SOA-C02 Mock Exam 80 — 25 Questions

Question 1

An organization uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. A SysOps administrator needs to be alerted when a canary run fails. Which THREE steps are required to set up this alerting?

Accepted Answer

Configure a CloudWatch alarm on the canary's `SuccessPercent` metric.. Option B is correct because CloudWatch Synthetics canaries automatically publish a `SuccessPercent` metric to CloudWatch. By configuring a CloudWatch alarm on this metric (e.g., when `SuccessPercent` drops below 100), the administrator can trigger an alert whenever a canary run fails. This is the standard method for monitoring canary health without needing custom metrics.

Answer

Create a custom CloudWatch metric for canary failures.

Answer

Enable detailed monitoring on the canary.

Question 2

Refer to the exhibit. A SysOps administrator created this IAM policy for an application that sends custom metrics to CloudWatch and writes logs to CloudWatch Logs. The application reports that it cannot publish logs. What is the most likely reason?

Accepted Answer

The resource ARN for the logs actions is incorrect; it should include 'log-group:' before the wildcard.. Option A is correct because the IAM policy uses `arn:aws:logs:us-east-1:123456789012:*` for the `Resource` element of the `logs:PutLogEvents` and `logs:CreateLogGroup` actions. For CloudWatch Logs, the resource ARN must include the `log-group:` prefix before the log group name or wildcard, such as `arn:aws:logs:us-east-1:123456789012:log-group:*`. Without this prefix, the ARN does not match any valid CloudWatch Logs resource, causing the application to fail when attempting to publish logs.

Answer

The policy requires a condition key to restrict access to specific log groups.

Answer

The policy does not allow the cloudwatch:PutMetricData action for the specific metric.

Answer

The application must assume an IAM role to write logs.

Question 3

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified if a stack creation fails. Which method is the most efficient way to achieve this?

Accepted Answer

Specify an SNS topic ARN in the 'NotificationARNs' parameter of the stack.. Option B is correct because CloudFormation natively supports specifying an Amazon SNS topic ARN in the 'NotificationARNs' parameter of the stack. When a stack creation fails, CloudFormation automatically publishes a notification to the SNS topic, which can then deliver the message via email, SMS, or other protocols without any custom polling or additional services.

Answer

Use Amazon Simple Email Service (SES) to send emails on stack failure.

Answer

Create a Lambda function that polls the CloudFormation API for stack status changes.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' events.

Question 4

A company wants to monitor for unauthorized API calls in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, and timestamp of each call. This enables monitoring for unauthorized API activity by analyzing the logs for suspicious patterns or unexpected actions. CloudTrail is specifically designed for auditing API usage, unlike other services that focus on resource configuration or threat detection.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 5

A company uses Amazon RDS for MySQL and wants to monitor the number of database connections in real time. Which CloudWatch metric should the SysOps administrator use?

Accepted Answer

DatabaseConnections. Amazon RDS for MySQL exposes a CloudWatch metric named `DatabaseConnections` that reports the number of client connections to the DB instance. This metric is derived from the MySQL `Threads_connected` status variable and is updated every minute, providing real-time visibility into connection counts for monitoring and alarming.

Answer

CPUUtilization

Answer

ActiveConnections

Answer

ConnectionCount

Question 6

A company is using Amazon RDS for MySQL and needs to encrypt data at rest. Which action should be taken to enable encryption?

Accepted Answer

Create a new RDS DB instance with encryption enabled.. Amazon RDS for MySQL does not support enabling encryption on an existing DB instance. Encryption at rest must be enabled at the time of instance creation. Therefore, the correct action is to create a new RDS DB instance with encryption enabled, and then migrate the data from the unencrypted instance to the new encrypted one.

Answer

Use the RDS console to enable encryption on the existing DB instance.

Answer

Use AWS KMS to create a customer master key and assign it to the existing DB instance.

Answer

Modify the existing RDS DB instance and enable encryption.

Question 7

A company is using AWS CodePipeline to deploy a web application. The security team requires that all code changes be reviewed and approved before deployment to production. Which action should be taken to enforce this requirement?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline before the production deployment stage.. Option A is correct because adding a manual approval action in the CodePipeline pipeline before the production deployment stage enforces a required review and approval gate. This action pauses the pipeline at that point, waiting for an authorized user to manually approve the change before it proceeds to the production stage, directly meeting the security team's requirement.

Answer

Create an IAM policy that denies the codecommit:PutFile action unless the user is in a specific group.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to notify the security team of any deployments.

Answer

Configure a CodeCommit repository to require pull requests for all changes.

Question 8

A company uses CloudWatch Logs to collect application logs from EC2 instances. The logs are critical for troubleshooting. The operations team notices that some log entries are missing during peak hours. The CloudWatch Logs agent is configured with a batch size of 1 MB and a batch timeout of 10 seconds. Which TWO actions should the administrator take to reduce the chance of missing log events?

Accepted Answer

Increase the batch size to 5 MB.. Option C is correct because increasing the batch size from 1 MB to 5 MB allows the CloudWatch Logs agent to buffer more log data before sending a request. During peak hours, log volume spikes can cause the agent to drop events if the batch fills up faster than it can be transmitted. A larger batch size reduces the frequency of API calls and helps ensure that all log entries are successfully delivered.

Answer

Use PutLogEvents directly from the application.

Answer

Reduce the retry count for failed requests.

Answer

Increase the batch timeout to 30 seconds.

Question 9

Which TWO actions can be used to protect data in transit between an EC2 instance and an S3 bucket? (Choose two.)

Accepted Answer

Use HTTPS instead of HTTP when accessing S3 from the EC2 instance.. Option C is correct because HTTPS encrypts the data in transit between the EC2 instance and S3 using TLS, protecting it from eavesdropping or tampering. This ensures that the HTTP request and response payload, as well as headers, are encrypted over the network, which is a direct method to protect data in transit.

Answer

Configure security group rules on the EC2 instance to allow only S3 traffic.

Answer

Apply an S3 bucket policy that denies access unless the request includes the x-amz-server-side-encryption header.

Answer

Enable S3 default encryption (SSE-S3) on the bucket.

Question 10

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer, Auto Scaling group, and RDS database. The SysOps administrator receives a notification that a stack update has failed. The administrator wants to investigate the failure and understand which resource caused the issue. The stack is in the UPDATE_ROLLBACK_IN_PROGRESS state. What should the administrator do to identify the failed resource?

Accepted Answer

View the stack events in the CloudFormation console to see which resource failed and the error message.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_IN_PROGRESS, the most direct way to identify the failed resource is to view the stack events in the CloudFormation console. Each event includes a status reason field that contains the specific error message and the logical resource ID of the resource that caused the failure, allowing the administrator to pinpoint the issue without additional investigation.

Answer

Review the stack's template in the CloudFormation console to check for syntax errors.

Answer

Check the CloudWatch Logs for the EC2 instances in the Auto Scaling group.

Answer

Manually re-run the update with the same parameters to see if the error recurs.

Question 11

A company has a VPC with public and private subnets. The private subnets contain RDS databases that should not be accessible from the internet. Which configuration ensures that the databases are only accessible from the application servers in the public subnets?

Accepted Answer

Create a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers.. Option D is correct because security groups act as a virtual firewall at the instance level, and you can reference another security group as a source. By creating a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers, you ensure that only those application servers (regardless of their IP addresses) can reach the databases. This approach is more dynamic and secure than using CIDR-based rules, as it automatically accommodates changes in the application servers' IP addresses or scaling events.

Answer

Attach an internet gateway to the VPC and route the private subnet's traffic to it.

Answer

Attach a NAT gateway to the private subnet and route traffic through it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

Question 12

A SysOps administrator sets up an alarm to monitor the CPU utilization of an Auto Scaling group. The alarm should trigger a scaling policy when CPU exceeds 80% for 5 consecutive minutes. The alarm state remains 'INSUFFICIENT_DATA' even though instances are running. Which THREE are possible causes?

Accepted Answer

The EC2 instances are not sending CPU utilization metrics to CloudWatch.. Option A is correct because if EC2 instances are not sending CPU utilization metrics to CloudWatch, the alarm will remain in INSUFFICIENT_DATA state. This can happen if the CloudWatch agent is not installed or configured on the instances, or if the instances lack the necessary IAM permissions to publish metrics. Without metric data, CloudWatch cannot evaluate the alarm condition.

Answer

The Auto Scaling group does not have a health check grace period configured.

Answer

The Auto Scaling group uses ELB health checks.

Question 13

An IAM policy is attached to an EC2 instance role to allow sending logs to CloudWatch Logs. The application running on the instance fails to send logs to the log group 'MyAppLogGroup'. Which change is required to fix the issue?

Accepted Answer

Add a new statement allowing logs:PutLogEvents on 'arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogGroup:log-stream:*'.. The IAM policy attached to the EC2 instance role is missing the `logs:PutLogEvents` permission for the specific log stream within the log group. Even if the policy allows `logs:CreateLogStream` and `logs:DescribeLogGroups`, the application cannot send log events without `logs:PutLogEvents` on the log stream resource. Option C adds the required statement with the correct ARN pattern to resolve the failure.

Answer

Install the CloudWatch agent on the instance.

Answer

Attach the policy to the EC2 instance instead of the instance role.

Answer

Change the log group ARN in the policy to include the log stream name.

Question 14

A company wants to receive a notification when the root account is used to perform any action in the AWS account. Which service should be used to monitor this?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. AWS CloudTrail logs all API activity in the account, including root user actions. By creating a CloudTrail trail and sending those logs to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that matches the `RootAccess` event or any API call where `userIdentity.type` is `Root` and trigger a notification via SNS or Lambda. This combination provides real-time monitoring and alerting for root account usage.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack enters a ROLLBACK_IN_PROGRESS state. Which TWO methods can achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the CloudFormation stack status change.. Option B is correct because Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack status changes, including ROLLBACK_IN_PROGRESS, by matching the 'CloudFormation Stack Status Change' event pattern. This allows you to trigger a notification action (e.g., via SNS or Lambda) in real time when the stack enters that state.

Answer

Use AWS Config rules to evaluate the stack state.

Answer

Configure a CloudWatch Logs subscription filter to detect the stack state.

Answer

Create a CloudTrail trail and monitor the UpdateStack API call.

Question 16

Which THREE steps are required to enable AWS CloudTrail log file integrity validation? (Choose three.)

Accepted Answer

Enable CloudTrail to log management events and data events for all resources.. Option A is correct because enabling CloudTrail to log management events and data events for all resources is a prerequisite for log file integrity validation. The integrity validation process relies on digest files that contain hashes of the log files, and these digest files are only generated for trails that capture events. Without logging events, there are no log files to validate, making this step essential for the integrity validation feature to function.

Answer

Create a customer-managed KMS key to encrypt the digest files.

Answer

Configure CloudTrail to deliver logs to CloudWatch Logs for real-time analysis.

Question 17

A company hosts a web application on multiple EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator receives a report that the application is experiencing intermittent 503 errors. The ALB target group health checks are configured to check the /health endpoint every 30 seconds with a healthy threshold of 2 and an unhealthy threshold of 2. The administrator checks the ALB metrics and notices that the number of healthy hosts occasionally drops to zero. The EC2 instances are normal and the application logs show no errors. What is the most likely cause and solution?

Accepted Answer

Increase the health check timeout to 10 seconds.. The intermittent 503 errors and healthy hosts dropping to zero indicate that health checks are timing out before the application can respond. With a default health check timeout of 5 seconds and a 30-second interval, if the /health endpoint occasionally takes longer than 5 seconds (e.g., due to transient load), the ALB marks instances unhealthy after two consecutive failures (unhealthy threshold of 2). Increasing the timeout to 10 seconds gives the endpoint more time to respond, preventing false negatives without changing the check frequency.

Answer

Increase the health check interval to 60 seconds.

Answer

Add more EC2 instances to the target group.

Answer

Decrease the healthy threshold to 1.

Question 18

A SysOps administrator is troubleshooting a Lambda function that is not processing messages from an SQS queue. The function is subscribed to the queue via an event source mapping. The function has a reserved concurrency of 0. Which TWO actions will resolve the issue?

Accepted Answer

Set the reserved concurrency to a value greater than 0.. Reserved concurrency of 0 means the Lambda function has no available execution capacity, so it cannot process any invocations, including those from SQS. Setting reserved concurrency to a value greater than 0 (e.g., 1 or more) allocates the necessary execution slots for the function to run. This directly resolves the issue because the event source mapping will successfully invoke the function only when concurrency is available.

Answer

Add SQS permissions to the Lambda execution role.

Answer

Configure a dead-letter queue for the Lambda function.

Answer

Increase the batch size in the event source mapping.

Question 19

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which configuration ensures that traffic is distributed evenly across all healthy targets?

Accepted Answer

Enable cross-zone load balancing on the ALB. Cross-zone load balancing enables the ALB to distribute incoming traffic evenly across all healthy targets in all enabled Availability Zones, rather than sending traffic only to targets within the same zone as the requesting client. By default, ALBs distribute traffic equally across zones first, then round-robin within each zone, which can lead to uneven load if target counts differ per zone. Enabling cross-zone load balancing overrides this behavior, ensuring each healthy target receives an equal share of requests regardless of its zone.

Answer

Configure sticky sessions (session affinity) on the target group

Answer

Use a Network Load Balancer with path-based routing

Answer

Enable connection draining on the target group

Question 20

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The SysOps administrator needs to restrict access to the ALB so that it only accepts requests from CloudFront. Which solution should the administrator implement?

Accepted Answer

Configure CloudFront to add a custom HTTP header to requests, and configure the ALB to only forward requests that contain that header. Option D is correct because it uses a shared secret mechanism: CloudFront is configured to add a custom HTTP header (e.g., X-Origin-Verify) to all requests, and the ALB's listener rule is configured to only forward requests that contain that specific header value. This ensures that only requests originating from your CloudFront distribution reach the ALB, as the header is not present in direct client requests. This approach is recommended by AWS for restricting ALB access to CloudFront when the origin is an ALB, because CloudFront does not support Origin Access Identity (OAI) with ALB origins.

Answer

Replace the ALB with a Network Load Balancer and use a VPC endpoint

Answer

Create an origin access identity (OAI) and attach it to the CloudFront distribution

Answer

Add a security group rule to the ALB that allows traffic only from the CloudFront IP ranges