SOA-C02 Mock Exam 83 — 25 Questions

Question 1

Refer to the exhibit. A SysOps administrator runs the command and sees the output. The administrator then creates a CloudWatch alarm on the CPUUtilization metric for this instance, but the alarm state remains 'INSUFFICIENT_DATA'. What is a likely cause?

Accepted Answer

The EC2 instance is stopped or terminated.. The command output shows the instance state is 'stopped'. CloudWatch cannot retrieve metrics from a stopped or terminated EC2 instance because the hypervisor is no longer running the instance's operating system or collecting CPU utilization data. When no metric data points are received for the configured alarm period, the alarm transitions to 'INSUFFICIENT_DATA' state.

Answer

Detailed monitoring is not enabled.

Answer

The instance is in a different AWS region.

Answer

The metric name is misspelled.

Question 2

A company uses Amazon CloudFront to deliver static content from an Amazon S3 bucket. Users in Europe report slow load times. Which CloudFront feature would MOST effectively improve performance for these users?

Accepted Answer

Add additional edge locations in Europe and use regional edge caches.. Adding additional edge locations in Europe and using regional edge caches (Option B) reduces latency by serving content from geographically closer points of presence (PoPs) and by caching objects at a regional layer that aggregates requests from multiple edge locations, which improves cache hit ratios and reduces the load on the origin. This directly addresses the slow load times reported by European users by minimizing the distance data must travel.

Answer

Enable origin shield.

Answer

Enable HTTP/3 (QUIC) support on the distribution.

Answer

Configure geo restriction to allow only European users.

Question 3

A SysOps Administrator is configuring a Network Load Balancer (NLB) for a TCP-based application. The application requires that clients see the original source IP address of the request. Which configuration should the Administrator use?

Accepted Answer

Use the NLB default behavior; no additional configuration needed.. Network Load Balancers (NLBs) preserve the original source IP address of clients by default when forwarding TCP traffic to targets. This is because NLBs operate at Layer 4 and do not terminate the TCP connection; instead, they pass packets directly to the backend, allowing the target to see the client's IP. No additional configuration is required for this behavior.

Answer

Use an Application Load Balancer instead, which preserves the source IP.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Enable Proxy Protocol v2 on the target group.

Question 4

A SysOps administrator receives an alarm that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group behind an Application Load Balancer. The administrator needs to ensure that the instance is automatically replaced and that the root cause is investigated. What is the MOST efficient combination of actions to achieve this?

Accepted Answer

Configure an Auto Scaling lifecycle hook to terminate the unhealthy instance and send the instance system log to an S3 bucket for analysis.. Option A is correct because it combines automatic instance replacement via the Auto Scaling group's health check (which marks the instance unhealthy and terminates it) with a lifecycle hook that captures the instance's system log before termination and sends it to S3 for root cause analysis. This is the most efficient approach as it requires no manual intervention and preserves diagnostic data.

Answer

Create a CloudWatch alarm that triggers an SNS notification to the administrator to manually replace the instance.

Answer

Reboot the instance from the AWS Management Console and then review CloudTrail logs.

Answer

Manually stop and start the instance to recover it, then check the system logs.

Question 5

Refer to the exhibit. A SysOps administrator runs the command to find 'CreateKeyPair' events in January 2023 but gets an empty list. The administrator knows that key pairs were created during that time. What is the most likely reason?

Accepted Answer

The events occurred in a different AWS region.. The `aws cloudtrail lookup-events` command returns events only from the region specified in the AWS CLI configuration (or the `--region` parameter). If the administrator did not specify a region, the command defaults to the region set in the CLI profile. Since `CreateKeyPair` events are regional (each key pair is created in a specific region), the empty result indicates the events occurred in a different AWS region than the one queried.

Answer

The start and end times are outside the 90-day retention period.

Answer

CloudTrail is not enabled in the account.

Answer

The IAM user does not have 'cloudtrail:LookupEvents' permission.

Question 6

A SysOps administrator needs to ensure that all S3 buckets in the account are configured with server access logging. Which AWS service can evaluate the buckets and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously evaluate your S3 buckets against a managed rule (s3-bucket-server-access-logging-enabled) and automatically remediate non-compliant buckets using AWS Systems Manager Automation documents. This allows the SysOps administrator to enforce server access logging as a compliance requirement without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 7

A company is experiencing intermittent performance issues with an application running on an EC2 instance. The CloudWatch metrics show high CPU utilization but no correlation with the timing of the issue. The SysOps administrator needs to collect detailed performance data to identify the root cause. Which AWS service should the administrator use to capture network-level metrics and logs?

Accepted Answer

Enable VPC Flow Logs for the EC2 instance's subnet.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet count) at the network interface level, which is essential for diagnosing network-related performance issues. Since the problem is intermittent and uncorrelated with CPU, network-level metrics can reveal issues like packet loss, throttling, or latency that application logs or CPU metrics alone cannot. This directly addresses the need for detailed network-level data.

Answer

Configure a CloudWatch Logs agent on the instance to send application logs.

Answer

Use AWS CloudTrail to log all API calls made to the instance.

Answer

Enable AWS Config to track configuration changes to the instance.

Question 8

A SysOps administrator notices that an RDS instance's CPU utilization is consistently above 80% during peak hours. The administrator wants to set up automated actions to scale the database and also notify the team. What should the administrator do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization that triggers a Lambda function to modify the RDS instance class to a larger size.. Option C is correct because it uses a CloudWatch alarm on CPU utilization to trigger a Lambda function, which can programmatically call the ModifyDBInstance API to scale the RDS instance class up during peak hours. This provides automated, event-driven scaling based on actual utilization, and the same alarm can be configured to send an SNS notification to the team. This approach is flexible and allows custom logic in Lambda, such as checking current metrics before scaling.

Answer

Configure a scheduled scaling action to change the instance class during peak hours.

Answer

Add the RDS instance to an Auto Scaling group.

Answer

Enable RDS Auto Scaling for the instance.

Question 9

A SysOps administrator is designing a monitoring solution for a critical application running on EC2 instances. The application requires that all API calls to the environment are logged for security analysis. Which TWO services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS CLI, SDKs, and other services. CloudTrail logs provide the identity of the caller, the time of the call, the source IP address, and the request parameters, which are essential for security analysis. Option B (Amazon CloudWatch Logs) is also correct because CloudTrail logs can be delivered to CloudWatch Logs for centralized monitoring, alerting, and retention, enabling real-time analysis and integration with other AWS services.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 10

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer (ALB) in the public subnets routes traffic to EC2 instances in the private subnets. The EC2 instances need to access the internet for software updates. Which solution is MOST secure and cost-effective?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet route tables pointing 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing inbound connections from the internet. This is the most secure and cost-effective solution because it uses a managed AWS service that scales automatically and incurs charges only for usage and hourly uptime, avoiding the need for a bastion host or VPN.

Answer

Set up a VPN connection to an on-premises network and route internet traffic through it.

Answer

Assign public IP addresses to the EC2 instances and route traffic directly.

Answer

Attach an internet gateway to the private subnets and route 0.0.0.0/0 to it.

Question 11

A company uses AWS CloudTrail to log API calls in a multi-account environment. The security team wants to be alerted when an IAM user in the production account modifies a security group to allow inbound SSH from 0.0.0.0/0. Which combination of actions should be taken to meet this requirement?

Accepted Answer

Stream CloudTrail logs to CloudWatch Logs, create a metric filter for the specific API call, and set a CloudWatch Alarm that sends a notification to an SNS topic.. Option D is correct because CloudTrail logs can be streamed to CloudWatch Logs, where a metric filter can be created to match the specific API call (e.g., AuthorizeSecurityGroupIngress with a CIDR of 0.0.0.0/0 and port 22). A CloudWatch Alarm based on that metric can then trigger an SNS notification, providing a real-time alert for the exact security group modification.

Answer

Use AWS Config managed rule 'restricted-ssh' to detect the security group change and trigger an SNS notification.

Answer

Enable AWS Security Hub and configure a custom insight to detect the security group modification.

Answer

Create an AWS Lambda function that is triggered by CloudTrail events and publishes to SNS.

Question 12

Refer to the exhibit. A SysOps administrator deploys this CloudFormation stack. The EC2 instance launches and the web server starts. However, the CloudWatch alarm does not trigger even when CPU utilization exceeds 80%. What is the MOST likely reason?

Accepted Answer

The alarm statistic should be 'Maximum' instead of 'Average' to catch CPU spikes that may not sustain the average above 80% for 5 minutes.. Option B is correct because the alarm is configured with the 'Average' statistic, which smooths out CPU utilization over the 5-minute period. If CPU utilization spikes above 80% but does not sustain an average above that threshold for the entire duration, the alarm will not trigger. Using the 'Maximum' statistic would catch any single data point exceeding 80% within the period, making it appropriate for detecting short-lived spikes.

Answer

The alarm action is missing a valid SNS topic ARN.

Answer

The alarm dimension is incorrect; it should use the instance's private IP.

Answer

The user data script fails to start the web server, causing the instance to be unhealthy.

Question 13

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). The SysOps administrator needs to be notified if the ALB's error rate exceeds 5% for 5 consecutive minutes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Use a CloudWatch alarm on the ALB's 'HTTPCode_ELB_5XX_Count' metric with a math expression to calculate error rate.. Option B is correct because CloudWatch can directly monitor the ALB's 'HTTPCode_ELB_5XX_Count' metric and combine it with the 'RequestCount' metric using a math expression to calculate the error rate as a percentage. This approach requires no additional logging or external services, and a CloudWatch alarm can be configured to trigger an SNS notification when the error rate exceeds 5% for 5 consecutive minutes, minimizing operational overhead.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena to detect error rates.

Answer

Enable CloudTrail for the ALB and create a metric filter for 5xx errors.

Answer

Use AWS Config rules to monitor the ALB configuration and trigger a notification on changes.

Question 14

Refer to the exhibit. An EC2 instance is running the CloudWatch Logs agent and uses the IAM policy shown. The agent is configured to send logs to the log group 'MyAppLogGroup'. However, logs are not appearing. What is the MOST likely cause?

Accepted Answer

The policy is missing permission to create the log group if it does not exist.. Option C is correct because the CloudWatch Logs agent cannot automatically create a log group; it requires explicit permission via the `logs:CreateLogGroup` action in the IAM policy. Without this permission, if the log group 'MyAppLogGroup' does not already exist, the agent will fail to send logs, even though the `logs:PutLogEvents` action is allowed. The policy shown only grants `logs:PutLogEvents` and `logs:DescribeLogStreams`, missing the necessary `logs:CreateLogGroup` and `logs:CreateLogStream` actions for initial setup.

Answer

The log group name in the policy does not match the agent configuration.

Answer

The policy does not allow the 'logs:PutLogEvents' action.

Answer

The Resource ARN incorrectly specifies a wildcard after the log group name.

Question 15

A company wants to centrally collect and analyze logs from all AWS accounts in an organization. The logs include CloudTrail, VPC Flow Logs, and AWS Config logs. Which solution is the most scalable and cost-effective?

Accepted Answer

Configure each account to deliver logs to a centralized S3 bucket and use Amazon Athena to query them.. Option D is correct because it uses a centralized S3 bucket to aggregate logs from all accounts, which is highly scalable and cost-effective due to S3's low storage costs and lifecycle policies. Amazon Athena then allows serverless, pay-per-query analysis of the logs without needing to provision or manage any infrastructure, making it ideal for ad-hoc and cross-account log analysis.

Answer

Stream all logs to a central CloudWatch Logs account using cross-account subscriptions.

Answer

Use CloudWatch Logs Insights to query logs from each account individually.

Answer

Use Amazon Kinesis Data Firehose to deliver logs to an Amazon Elasticsearch Service cluster.

Question 16

A company has an AWS Lambda function that processes files uploaded to an S3 bucket. The function fails intermittently with a timeout error. What should the SysOps administrator do to monitor and resolve this issue?

Accepted Answer

Increase the Lambda function timeout and review the function logs in CloudWatch Logs.. Option C is correct because increasing the Lambda function timeout directly addresses the intermittent timeout error by allowing the function more time to complete execution before Lambda terminates it. Reviewing CloudWatch Logs is essential to identify the root cause, such as slow downstream dependencies or inefficient code, enabling targeted optimization. This approach aligns with standard troubleshooting for Lambda timeout issues.

Answer

Place the S3 bucket in a different AWS region to reduce latency.

Answer

Enable provisioned concurrency for the Lambda function.

Answer

Configure EC2 Auto Scaling to launch more instances for the Lambda function.

Question 17

A SysOps administrator notices that an EC2 instance's CPU utilization has been at 100% for the past hour. The administrator checks CloudWatch metrics and sees no anomalies in network or disk I/O. Which step should the administrator take to investigate further?

Accepted Answer

Enable detailed monitoring on the EC2 instance to get 1-minute CloudWatch metrics.. Detailed monitoring (1-minute metrics) provides higher-resolution data than the default 5-minute metrics, allowing the administrator to identify short-lived CPU spikes or patterns that might be averaged out in the standard 5-minute interval. Since network and disk I/O appear normal, the issue is likely a process or application consuming CPU, and finer-grained metrics help pinpoint the timing and correlate with specific events or logs.

Answer

Install the CloudWatch Logs agent on the instance to capture system logs.

Answer

Check the EC2 instance's CPU credit balance in CloudWatch.

Answer

Stop the EC2 instance and start it again to reset the CPU.

Question 18

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect to an on-premises network using a site-to-site VPN. The on-premises network uses 10.0.0.0/16 as well. Which solution avoids routing conflicts?

Accepted Answer

Use a NAT instance to translate addresses for overlapping ranges.. Option D is correct because a NAT instance can translate the overlapping IP addresses from the on-premises network (10.0.0.0/16) to a different IP range within the VPC, allowing communication without routing conflicts. The NAT instance performs destination NAT (DNAT) for inbound traffic and source NAT (SNAT) for outbound traffic, effectively hiding the overlap. This is a common workaround when both networks use the same CIDR block and cannot be renumbered.

Answer

Attach an Internet Gateway and use public IPs for communication.

Answer

Set up a second VPN connection to a different virtual private gateway.

Answer

Create a VPC peering connection between the VPC and on-premises network.

Question 19

A SysOps administrator is troubleshooting an EC2 instance that is unresponsive. The administrator can SSH into the instance but finds that the CloudWatch agent is not sending custom metrics. The CloudWatch agent configuration file is at '/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json'. What should the administrator check first?

Accepted Answer

Verify that the IAM role attached to the EC2 instance has the CloudWatchAgentServerPolicy.. The correct first check is to verify the IAM role attached to the EC2 instance has the CloudWatchAgentServerPolicy. The CloudWatch agent uses the instance's IAM role to obtain credentials for publishing metrics to CloudWatch. Without this policy, the agent will fail to send custom metrics even if it is running correctly and the instance has network connectivity.

Answer

Ensure that the IAM user has permissions to access CloudWatch.

Answer

Check if the security group allows outbound traffic on port 443.

Answer

Run 'sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status' to check the agent status.

Question 20

A company uses CloudWatch Logs to monitor application logs. The SysOps administrator wants to search for specific error patterns across multiple log groups. Which THREE AWS services can be used to achieve this?

Accepted Answer

CloudWatch Logs Insights. CloudWatch Logs Insights is correct because it is a native AWS service designed specifically for querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) across multiple log groups to search for specific error patterns, making it a direct and efficient solution for this use case without requiring data export or additional infrastructure.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue