SOA-C02 Mock Exam 78 — 25 Questions

Question 1

A SysOps administrator notices that an Amazon RDS instance's CPU utilization is consistently above 90% during peak hours. The application is read-heavy and can tolerate eventual consistency. Which action would MOST effectively reduce CPU load?

Accepted Answer

Create one or more read replicas and direct read traffic to them.. The application is read-heavy and can tolerate eventual consistency, making read replicas the ideal solution. By offloading read traffic to one or more read replicas, the primary RDS instance's CPU load is reduced because it no longer has to process all read queries. This directly addresses the high CPU utilization during peak hours without requiring a larger instance or other changes.

Answer

Increase the instance size from db.r5.large to db.r5.xlarge.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Change the storage type to Provisioned IOPS.

Question 2

A SysOps administrator needs to monitor the CPU utilization of an EC2 instance and receive an alert when it exceeds 80% for 10 consecutive minutes. Which AWS service should be used to configure this monitoring and alerting?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it allows you to monitor a specific metric, such as EC2 CPUUtilization, and trigger an action (e.g., an SNS notification) when the metric crosses a defined threshold (80%) for a specified number of consecutive evaluation periods (10 minutes, which with the default 1-minute period equals 10 datapoints). This directly fulfills the requirement for threshold-based alerting on a single metric over a sustained duration.

Answer

Amazon EventBridge

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 3

Which THREE actions can be taken to remediate an EC2 instance that has been compromised according to security best practices? (Select THREE.)

Accepted Answer

Terminate the instance after taking a forensic snapshot.. Terminating the instance after taking a forensic snapshot (Option A) is correct because it ensures the compromised instance is removed from the environment, preventing further malicious activity, while the snapshot preserves the volatile data (memory, disk state) for offline forensic analysis. This aligns with the AWS security best practice of 'preserve evidence, then contain and eradicate' by using EBS snapshots to capture the root volume and any additional data volumes before termination.

Answer

Reboot the instance to clear the compromise.

Answer

Apply any pending patches and restart the application.

Question 4

A company's application running on EC2 instances is experiencing intermittent errors. The SysOps team needs to collect and analyze application logs from all instances centrally. The logs must be stored durably and searchable with minimal latency. Which solution meets these requirements?

Accepted Answer

Install the CloudWatch Logs agent on each EC2 instance and stream logs to Amazon CloudWatch Logs.. Option C is correct because the CloudWatch Logs agent (or unified CloudWatch agent) installed on each EC2 instance can stream application logs in near real-time to Amazon CloudWatch Logs, which provides durable storage, automatic encryption at rest, and a searchable interface via the console, CLI, or API with minimal latency. This centralized logging solution meets the requirements for collecting logs from all instances, storing them durably, and enabling immediate querying without additional infrastructure.

Answer

Enable AWS CloudTrail and store logs in an S3 bucket.

Answer

Use Amazon Kinesis Data Firehose to send logs directly from each instance to Amazon Redshift.

Answer

Store logs locally on each instance and periodically copy them to Amazon S3.

Question 5

A company has enabled AWS CloudTrail in all regions and is logging to an S3 bucket. The security team needs to be alerted within minutes if any IAM user creates a new access key. What is the MOST efficient way to achieve this?

Accepted Answer

Configure CloudTrail to send logs to CloudWatch Logs. Create a metric filter for the IAM event 'CreateAccessKey' and set a CloudWatch alarm that sends an SNS notification.. Option C is correct because CloudTrail can be configured to deliver events to CloudWatch Logs, where a metric filter can be created to match the 'CreateAccessKey' event. A CloudWatch alarm based on that metric filter can then trigger an SNS notification within minutes, providing the most efficient and native AWS solution for real-time alerting without custom code or polling.

Answer

Enable S3 event notifications on the CloudTrail bucket to trigger a Lambda function that parses logs and sends an alert.

Answer

Use AWS Config rules to detect changes to IAM access keys and trigger an SNS notification.

Answer

Run a script on an EC2 instance that polls CloudTrail API for new events every minute and sends alerts.

Question 6

A SysOps administrator is investigating a performance issue where an Amazon RDS for MySQL instance's ReadIOPS metric is consistently high. The database is used by a web application. Which THREE actions should the administrator take to improve performance?

Accepted Answer

Increase the InnoDB buffer pool size to cache more data in memory.. Increasing the InnoDB buffer pool size allows more data and indexes to be cached in memory, reducing the need for disk reads and thus lowering ReadIOPS. This is a direct and effective tuning action for MySQL on RDS when read I/O is the bottleneck.

Answer

Change the storage type to Provisioned IOPS for better performance.

Answer

Enable Multi-AZ deployment for high availability.

Question 7

An application running on Amazon ECS with Fargate is experiencing intermittent failures. The application logs show connection timeouts to an RDS MySQL database. The database is in the same VPC but a different subnet. Which CloudWatch metric should be examined first to diagnose the issue?

Accepted Answer

VPC Flow Logs for the ECS task's elastic network interface.. Option D is correct because VPC Flow Logs capture metadata about network traffic at the elastic network interface level, including whether packets were accepted or rejected. Since the application logs show connection timeouts (not authentication or resource exhaustion), the most likely cause is a network path issue, such as a missing route or security group rule blocking traffic between the ECS task's subnet and the RDS subnet. VPC Flow Logs will reveal if packets from the ECS task to the RDS database are being dropped, allowing you to pinpoint the exact network failure.

Answer

DatabaseConnections for the RDS instance.

Answer

MemoryUtilization for the RDS instance.

Answer

CPUUtilization for the ECS tasks.

Question 8

A company is using AWS Lambda functions to process incoming messages from Amazon SQS. The Lambda function sometimes fails due to a transient error, and the message is not processed. The team wants to automatically retry failed messages and send them to a dead-letter queue (DLQ) after three failed attempts. Which configuration meets these requirements?

Accepted Answer

Configure the SQS queue as an event source for Lambda with a DLQ specified in the Lambda function's dead-letter configuration.. Option C is correct because when an SQS queue is configured as an event source for Lambda, the Lambda service manages the polling and deletion of messages. By specifying a dead-letter queue (DLQ) in the Lambda function's dead-letter configuration (not the SQS redrive policy), failed invocations are retried based on the Lambda function's 'maximumRetryAttempts' setting (default 2, plus the initial attempt equals 3 total). After exhausting retries, the message is sent to the DLQ specified in the Lambda configuration, ensuring automatic retry and DLQ routing without relying on SQS's visibility timeout or redrive policy.

Answer

Set the Lambda function's reserved concurrency to 1 and enable 'maximumRetryAttempts' to 2.

Answer

Create an SQS queue with a visibility timeout that allows three retries before sending to a DLQ.

Answer

Configure the SQS queue with a redrive policy that allows three maximum receives before sending to a DLQ.

Question 9

A company has a fleet of EC2 instances that are part of an Auto Scaling group. The SysOps team wants to automatically replace any instance that fails the status check for 2 consecutive minutes. Which configuration should be used?

Accepted Answer

Configure an EC2 Auto Scaling group to use EC2 status checks and set the health check grace period to 2 minutes.. Option A is correct because an Auto Scaling group can use EC2 status checks to determine instance health. By setting the health check grace period to 2 minutes, the Auto Scaling group will wait 2 minutes after an instance enters the InService state before starting health checks, and then if the instance fails status checks for 2 consecutive minutes, the Auto Scaling group will mark it as unhealthy and automatically terminate and replace it.

Answer

Use AWS Systems Manager Automation to run a script that reboots the instance.

Answer

Configure an Amazon EventBridge rule to trigger an AWS Lambda function that terminates the instance.

Answer

Configure a CloudWatch Alarm on StatusCheckFailed metric to reboot the instance.

Question 10

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps team needs to capture detailed HTTP request-level data, including headers and payload, for troubleshooting purposes. The data should be stored in Amazon S3 for analysis. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable access logs on the ALB and specify an S3 bucket as the destination.. Option C is correct because ALB access logs capture detailed HTTP request-level data, including headers and payload, and can be directly delivered to an S3 bucket without any additional agents or configuration on the EC2 instances. This native integration minimizes operational overhead by eliminating the need to install or manage logging agents on each instance.

Answer

Install the CloudWatch Logs agent on each EC2 instance and configure it to send Apache access logs to CloudWatch Logs, then export to S3.

Answer

Enable VPC Flow Logs and send them to an S3 bucket.

Answer

Use AWS CloudTrail with data events enabled for the ALB.

Question 11

Refer to the exhibit. An IAM policy is attached to an EC2 instance role. The application on the instance attempts to write logs to a log group named 'MyAppLogs' in CloudWatch Logs but fails. What is the likely cause?

Accepted Answer

The policy does not grant permission to create the log group because the resource for CreateLogGroup is specified as the log stream ARN.. The policy grants `logs:CreateLogGroup` but specifies the resource as the log stream ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:log-stream:*`). CloudWatch Logs requires the resource for `CreateLogGroup` to be the log group ARN (`arn:aws:logs:us-east-1:123456789012:log-group:*` or a specific log group name), not a log stream. Since the application is attempting to write logs to a log group that does not yet exist, the `CreateLogGroup` call fails due to the incorrect resource ARN, causing the overall write operation to fail.

Answer

The EC2 instance does not have an internet gateway to reach CloudWatch Logs.

Answer

The log group name in the policy does not match the application's log group.

Answer

The policy lacks permission for 'logs:DescribeLogGroups'.

Question 12

A SysOps administrator needs to ensure that an Amazon RDS instance automatically reboots if it becomes unavailable due to an operating system crash. The instance is a Multi-AZ deployment. What is the correct approach?

Accepted Answer

Enable Multi-AZ on the RDS instance to automatically failover to the standby.. Option D is correct because Multi-AZ deployments automatically handle failover to a standby replica in a different Availability Zone when the primary instance becomes unavailable due to an OS crash. This built-in mechanism ensures high availability without manual intervention, as the standby takes over with the same endpoint.

Answer

Use AWS Systems Manager Run Command to reboot the instance when a health check fails.

Answer

Create an Amazon EventBridge rule to trigger a Lambda function that reboots the instance.

Answer

Configure a CloudWatch Alarm on the DatabaseConnections metric to reboot the instance.

Question 13

An application writes logs to a file on an EC2 instance. The SysOps team needs to send these logs to Amazon CloudWatch Logs in real time. The logs must be encrypted at rest in CloudWatch Logs using a customer-managed KMS key. Which steps are required?

Accepted Answer

Install the CloudWatch Logs agent and associate a KMS key with the log group using the 'associate-kms-key' API.. Option D is correct because the CloudWatch Logs agent can send log data from an EC2 instance to CloudWatch Logs in real time, and the 'associate-kms-key' API (or the equivalent AWS CLI command 'put-log-group-encryption') allows you to associate a customer-managed KMS key with a log group, encrypting the logs at rest. This meets both the real-time delivery and customer-managed KMS encryption requirements without additional services or workarounds.

Answer

Use AWS CloudTrail to deliver logs to CloudWatch Logs with KMS encryption.

Answer

Store logs in S3 with KMS encryption and use S3 event notifications to trigger Lambda to put logs in CloudWatch Logs.

Answer

Install the CloudWatch Logs agent and enable encryption on the EC2 instance volume using KMS.

Question 14

An application running on EC2 instances behind an Application Load Balancer (ALB) sends custom metrics to CloudWatch. The team wants to set an alarm that triggers when the error rate exceeds 5% over a 5-minute period. The alarm must evaluate the metric every minute. Which configuration is required?

Accepted Answer

Period = 60 seconds, Statistic = Average, Evaluation Periods = 5, Datapoints to Alarm = 5. Option C is correct because the alarm must evaluate the error rate every minute (period = 60 seconds) over a 5-minute window. With evaluation periods = 5 and datapoints to alarm = 5, the alarm requires all five 1-minute datapoints to exceed the 5% threshold, ensuring the error rate is sustained for the full 5-minute period. The Average statistic is appropriate because the error rate is a percentage metric that should be averaged over each period.

Answer

Period = 300 seconds, Statistic = Average, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 300 seconds, Statistic = Sum, Evaluation Periods = 1, Datapoints to Alarm = 1

Answer

Period = 60 seconds, Statistic = Sum, Evaluation Periods = 5, Datapoints to Alarm = 5

Question 15

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.. Option C is correct because Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Answer

Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.

Answer

Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.

Answer

Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.

Question 16

A SysOps administrator is troubleshooting an application that runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The administrator checks the ALB access logs and finds entries with 'elb_status_code' 503 and 'target_status_code' '-'. What is the most likely cause?

Accepted Answer

The target instances are unhealthy, causing the ALB to return 503.. The ALB access log entry with `elb_status_code` 503 and `target_status_code` '-' indicates that the load balancer itself generated the 503 error because it could not establish a connection to any healthy target. The dash for the target status code means the request never reached a target instance, which occurs when all targets in the target group are marked unhealthy by the health checks. This is the most common cause of intermittent 503 errors with an ALB.

Answer

The SSL certificate on the ALB has expired.

Answer

The target instances have high CPU utilization.

Answer

The security group on the ALB is blocking traffic.

Question 17

Refer to the exhibit. A SysOps administrator runs the 'list-metrics' command for CPUUtilization. Based on the output, what can the administrator conclude?

Accepted Answer

There are two EC2 instances that have reported CPUUtilization metrics at some point.. The 'list-metrics' output shows two distinct dimensions (i-12345678 and i-87654321) for the CPUUtilization metric, indicating that two EC2 instances have reported this metric at some point. Option B is correct because the presence of two unique instance IDs in the metric data confirms that CPUUtilization has been recorded for both instances, regardless of whether they are currently active or have alarms configured.

Answer

The CPUUtilization metric is only available for EC2 instances.

Answer

Both instances are actively publishing CPUUtilization metrics.

Answer

An alarm has been set on both instances for CPUUtilization.

Question 18

A company is using AWS CloudTrail to log API activity. They need to ensure that log files are protected from unauthorized modification and can be used to verify the integrity of log files. Which AWS feature should be enabled?

Accepted Answer

Enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation uses a SHA-256 hash chain to create a digest file that can be used to verify that log files have not been modified, deleted, or tampered with after delivery. This feature is specifically designed to provide cryptographic assurance of log file integrity, meeting the requirement to protect against unauthorized modification and enable verification.

Answer

Enable S3 server-side encryption on the CloudTrail S3 bucket.

Answer

Stream CloudTrail logs to Amazon CloudWatch Logs.

Answer

Enable S3 Multi-Factor Authentication (MFA) Delete on the CloudTrail S3 bucket.

Question 19

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending a notification via Amazon SNS, when a status check fails. This is the native AWS service designed for real-time monitoring and alerting on metric thresholds, making it the correct choice for this use case.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 20

Which TWO of the following are benefits of using Amazon CloudFront in front of an Application Load Balancer? (Select TWO.)

Accepted Answer

Protect the application against DDoS attacks. Amazon CloudFront provides AWS Shield Standard automatically, which mitigates common Layer 3/4 DDoS attacks at the edge before traffic reaches the ALB. By absorbing volumetric attacks at CloudFront's globally distributed edge locations, the ALB is shielded from malicious traffic, ensuring application availability. This is a key benefit because ALBs alone do not have built-in DDoS protection beyond basic security group rules.

Answer

Simplify VPC endpoint configuration

Answer

Offload SSL/TLS termination from the ALB

Answer

Provide a static IP address for the application