SOA-C02 Mock Exam 82 — 25 Questions

Question 1

A company runs a batch processing job on a single EC2 instance that runs for 2 hours every night. The job is fault-tolerant and can be interrupted. The SysOps administrator wants to minimize compute costs. What is the MOST cost-effective solution?

Accepted Answer

Use a Spot Instance that can be interrupted but is significantly cheaper.. A Spot Instance is the most cost-effective choice because the job is fault-tolerant and can be interrupted, allowing you to leverage unused AWS EC2 capacity at up to 90% discount compared to On-Demand pricing. Since the job runs for only 2 hours nightly and can handle interruptions, Spot Instances provide the lowest compute cost while meeting the workload requirements.

Answer

Use an On-Demand instance to ensure the job runs every night.

Answer

Purchase a Reserved Instance for 1 year to get a discount.

Answer

Launch a Dedicated Host to ensure consistent performance.

Question 2

A SysOps administrator is troubleshooting an issue where an EC2 instance running a web server is not reachable from the internet. The instance has a public IP and is in a public subnet. The security group allows HTTP and HTTPS from 0.0.0.0/0. The network ACL allows all inbound and outbound traffic. What should the administrator check NEXT?

Accepted Answer

Verify that the subnet's route table has a route to an internet gateway.. The instance is in a public subnet with a public IP and security group allowing HTTP/HTTPS, and the network ACL allows all traffic. The most likely remaining issue is that the subnet's route table lacks a route to an internet gateway (IGW), which is required for traffic to and from the internet. Without this route, the instance cannot send responses back to internet clients, making it unreachable despite having a public IP.

Answer

Check that the instance is associated with an Elastic IP address.

Answer

Confirm that the instance's operating system firewall is disabled.

Answer

Review the VPC Flow Logs for the instance's network interface.

Question 3

A SysOps administrator is troubleshooting a slow-running RDS MySQL instance. The administrator notices that the ReadIOPS metric is consistently high, but the WriteIOPS is low. The instance type is db.m5.large with 300 GB of General Purpose SSD (gp2). What is the most likely cause?

Accepted Answer

The gp2 volume is experiencing I/O credit exhaustion.. The correct answer is D because a db.m5.large instance with 300 GB of gp2 storage has a baseline IOPS of 900 (3 IOPS per GB) and a burst balance of 5.4 million I/O credits. With consistently high ReadIOPS and low WriteIOPS, the volume is likely exhausting its I/O credit balance, causing performance throttling. This is a classic symptom of gp2 I/O credit exhaustion, where read-heavy workloads deplete the burst bucket, leading to degraded performance.

Answer

The instance type is too small for the workload.

Answer

The database is experiencing write contention.

Answer

The network bandwidth is insufficient.

Question 4

A SysOps administrator is configuring a CloudWatch dashboard to monitor an application. Which TWO of the following are valid widget types that can be added to a CloudWatch dashboard?

Accepted Answer

Number. Option D (Number) is correct because CloudWatch dashboards support the Number widget type, which displays a single metric value as a numeric statistic (e.g., sum, average, or sample count) and can optionally show a trend arrow. This widget is ideal for showing key performance indicators like current error count or latency.

Answer

Line

Answer

Alarm

Answer

Bar chart

Question 5

Refer to the exhibit. A SysOps administrator runs the AWS CLI command shown. The output shows that the CPUUtilization average over the period is 75%. However, the administrator knows that the instance was idle for the first 15 minutes of the hour. Which explanation best describes why the average might be misleading?

Accepted Answer

The average statistic over a period of 300 seconds can smooth out spikes, and the overall average of 75% may be due to a high spike after the idle period.. Option B is correct because the average statistic over a 300-second period can smooth out brief but intense spikes in CPU utilization. In this scenario, the instance was idle for the first 15 minutes, so the average of 75% over the entire hour must be driven by a very high CPU spike later in the period. The period of 300 seconds aggregates data into 5-minute intervals, which can mask the idle period and make the overall average misleading.

Answer

The period is too long; a shorter period like 60 seconds would show more granular data.

Answer

The command should include --unit Percent to get accurate data.

Answer

The --statistics parameter should be set to 'Sum' to capture total usage.

Question 6

Refer to the exhibit. A SysOps administrator runs the CloudWatch Logs Insights query shown. What does this query do?

Accepted Answer

Counts the number of ERROR and FATAL log entries per 5-minute interval and displays them in descending order by time.. The CloudWatch Logs Insights query uses `stats count(*) by bin(5m)` to aggregate log events into 5-minute time buckets, then filters with `filter @message like /ERROR|FATAL/` to include only those severity levels. The `sort @timestamp desc` orders the resulting time buckets in descending chronological order, producing a count of ERROR and FATAL entries per 5-minute interval. This matches option B exactly.

Answer

Groups ERROR and FATAL entries by log stream name.

Answer

Displays the full log messages of all ERROR and FATAL entries.

Answer

Deletes all log entries containing ERROR or FATAL older than 5 minutes.

Question 7

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences unpredictable traffic spikes. Which AWS service should be used to automatically adjust the number of EC2 instances based on demand, optimizing cost and performance?

Accepted Answer

AWS Auto Scaling. AWS Auto Scaling is the correct service because it automatically adjusts the number of EC2 instances in response to demand, using scaling policies based on metrics like CPU utilization or request count. This ensures that the application can handle traffic spikes without manual intervention, optimizing both cost (by scaling down during low demand) and performance (by scaling up during spikes). The service integrates directly with the Application Load Balancer to register and deregister instances as needed.

Answer

Amazon CloudWatch

Answer

Elastic Load Balancing

Answer

AWS Lambda

Question 8

A company is using Amazon S3 to store historical data. The data is accessed frequently for the first 30 days, then accessed infrequently for the next 90 days, and after 120 days it is rarely accessed but must be retained for 7 years for compliance. Which S3 lifecycle policy provides the LOWEST cost while meeting these requirements?

Accepted Answer

Standard for 30 days, then transition to Standard-IA for 90 days, then to Glacier Deep Archive.. Option A is correct because it aligns the storage class transitions precisely with the access patterns: Standard for frequent access (first 30 days), Standard-IA for infrequent access (next 90 days), and Glacier Deep Archive for long-term retention (after 120 days). This minimizes cost by avoiding paying for premium storage when data is rarely accessed, while still meeting the 7-year compliance requirement at the lowest possible storage cost.

Answer

Standard for 30 days, then transition to One Zone-IA for 90 days, then to Glacier Deep Archive.

Answer

Standard for 120 days, then transition to Glacier Deep Archive.

Answer

Standard for 30 days, then transition to Glacier for the remaining life.

Question 9

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered together. The VPCs are in the same AWS region. An EC2 instance in VPC A (10.0.1.0/24) cannot ping an EC2 instance in VPC B (10.0.2.0/24). Both VPCs have route tables that include the CIDR of the other VPC with the peering connection as the target. The security groups and network ACLs allow all inbound and outbound traffic. What is the most likely issue?

Accepted Answer

There is a third VPC C that is peered with both VPC A and VPC B, and VPC A is trying to reach VPC B through VPC C.. Option C is correct because transitive routing is not supported with VPC peering. Even though VPC A and VPC B are both peered with VPC C, traffic cannot flow from VPC A to VPC B through VPC C. Each VPC peering connection is a one-to-one relationship, and EC2 instances in VPC A cannot reach VPC B unless there is a direct VPC peering connection between them. The route tables in VPC A and VPC B must point directly to each other's CIDR via a direct peering connection, not through an intermediate VPC.

Answer

The route tables do not have a route to the other VPC's CIDR.

Answer

The VPC peering connection is not enabled for DNS resolution.

Answer

The VPCs are in different AWS regions.

Question 10

A SysOps administrator notices that an EC2 instance's CPU utilization is consistently above 90% during peak hours. Which action will improve performance without over-provisioning resources?

Accepted Answer

Change the instance type to a larger size, such as moving from t3.medium to t3.large.. Option C is correct because changing the instance type to a larger size (e.g., from t3.medium to t3.large) vertically scales the instance, providing more vCPUs and memory to handle the increased CPU load during peak hours. This directly addresses the high CPU utilization without over-provisioning, as you are only scaling up the specific resource that is constrained. Spot Instances (A) do not improve performance; they offer lower cost but same performance. Increasing EBS volumes (B) does not affect CPU performance. Auto Scaling (D) adds more instances (horizontal scaling), which can over-provision if the single instance's capacity is sufficient after a vertical scale-up.

Answer

Use Spot Instances instead of On-Demand.

Answer

Increase the number of EBS volumes attached to the instance.

Answer

Configure Auto Scaling to add more instances during peak hours.

Question 11

Which TWO actions can reduce costs for an Amazon EC2 environment that runs non-critical batch jobs that can be interrupted? (Choose TWO.)

Accepted Answer

Use Scheduled Reserved Instances.. Scheduled Reserved Instances allow you to reserve capacity for recurring time windows, such as daily or weekly batch jobs. This provides a significant discount over On-Demand pricing (up to 30-40%) while ensuring capacity is available when needed, making it cost-effective for predictable, interruptible workloads.

Answer

Associate Elastic IP addresses with the instances.

Answer

Use Dedicated Hosts.

Answer

Use On-Demand Instances.

Question 12

A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?

Accepted Answer

The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.. Option B is correct because the VPC route table contains a more specific route (0.0.0.0/0) pointing to an Internet Gateway, which overrides the less specific route to the virtual private gateway for traffic destined to the on-premises network. When the on-premises router advertises a specific route (e.g., 10.0.0.0/16) via BGP, the VPC route table must have a matching route (or a more specific one) pointing to the virtual private gateway; otherwise, the default route to the Internet Gateway takes precedence, sending traffic over the internet instead of Direct Connect.

Answer

The on-premises network does not have a route to the VPC CIDR.

Answer

The BGP session between the on-premises router and the Direct Connect router is down.

Answer

The virtual private gateway is not attached to the VPC.

Question 13

Which TWO configurations can improve the performance of an Amazon RDS for PostgreSQL database that is experiencing high read latency? (Choose TWO.)

Accepted Answer

Enable provisioned IOPS on the DB instance.. Option B is correct because enabling Provisioned IOPS on an Amazon RDS for PostgreSQL database provides consistent and predictable I/O performance, which directly reduces read latency by ensuring sufficient IOPS for read-intensive workloads. Option C is correct because creating a read replica offloads read traffic from the primary DB instance to the replica, reducing contention and improving read latency for the primary instance.

Answer

Upgrade to a larger instance size.

Answer

Enable Multi-AZ deployment.

Answer

Enable storage auto-scaling.

Question 14

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The SysOps administrator receives reports that some users are experiencing intermittent HTTP 503 errors. What is the most likely cause?

Accepted Answer

The health checks are failing for the target group, causing the ALB to stop sending traffic to all instances.. HTTP 503 errors from an Application Load Balancer typically indicate that the target group has no healthy registered targets. When health checks fail for all instances in the target group, the ALB cannot route traffic to any backend, resulting in a 503 response. This is the most common cause of intermittent 503 errors in ALB architectures.

Answer

The security group attached to the ALB does not allow inbound traffic on port 443.

Answer

The EC2 instances do not have the correct IAM role to register with the ALB.

Answer

The ALB idle timeout is set too low.

Question 15

A company uses a Network Load Balancer (NLB) with a static IP address. The SysOps administrator needs to enable client IP preservation for the NLB so that backend instances see the original client IP. Which TWO conditions are required for client IP preservation to work?

Accepted Answer

The target group must be of type 'instance'.. Option A is correct because client IP preservation for a Network Load Balancer (NLB) requires the target group to be of type 'instance'. When the target group is instance-based, the NLB can forward packets with the original source IP address intact, allowing backend instances to see the client's IP directly. This is not supported when the target group is of type 'IP' because the NLB must perform NAT to route to the specified IP addresses.

Answer

The NLB must have TLS listeners.

Answer

Proxy protocol must be enabled on the target group.

Answer

Cross-zone load balancing must be enabled.

Question 16

A SysOps administrator is planning a VPC design with high availability for an application that must tolerate the failure of an entire Availability Zone. Which TWO configurations should be implemented? (Select TWO.)

Accepted Answer

Deploy a NAT Gateway in each Availability Zone.. Option B is correct because deploying a NAT Gateway in each Availability Zone ensures that private subnets in each AZ have a route to the internet via a NAT Gateway that resides in the same AZ, preventing cross-AZ data transfer costs and maintaining high availability if an entire AZ fails. Option C is correct because launching EC2 instances in at least two Availability Zones provides fault tolerance at the compute layer, allowing the application to continue serving traffic even if one AZ becomes unavailable.

Answer

Use a single NAT Gateway for all private subnets.

Answer

Use a placement group to ensure instances are in different AZs.

Answer

Use only one public subnet and one private subnet.

Question 17

A company wants to receive alerts when its AWS costs exceed a certain threshold. Which AWS service should be used?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost and usage budgets and receive alerts when actual or forecasted costs exceed a defined threshold. It directly supports cost-based alerting with actions such as sending an SNS notification or applying an IAM policy to restrict resources when the budget limit is breached.

Answer

Amazon CloudWatch

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Question 18

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. Users report slow load times. The SysOps team notices that all traffic goes to a single availability zone. Which action should be taken to improve performance and reliability?

Accepted Answer

Configure the ALB to use subnets in at least two Availability Zones. The correct action is to configure the ALB to use subnets in at least two Availability Zones. An ALB is a regional service that requires subnets in multiple AZs to distribute incoming traffic across healthy targets in those zones. When all traffic goes to a single AZ, it indicates the ALB is only attached to one subnet, creating a single point of failure and limiting the pool of EC2 instances that can serve traffic, which directly causes slow load times and reduced reliability.

Answer

Add more EC2 instances in the same Availability Zone

Answer

Replace the ALB with a Network Load Balancer (NLB)

Answer

Enable cross-zone load balancing on the ALB

Question 19

A company has an Auto Scaling group of EC2 instances behind an Application Load Balancer. The SysOps administrator notices that the healthy host count is lower than expected. The instances are in service, and security groups allow traffic. What is a likely cause?

Accepted Answer

The health check path is returning HTTP 503.. The correct answer is C because a health check path returning HTTP 503 (Service Unavailable) indicates that the target instances are reachable but the application is failing to respond correctly. The Application Load Balancer (ALB) marks instances as unhealthy when the health check receives any non-2xx or non-3xx response, which reduces the healthy host count even though the instances are in service and security groups are properly configured.

Answer

The instances are not registered with the target group.

Answer

The security group for the load balancer does not allow inbound traffic.

Answer

The target group is not associated with the load balancer.

Question 20

A SysOps administrator is troubleshooting DNS resolution issues for a custom domain used by an Application Load Balancer. Which TWO steps should the administrator take to diagnose the issue? (Choose two.)

Accepted Answer

Verify that the Route 53 alias record points to the ALB's DNS name. Option B is correct because a Route 53 alias record must point to the ALB's DNS name (e.g., my-alb-1234567890.us-east-1.elb.amazonaws.com) to properly route traffic to the load balancer. If the alias record is misconfigured or points to an incorrect resource, DNS resolution will fail or resolve to an unintended IP, causing the custom domain not to work.

Answer

Ensure the VPC's CIDR block does not overlap with the ALB's IP range

Answer

Verify that the ALB's security group allows inbound traffic on port 443

Answer

Check the health status of the ALB's target group