SOA-C02 Mock Exam 84 — 25 Questions

Question 1

A SysOps administrator notices that an EC2 instance's CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a CPU utilization-based scaling policy. However, no new instances have been launched. What is the most likely cause?

Accepted Answer

The Auto Scaling cooldown period is preventing additional scaling activities.. The most likely cause is that the Auto Scaling cooldown period is preventing additional scaling activities. When a scaling activity completes, a cooldown period (default 300 seconds) starts during which the Auto Scaling group ignores additional CloudWatch alarms to allow metrics to stabilize. If the instance has been above 90% CPU for an hour but no new instances launched, the cooldown period may have been triggered by a previous scaling event and is still active, blocking further scale-out actions despite sustained high utilization.

Answer

The EC2 instance is in a private subnet and cannot communicate with the Auto Scaling service.

Answer

The CloudWatch alarm is publishing to an S3 bucket that is full.

Answer

The scaling policy is based on memory utilization, not CPU.

Question 2

A SysOps administrator creates this IAM policy for a monitoring application. The application needs to publish custom metrics to CloudWatch and retrieve information about EC2 instances and Auto Scaling groups. The application reports that it cannot list EC2 instances. What is the most likely reason?

Accepted Answer

The policy uses a wildcard for the ec2:Describe action; it should specify ec2:DescribeInstances.. The policy uses a wildcard for the ec2:Describe action, but IAM does not support wildcards for action names in the format 'ec2:Describe*'. The correct action to list EC2 instances is 'ec2:DescribeInstances'. Because the wildcard is invalid, the policy grants no EC2 Describe permissions, causing the application to fail when listing instances.

Answer

The policy does not grant access to the us-east-1 region.

Answer

The policy is missing the cloudwatch:PutMetricData action for the monitoring application.

Answer

The policy should include ec2:DescribeTags to list instances.

Question 3

Which TWO statements about Amazon CloudFront origins are correct? (Choose two.)

Accepted Answer

CloudFront can use an Application Load Balancer as an origin.. Option C is correct because CloudFront can use an Application Load Balancer (ALB) as a custom origin. This allows you to distribute traffic from a web application running behind an ALB, enabling dynamic content delivery with CloudFront's edge caching and HTTPS termination.

Answer

CloudFront only supports HTTP origins, not HTTPS.

Answer

CloudFront can only use S3 buckets as origins.

Answer

CloudFront origins must be in the same region as the distribution.

Question 4

A company is using AWS KMS to encrypt data at rest in S3. The security team wants to ensure that encryption keys are automatically rotated annually. Which type of KMS key should be used?

Accepted Answer

Use an AWS managed key. AWS managed KMS keys (AWS managed keys) are automatically rotated every year (365 days) with no action required from the customer. This satisfies the security team's requirement for annual automatic key rotation without any manual intervention or additional configuration.

Answer

Use an asymmetric KMS key

Answer

Use a custom key store (CloudHSM)

Answer

Use a customer managed key with imported key material

Question 5

Which THREE components are required to set up a site-to-site VPN connection between a VPC and an on-premises network? (Choose three.)

Accepted Answer

Virtual private gateway or transit gateway. A virtual private gateway or transit gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network. It provides the target for the VPN connection and must be attached to the VPC to enable site-to-site VPN functionality.

Answer

NAT Gateway

Answer

Internet gateway

Question 6

A SysOps administrator needs to grant cross-account access to an S3 bucket in Account A for an IAM user in Account B. The bucket policy in Account A allows the IAM user's account root principal. What additional configuration is required?

Accepted Answer

Attach an IAM policy to the user in Account B that allows the required S3 actions. D is correct because cross-account access to an S3 bucket requires both a bucket policy that grants access to the root principal of the target account (Account B) and an IAM policy attached to the user in Account B that explicitly allows the desired S3 actions. Without the IAM policy, the user in Account B has no permissions to perform any S3 operations, even though the bucket policy in Account A permits the account root. The IAM policy acts as the identity-based permission that authorizes the specific user to invoke the S3 API calls.

Answer

Modify the AWS KMS key policy to allow the user in Account B

Answer

Add a bucket ACL granting access to the user in Account B

Answer

Add an AWS Organizations service control policy to allow access

Question 7

A SysOps administrator needs to ensure that all S3 buckets in the account are logged to CloudTrail for data events. The administrator enables CloudTrail with data events for S3 and selects 'All buckets' in the current account. However, after a week, they notice that some buckets are not being logged. What is the most likely reason?

Accepted Answer

The S3 buckets do not have a bucket policy that allows CloudTrail to write the log files.. When CloudTrail delivers S3 data event logs to a destination bucket, it writes log files on behalf of the trail. Even if the trail is configured to log data events for 'All buckets,' CloudTrail must have explicit permissions to write to the destination bucket. The destination bucket requires a bucket policy that grants CloudTrail the s3:PutObject action; without this policy, CloudTrail cannot deliver logs for any bucket, including those being monitored. Option B correctly identifies this missing bucket policy as the most likely reason some buckets are not logged.

Answer

The IAM user who created the trail does not have s3:PutObject permissions on the buckets.

Answer

The S3 buckets are in a different AWS Region from the CloudTrail trail.

Answer

The S3 buckets have server access logging enabled, which conflicts with CloudTrail logging.

Question 8

A SysOps administrator wants to be notified when an Auto Scaling group launches a new instance. Which AWS service can be used to capture the Auto Scaling lifecycle events and send a notification?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS is the correct choice because it can receive lifecycle notifications from Auto Scaling groups via Amazon EventBridge (formerly CloudWatch Events) and then deliver those notifications to subscribers (e.g., email, SMS, HTTP endpoints). Auto Scaling groups emit lifecycle events (e.g., `EC2 Instance-launch Lifecycle Action`) that can be captured by EventBridge rules, which then invoke an SNS topic to send the notification.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 9

A company has an application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application logs show intermittent 503 errors. The ALB access logs show that the errors occur when the target response time exceeds 30 seconds. Which configuration change should the SysOps administrator make to reduce the number of 503 errors without affecting the application's behavior?

Accepted Answer

Increase the idle timeout setting on the ALB. The 503 errors occur when the target response time exceeds 30 seconds, which matches the default idle timeout of the Application Load Balancer. By increasing the idle timeout setting on the ALB to a value higher than the application's maximum expected response time (e.g., 60 or 120 seconds), the ALB will wait longer before closing the connection, preventing premature 503 errors while the backend is still processing the request.

Answer

Increase the deregistration delay on the target group

Answer

Enable cross-zone load balancing on the ALB

Answer

Decrease the health check interval on the target group

Question 10

A SysOps administrator needs to create a custom metric to track the number of active connections to an EC2 instance. Which steps should be taken? (Select TWO.)

Accepted Answer

Use the AWS CLI to call put-metric-data and publish the custom metric.. Option B is correct because the AWS CLI `put-metric-data` command allows you to publish custom metrics directly to CloudWatch, which is the standard method for sending application-level or OS-level metrics that are not automatically provided by AWS. Option E is correct because the Amazon CloudWatch agent can collect custom metrics from the EC2 instance (e.g., active connection counts from netstat or a script) and publish them to CloudWatch, making it the recommended approach for in-guest metric collection.

Answer

Enable detailed monitoring on the EC2 instance.

Answer

Store the metric data in an S3 bucket and configure CloudWatch to read from it.

Answer

Use the EC2 console to enable custom metric collection.

Question 11

A company uses AWS CloudTrail to log API activity. A SysOps administrator discovers that some management events are not being logged. The administrator checks the CloudTrail configuration and confirms that management events are enabled and logging is working for most events. What is the most likely cause of the missing events?

Accepted Answer

The trail is configured to log events only for a single region, and the missing events occurred in a different region. Option C is correct because CloudTrail trails can be configured to log events for a single region or all regions. If the trail is set to log only one region, management events occurring in any other region will not be captured. Since the administrator confirmed management events are enabled and logging works for most events, the most likely cause is that the missing events originated from a region not covered by the trail.

Answer

The trail excludes specific management events based on read/write filtering

Answer

The trail is logging only data events for S3

Answer

The missing events are from unsupported services

Question 12

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Accepted Answer

Misconfigured firewall or iptables. An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Answer

Network connectivity issues

Answer

Detached EBS root volume

Answer

Insufficient memory for applications

Question 13

A company wants to ensure that all IAM user changes are logged and that an alert is sent when a new IAM user is created. Which services should be used together to achieve this? (Select THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can receive and store log events from AWS CloudTrail, which records all IAM user changes including user creation. By sending CloudTrail logs to CloudWatch Logs, you can then create metric filters to detect specific API calls like 'CreateUser' and trigger CloudWatch Alarms to send notifications via SNS.

Answer

AWS Config

Answer

Amazon S3

Question 14

A SysOps administrator wants to monitor the CPU utilization of an Amazon RDS instance and receive an alert if it exceeds 90% for 5 consecutive minutes. Which TWO AWS services are required to set up this monitoring? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch is the service that collects and stores metrics such as CPU utilization from RDS instances. Amazon CloudWatch Alarms allow you to set a threshold (e.g., CPU > 90%) and evaluate it over a specified period (e.g., 5 consecutive minutes) to trigger an action, such as sending a notification via SNS.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Answer

Amazon RDS Enhanced Monitoring

Question 15

A SysOps administrator is setting up monitoring for an application that runs on Amazon ECS with Fargate launch type. The application's performance degrades when memory utilization exceeds 80%. The administrator wants to receive a notification when memory usage approaches this threshold. What should the administrator do?

Accepted Answer

Create a CloudWatch alarm on the ECS service's MemoryUtilization metric. Option D is correct because Amazon ECS services automatically publish a `MemoryUtilization` metric to CloudWatch for Fargate tasks. By creating a CloudWatch alarm on this metric with a threshold of 80%, the administrator can trigger an SNS notification when memory usage approaches the threshold, enabling proactive remediation before performance degrades.

Answer

Install the CloudWatch agent on each Fargate task

Answer

Use Amazon CloudWatch Container Insights to view ReservedMemory metric

Answer

Enable Service Auto Scaling with a target tracking policy based on MemoryUtilization

Question 16

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running a custom application. The instance is not using the default CloudWatch metrics for memory. What should the administrator do to collect memory metrics?

Accepted Answer

Install and configure the CloudWatch agent on the instance. The default CloudWatch metrics for EC2 include CPU, disk, and network utilization, but not memory utilization. To collect custom metrics like memory usage, you must install and configure the CloudWatch agent on the instance. The agent collects memory and disk metrics from the OS and sends them to CloudWatch as custom metrics.

Answer

Enable detailed monitoring on the EC2 instance

Answer

Use AWS Trusted Advisor to check memory utilization

Answer

Use Amazon Inspector to monitor memory

Question 17

A SysOps administrator notices that an Amazon RDS for MySQL instance's CPU utilization has been consistently above 80% for the past hour. Which CloudWatch metric should the administrator examine to determine whether the high CPU is due to a specific SQL query?

Accepted Answer

DatabaseConnections. The correct answer is C, DatabaseConnections, because a high number of database connections can indicate that many concurrent queries are running, which could be caused by a specific SQL query that is inefficient or blocking others. However, to directly identify a specific SQL query causing high CPU, you would need to use Performance Insights or the slow query log, not a CloudWatch metric alone. DatabaseConnections is the closest metric among the options that correlates with query activity, as a sudden spike in connections often points to problematic queries.

Answer

WriteIOPS

Answer

FreeableMemory

Answer

ReadLatency

Question 18

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should the administrator use to set up an alarm based on the status check metric?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because EC2 instance status checks are published as CloudWatch metrics (e.g., StatusCheckFailed, StatusCheckFailed_Instance, StatusCheckFailed_System). A CloudWatch Alarm can be configured to monitor these metrics and trigger an action, such as sending a notification via Amazon SNS, when the alarm state changes to ALARM. This directly meets the requirement to receive a notification when a status check fails.

Answer

Amazon EventBridge

Answer

AWS Config

Answer

AWS Systems Manager

Question 19

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Amazon Linux 2. Which of the following is required to publish memory metrics to CloudWatch?

Accepted Answer

Install and configure the CloudWatch agent on the instance.. The CloudWatch agent is specifically designed to collect custom metrics, such as memory utilization, from EC2 instances and publish them to CloudWatch. Unlike the default EC2 monitoring, which only captures hypervisor-level metrics (CPU, network, disk), memory utilization requires an in-guest agent to read from the operating system's /proc/meminfo or similar interfaces. The CloudWatch agent can be configured via a JSON file to collect memory metrics and send them to CloudWatch using the PutMetricData API.

Answer

Use the CloudWatch Logs agent to parse memory usage from system logs.

Answer

Enable detailed monitoring on the instance.

Answer

Install the AWS Systems Manager Agent (SSM Agent) and configure it to send metrics.

Question 20

A company has an S3 bucket that stores sensitive data. A SysOps administrator needs to detect when objects in the bucket are publicly accessible. Which AWS service should the administrator use to continuously monitor and report on public access?

Accepted Answer

AWS Config. AWS Config provides a managed rule called 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited' that continuously evaluates S3 bucket policies and ACLs against the desired configuration. When a bucket becomes publicly accessible, AWS Config flags it as noncompliant and can trigger automated remediation or notifications. This makes it the correct service for ongoing monitoring and reporting of public access to sensitive data.

Answer

S3 server access logs

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor