SOA-C02 Mock Exam 81 — 25 Questions

Question 1

A company is designing a multi-tier application in a VPC. The web tier must be in public subnets and the application tier in private subnets. The application tier needs to receive traffic only from the web tier. Which TWO configurations are required?

Accepted Answer

Configure the security group for the application tier to allow inbound traffic from the web tier's security group.. Option A is correct because security groups support stateful, rule-based traffic control using logical references to other security groups. By specifying the web tier's security group as the source in the application tier's inbound rule, traffic is allowed only from instances associated with that web tier security group, regardless of IP address changes. This provides a more secure and manageable configuration than using CIDR blocks, as it automatically adapts to scaling or instance replacements.

Answer

Use a network ACL on the private subnet to deny all inbound traffic except from the public subnet CIDR.

Answer

Add a route to the Internet Gateway in the private subnet's route table.

Answer

Assign public IP addresses to the application tier instances for outbound access.

Question 2

A SysOps administrator needs to route traffic to multiple AWS regions for disaster recovery using Amazon Route 53. The primary region should receive all traffic unless it becomes unhealthy. Which routing policy should be used?

Accepted Answer

Failover routing policy. Failover routing policy is correct because it allows you to configure an active-passive setup where all traffic is directed to a primary resource (e.g., an Elastic Load Balancer in the primary region) unless Route 53 health checks determine that the primary is unhealthy. When the primary fails, Route 53 automatically routes traffic to the secondary (disaster recovery) resource in another region. This directly meets the requirement of sending all traffic to the primary region unless it becomes unhealthy.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 3

A company is using Amazon CloudFront to distribute content globally. They want to restrict access to their content so that only users from specific countries can access it. Which TWO actions can be taken to achieve this?

Accepted Answer

Configure CloudFront geo restriction (whitelist or blacklist) at the distribution level.. Option B is correct because CloudFront geo restriction allows you to whitelist or blacklist countries at the distribution level, directly controlling access based on the geographic location of the viewer's IP address. This is a native CloudFront feature that does not require additional services, making it a straightforward solution for country-based access control.

Answer

Configure an S3 bucket policy with a condition for aws:SourceIp.

Answer

Use IAM policies to restrict access based on the user's location.

Answer

Set up an Application Load Balancer rule to deny traffic from certain IP ranges.

Question 4

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. The stack creation fails with the error 'The maximum number of VPCs has been reached.' The SysOps administrator needs to deploy the stack as soon as possible. What should the administrator do?

Accepted Answer

Request a VPC limit increase from AWS Support.. Option C is correct because the error 'The maximum number of VPCs has been reached' indicates the AWS account has hit the default VPC limit (5 per region). Requesting a service limit increase from AWS Support is the fastest way to raise this soft limit without modifying existing infrastructure or templates, allowing the stack to deploy in the same region.

Answer

Delete unused VPCs to free up capacity.

Answer

Modify the CloudFormation template to use an existing VPC.

Answer

Deploy the stack in a different AWS region.

Question 5

A company uses Amazon CloudWatch Logs to store application logs. The security team needs to be alerted when any log group contains a specific error pattern. The solution must minimize latency and operational overhead. What should a SysOps administrator do?

Accepted Answer

Create a Lambda function subscribed to the CloudWatch Logs log group, which checks for the error pattern and publishes to an SNS topic.. Option C is correct because subscribing a Lambda function directly to a CloudWatch Logs log group allows real-time, low-latency processing of log events as they arrive. The Lambda function can parse each log event for the specific error pattern and publish to an SNS topic to alert the security team, minimizing operational overhead by avoiding additional streaming or polling services.

Answer

Stream the logs to Amazon Kinesis Data Firehose, which then triggers a Lambda function to check for errors.

Answer

Create a CloudWatch metric filter on the log group and set an alarm that triggers an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute and send results via SNS.

Question 6

A company runs a production database on Amazon RDS for PostgreSQL. The SysOps administrator wants to improve query performance for a read-heavy application without increasing costs significantly. Which THREE actions should the administrator take? (Choose three.)

Accepted Answer

Optimize slow queries by reviewing the slow query log. Option C is correct because reviewing the slow query log in RDS for PostgreSQL allows the administrator to identify and optimize poorly performing queries, which directly improves query performance without incurring additional infrastructure costs. This is a standard performance tuning practice that targets the root cause of read-heavy application slowdowns.

Answer

Enable Multi-AZ deployment

Answer

Increase the allocated storage size

Question 7

A SysOps administrator needs to ensure that all S3 buckets in the account have server access logging enabled. The administrator wants to be notified if a bucket is created without logging. What is the most efficient solution?

Accepted Answer

Use AWS Config with a managed rule to evaluate S3 buckets for server access logging.. AWS Config with the managed rule 's3-bucket-server-access-logging-enabled' continuously evaluates all S3 buckets against the desired configuration. When a bucket is created without server access logging, AWS Config automatically flags it as noncompliant and can trigger an SNS notification. This is the most efficient solution because it provides ongoing, automated compliance monitoring without requiring custom scripts or event-driven remediation.

Answer

Periodically run a script to list all buckets and check logging configuration.

Answer

Enable S3 event notifications on the bucket creation event and trigger a Lambda function.

Answer

Use CloudWatch Events to detect CreateBucket API calls and trigger a Lambda function.

Question 8

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator notices that the application's response time is increasing during peak hours. The administrator wants to set up a CloudWatch dashboard that displays the average latency of requests across all instances and the number of healthy hosts. Which metrics should be used?

Accepted Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'HealthyHostCount' metric.. Option B is correct because the ALB's 'TargetResponseTime' metric measures the average time (in seconds) that requests are routed to targets, which directly reflects application latency. The ALB's 'HealthyHostCount' metric shows the number of healthy registered targets, which is the exact metric needed to monitor host health. Together, these two metrics provide the required visibility into average latency and healthy host count across all instances.

Answer

Use the ALB's 'TargetResponseTime' metric and the ALB's 'UnhealthyHostCount' metric.

Answer

Use the ALB's 'RequestCount' metric and the EC2 Auto Scaling group's 'GroupInServiceInstances' metric.

Answer

Use the ALB's 'Latency' metric and the EC2 instance's 'CPUUtilization' metric.

Question 9

A SysOps administrator needs to centrally collect operating system-level metrics from a fleet of Amazon EC2 instances running Amazon Linux 2. The metrics should include memory usage and disk I/O. Which solution should the administrator implement?

Accepted Answer

Install and configure the CloudWatch agent on the EC2 instances.. The CloudWatch agent is the correct solution because it can collect custom OS-level metrics such as memory usage and disk I/O from EC2 instances running Amazon Linux 2. Unlike the default CloudWatch metrics, which only capture hypervisor-level metrics (e.g., CPU, network), the CloudWatch agent uses the procstat and disk plugins to gather detailed system metrics and publish them to CloudWatch as custom namespaces.

Answer

Enable detailed monitoring on the EC2 instances.

Answer

Use AWS CloudTrail to log OS-level metrics.

Answer

Use AWS Systems Manager Inventory to collect metrics.

Question 10

A company hosts a static website on Amazon S3 and uses Amazon CloudFront for content delivery. The marketing team wants to know how many users visit the website each day, including the geographic distribution. Which solution requires the LEAST operational overhead?

Accepted Answer

Enable CloudFront access logs and use Amazon Athena to query the logs in S3.. Option B is correct because enabling CloudFront access logs and querying them with Amazon Athena provides detailed user visit counts and geographic distribution with minimal operational overhead. Access logs contain client IP addresses and request details, which Athena can analyze using SQL without managing servers or complex pipelines. This approach is serverless and cost-effective for periodic analysis.

Answer

Use CloudWatch metrics for CloudFront to view request counts and enable detailed metrics.

Answer

Enable AWS CloudTrail for CloudFront and query the event history.

Answer

Enable CloudFront real-time logs and send them to Amazon Kinesis Data Analytics for analysis.

Question 11

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an alert if it exceeds 80% for 10 consecutive minutes. The instance is in a VPC with no Internet access. What is the MOST efficient way to meet these requirements?

Accepted Answer

Create a CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and an evaluation period of 2.. Option B is correct because a CloudWatch alarm with a period of 5 minutes and an evaluation period of 2 means the alarm evaluates two consecutive 5-minute data points, totaling 10 minutes. Since the EC2 instance is in a VPC with no Internet access, CloudWatch metrics are still reported via the CloudWatch service endpoint within the VPC (or via VPC endpoints), so no additional agent or script is needed. This is the most efficient approach as it uses native CloudWatch functionality without requiring any custom scripts or additional software.

Answer

Use AWS Systems Manager to run a script on the instance that checks CPU and sends an SNS notification.

Answer

Enable detailed monitoring on the EC2 instance and create a CloudWatch alarm on the CPUUtilization metric.

Answer

Install the CloudWatch agent on the EC2 instance to collect CPU metrics and create a CloudWatch alarm.

Question 12

A company has an S3 bucket that stores sensitive data. The security team requires an alert whenever an object in the bucket is deleted. What is the MOST efficient way to achieve this?

Accepted Answer

Enable S3 event notifications and send them to Amazon EventBridge, then create a rule to publish to SNS.. Option D is correct because S3 event notifications can be sent directly to Amazon EventBridge, which allows you to create a rule that triggers an SNS topic for real-time alerts on object deletions. This approach is the most efficient as it avoids the overhead of log analysis or polling, providing immediate notification with minimal latency.

Answer

Configure S3 access logs and stream them to CloudWatch Logs, then create a metric filter.

Answer

Use S3 Inventory to generate a daily report and check for deletes.

Answer

Enable AWS CloudTrail data events for the S3 bucket and create a CloudWatch metric filter.

Question 13

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to be notified when a stack creation fails. Which solution meets this requirement with the LEAST effort?

Accepted Answer

Configure an SNS topic in the CloudFormation stack's 'NotificationARNs' parameter.. Option C is correct because CloudFormation natively supports specifying an SNS topic in the 'NotificationARNs' parameter, which automatically sends notifications on stack events such as creation failure. This requires no additional infrastructure, scripting, or monitoring setup, making it the least-effort solution.

Answer

Create a CloudWatch alarm that triggers when the CloudFormation stack status is 'CREATE_FAILED'.

Answer

Use AWS CloudTrail to monitor CreateStack API calls and trigger an SNS notification.

Answer

Write a custom script that polls the CloudFormation API every minute and sends an SNS notification on failure.

Question 14

A SysOps administrator is investigating a security breach. An IAM user 'Bob' is suspected of performing unauthorized actions. The administrator needs to determine the source IP addresses from which Bob's access keys were used in the last 30 days. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail event history.. AWS CloudTrail event history provides a record of all API calls made by IAM users, including the source IP address from which the request originated. By filtering the event history for the IAM user 'Bob' and the time range of the last 30 days, the administrator can identify the source IP addresses associated with each API call made using Bob's access keys. This directly meets the requirement to determine the source IP addresses of unauthorized actions.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Answer

AWS IAM credential report.

Question 15

A company is using Amazon CloudWatch Logs to collect logs from multiple AWS services. The SysOps administrator needs to query logs across multiple log groups in real-time. Which THREE of the following are capabilities of CloudWatch Logs Insights?

Accepted Answer

Run queries in real-time against incoming log data.. CloudWatch Logs Insights supports real-time queries against incoming log data, allowing you to analyze logs as they are ingested. This is enabled by its ability to query live streams without requiring data to be indexed first, making it suitable for real-time troubleshooting and monitoring.

Answer

Export query results directly to an S3 bucket.

Answer

Schedule queries to run at a specific time.

Question 16

A company uses CloudWatch Logs to store application logs from EC2 instances. The SysOps team needs to search for specific error patterns across all log groups. What is the most efficient way to perform this search?

Accepted Answer

Use CloudWatch Logs Insights to run a query across the log groups.. CloudWatch Logs Insights is purpose-built for ad-hoc querying and analysis of log data across multiple log groups. It allows you to run SQL-like queries (using a query language) to search for specific patterns, filter results, and aggregate data without needing to set up additional infrastructure. This is the most efficient method for the SysOps team's requirement because it provides immediate, interactive search capabilities directly within the AWS Management Console or via the AWS CLI.

Answer

Define a CloudWatch metric filter to count errors and view the metric.

Answer

Create a subscription filter to stream logs to Amazon ES and use Kibana.

Answer

Export the logs to Amazon S3 and use S3 Select to search.

Question 17

A SysOps administrator needs to reduce costs for an Amazon RDS for MySQL DB instance that is used for development. The instance is only needed during business hours (9 AM to 5 PM) on weekdays. Which solution is the MOST cost-effective while maintaining the ability to start and stop the instance on a schedule?

Accepted Answer

Use AWS Instance Scheduler to stop and start the RDS instance on a schedule.. Option D is correct because AWS Instance Scheduler is a fully managed solution designed specifically to start and stop RDS instances on a defined schedule, such as weekdays from 9 AM to 5 PM. This eliminates compute costs during non-business hours while preserving the instance's storage and configuration, making it the most cost-effective and reliable approach for a development environment.

Answer

Create a read replica and promote it when needed.

Answer

Purchase a reserved instance for the DB instance.

Answer

Use a Lambda function to stop the instance at 5 PM and start it at 9 AM on weekdays.

Question 18

A company wants to receive an email notification when an EC2 instance's status check fails. What AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarm. Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending an email via Amazon SNS, when a status check fails. This is the correct service because it directly integrates with EC2 metrics and supports alarm-based notifications for status check failures.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 19

An application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing increased latency. The SysOps administrator checks CloudWatch and sees that the ALB's TargetResponseTime is high, but the backend EC2 instance's CPUUtilization and MemoryUtilization are low. What is the most likely cause?

Accepted Answer

The ALB is experiencing connection queuing due to a high number of concurrent requests.. When TargetResponseTime is high but backend CPU and memory are low, the bottleneck is not the compute capacity of the instances but rather the ALB's ability to forward requests. The ALB has a default connection queue limit (typically 1024 pending connections per target group), and when concurrent requests exceed that, new requests are queued, increasing response time without stressing the backend. This is a classic sign of connection queuing at the load balancer level.

Answer

The application is CPU-bound on the EC2 instances.

Answer

The EC2 instances are throttled due to a burst balance limit.

Answer

The application is waiting on a database query that is slow.

Question 20

A SysOps administrator is setting up monitoring for an Amazon RDS instance. Which TWO metrics are available by default in Amazon CloudWatch for RDS?

Accepted Answer

DatabaseConnections. Amazon RDS automatically publishes a set of metrics to CloudWatch at no additional cost. DatabaseConnections is one of these default metrics, as it tracks the number of database client connections to the RDS instance. This metric is essential for monitoring connection limits and application connectivity health.

Answer

FreeableMemory

Answer

FailedLoginAttempts

Answer

WriteLatency