Which THREE AWS features can be used to improve the performance of an Amazon DynamoDB table that is experiencing high read latency? (Choose THREE.)

Accepted Answer

Enable DynamoDB Accelerator (DAX).. DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache that can reduce DynamoDB response times from milliseconds to microseconds. By caching frequently read items, DAX offloads read requests from the underlying table, directly addressing high read latency without requiring additional read capacity units or table modifications.

Answer

Enable Auto Scaling for read capacity.

Answer

Use Time to Live (TTL) to delete old items.

Question 18

A SysOps administrator needs to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. Which solution is the MOST operationally efficient?

Accepted Answer

Configure CloudTrail in each account to deliver logs to the same S3 bucket in the central account.. Option D is correct because AWS CloudTrail can be configured in each account to deliver logs directly to the same S3 bucket in a central account by specifying the central bucket's ARN and setting appropriate bucket policies. This approach is operationally efficient as it eliminates the need for intermediate services or replication, reducing complexity and cost while ensuring logs are centralized without manual intervention.

Answer

Use S3 replication to copy logs from each account's bucket to a central bucket.

Answer

Use CloudWatch Logs subscription filter to stream logs to a central account.

Answer

Use Amazon Kinesis Data Firehose to deliver logs from each account to a central S3 bucket.

Question 19

An organization is using AWS CloudFormation to deploy infrastructure. The SysOps administrator needs to receive notifications when stack creation fails. What is the simplest way to achieve this?

Accepted Answer

Provide an SNS topic ARN in the --notification-arns parameter when creating the stack.. Option B is correct because the `--notification-arns` parameter in the AWS CLI `create-stack` command directly associates an SNS topic with the stack, causing CloudFormation to publish notifications for all stack events, including failures. This is the simplest method as it requires no additional services or configuration beyond specifying the SNS topic ARN at stack creation.

Answer

Create a CloudWatch alarm on the 'StackCreationFailure' metric.

Answer

Create an EventBridge rule that triggers on CloudFormation events.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' failures.

Question 20

A company uses AWS Global Accelerator to improve the performance of a web application hosted in multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region as the endpoint. Users report that traffic is not being routed to the closest region. What could be the cause?

Accepted Answer

The health checks for the ALBs are failing, so traffic is diverted to other regions.. Global Accelerator uses health checks to determine endpoint availability. If the health checks for an ALB in a user's closest region are failing, Global Accelerator will consider that endpoint unhealthy and route traffic to the next closest healthy region. This causes users to be directed to a region farther away, even though a closer region exists.

Answer

The Global Accelerator is not configured with a custom routing accelerator.

Answer

The ALBs are not configured to allow cross-region communication.

Answer

The endpoints are configured in the same AWS region.