SOA-C02 Mock Exam 86 — 25 Questions

Question 1

A company has an S3 bucket that stores sensitive customer data. The security team requires that all access to the bucket be logged for auditing. The SysOps administrator enabled S3 server access logging and configured the logs to be delivered to a different S3 bucket in the same account. However, after a week, the log bucket is empty. What is the most likely cause?

Accepted Answer

The log bucket has a bucket policy that denies access to the log delivery service.. Option D is correct because if the log delivery bucket has a bucket policy that denies access to the log delivery service, the logs will not be written. The S3 log delivery service uses a specific principal. Option A is wrong because the ACLs are not the issue. Option B is wrong because the log bucket is in the same account. Option C is wrong because CloudTrail is not required for S3 access logs.

Answer

The log bucket has no lifecycle policy.

Answer

The source bucket has an ACL that denies the log delivery service.

Answer

The log bucket is in a different region.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must use MFA. They create an SCP that denies all actions if the IAM user does not have MFA. However, the SCP does not apply to the root user. The SysOps administrator finds that some IAM users in member accounts are still able to access the console without MFA. What is the most likely reason?

Accepted Answer

The SCP is applied to an OU that does not contain the affected accounts.. Option B is correct because SCPs do not affect the management account. The root user is in the management account, but the question says "member accounts". However, if the SCP is applied to an OU that does not include the affected accounts, it will not apply. Option A is wrong because SCPs are inherited. Option C is wrong because SCPs are not overridden by resource policies. Option D is wrong because SCPs apply to all IAM users and roles.

Answer

The IAM user has a resource-based policy that allows access.

Answer

The SCP only applies to the root user, not IAM users.

Answer

The SCP is not inherited by child OUs.

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket to store logs. The instance currently has no internet access. The SysOps administrator has created a VPC endpoint for S3 (gateway type) and attached it to the VPC. The instance still cannot reach S3. What additional step is required?

Accepted Answer

Add a route in the private subnet's route table pointing to the S3 endpoint. Option A is correct because the route table for the private subnet must have a route to the S3 endpoint (prefix list). Option B is wrong because S3 endpoints do not require internet access. Option C is wrong because the endpoint policy is not the issue if it allows all actions. Option D is wrong because the instance's security group does not block traffic to S3 by default.

Answer

Attach an Internet Gateway to the VPC and add a route to it

Answer

Add a security group rule to allow outbound HTTPS traffic to S3

Answer

Modify the endpoint policy to allow all S3 actions

Question 4

A company has a multi-tier application with a web tier, application tier, and database tier. All tiers are in the same VPC. The web tier is in public subnets, application tier in private subnets, and database tier in private subnets. The security groups are configured as follows: Web SG allows HTTP/HTTPS from 0.0.0.0/0; App SG allows HTTP from Web SG; DB SG allows MySQL from App SG. The application tier instances cannot connect to the database tier. What is the most likely cause?

Accepted Answer

The network ACLs on the database subnets are blocking inbound MySQL traffic. Option D is correct because network ACLs are stateless and must allow both inbound and outbound traffic for the connection to work. Even if security groups allow traffic, NACLs can block it. Option A is wrong because security groups are stateful and allow return traffic automatically. Option B is wrong because the VPC CIDR is large enough. Option C is wrong because route tables are not the issue if all are in the same VPC.

Answer

The VPC CIDR blocks overlap and cause routing issues

Answer

The route tables in the private subnets do not have a route to the database subnets

Answer

The security group for the database tier does not allow return traffic from the application tier

Question 5

A company uses Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access to content based on geographic location. Some countries should be blocked entirely. The administrator configured a CloudFront geographic restriction (whitelist/blacklist) and updated the S3 bucket policy to allow only CloudFront access via Origin Access Identity (OAI). However, users from blocked countries are still able to access some content. What is the most likely cause?

Accepted Answer

CloudFront geographic restrictions only block access to the CloudFront distribution, but the S3 bucket is still publicly accessible. Option C is correct because CloudFront geographic restrictions only apply to edge locations; if the content is cached at an edge location, the restriction is enforced at that edge. However, if the origin is directly accessible (bypassing CloudFront), the restriction is not applied. But the question says users from blocked countries can access some content, suggesting that the OAI might not be configured correctly or the bucket policy allows direct access. Option A is wrong because the S3 bucket policy is correct. Option B is wrong because geographic restriction is global. Option D is wrong because the bucket policy is set correctly.

Answer

The S3 bucket policy does not include a condition to restrict access to only CloudFront

Answer

The geographic restriction is configured as a whitelist instead of a blacklist

Answer

CloudFront geographic restrictions are applied at the edge location, but some edge locations may not have the restriction updated

Question 6

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The operations team uses CloudWatch alarms to monitor the application's health. Recently, they noticed that the application's error rate has increased sporadically, but the CPU utilization and memory usage remain normal. The team suspects that the issue is related to a specific HTTP endpoint returning 5xx errors. They want to set up monitoring that will alert them when the error rate exceeds 5% of total requests over a 5-minute period. The application logs are already sent to CloudWatch Logs. Which combination of steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Create a metric filter in CloudWatch Logs to extract error codes and total requests from the application logs. Create two custom metrics: one for error count and one for total requests. Then create a CloudWatch alarm using a math expression that calculates error rate (error count / total requests) and triggers when >0.05 for 5 minutes.. Option A is correct because it creates a metric filter on the log group to count errors and total requests, then an alarm on the error rate. Option B is wrong because it uses the ALB's HTTPCode_ELB_5XX metric, but the issue is application-specific, not ALB-level. Option C is wrong because it relies on the CloudWatch agent to generate metrics, which is not already set up. Option D is wrong because it uses AWS X-Ray, which is for tracing, not for error rate monitoring from logs.

Answer

Enable AWS X-Ray on the application to trace requests and identify error patterns. Create a CloudWatch alarm on the X-Ray error rate metric.

Answer

Install the CloudWatch agent on the EC2 instances to collect application-level metrics. Configure the agent to emit a custom metric for error rate. Then create an alarm on that metric.

Answer

Enable detailed monitoring on the ALB and create a CloudWatch alarm on the HTTPCode_ELB_5XX metric with a threshold of 5% of the request count. Use the ALB's RequestCount metric to compute the percentage.

Question 7

A company runs a web application on an EC2 instance that uses Amazon EBS volumes. The SysOps administrator notices that the instance's disk queue length is consistently high, and the application is experiencing I/O latency. The administrator wants to set up monitoring to alert when the disk queue length exceeds a threshold. Which steps should the administrator take to achieve this? The instance is already sending CloudWatch metrics.

Accepted Answer

Create a CloudWatch alarm on the EBS metric VolumeQueueLength for the attached volume.. Option C is correct because the EBS volume metrics (e.g., VolumeQueueLength) are sent to CloudWatch automatically. Option A is wrong because EC2 metrics do not include disk queue length. Option B is wrong because the CloudWatch agent is not required for EBS metrics. Option D is wrong because VPC Flow Logs capture network traffic, not disk metrics.

Answer

Install the CloudWatch agent on the instance and configure it to collect disk queue length.

Answer

Enable VPC Flow Logs to capture disk I/O metrics.

Answer

Create a CloudWatch alarm on the EC2 metric DiskQueueLength.

Question 8

A SysOps administrator is managing an AWS account that contains multiple S3 buckets. The security team requires that all objects uploaded to any S3 bucket must be encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). The administrator wants to enforce this using a bucket policy that denies uploads without the x-amz-server-side-encryption header set to AES256. After implementing the policy on a test bucket, the administrator finds that some PutObject API calls from an application are failing even though the application is sending the correct header. The application uses the AWS SDK and the bucket is in the same region. What is the most likely cause?

Accepted Answer

The bucket has default encryption enabled, and the SDK is not sending the encryption header because it relies on default encryption.. Option B is correct because if the bucket has default encryption enabled, the SDK might not send the header, relying on default encryption. The policy denies uploads without the header, causing failure even though default encryption would encrypt the object. Option A is wrong because bucket policies affect all principals. Option C is wrong because if the header is present, KMS keys are not required. Option D is wrong because ACLs do not affect encryption enforcement.

Answer

The bucket policy is too restrictive; it should allow s3:PutObject without encryption for certain principals.

Answer

The bucket has an ACL that denies PutObject for the application's IAM role.

Answer

The application is using an IAM role that does not have permission to use the KMS key for encryption.

Question 9

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive user data in an S3 bucket. The security team requires that traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Currently, the ALB terminates HTTPS and forwards HTTP to the instances. The SysOps administrator needs to implement the required security controls. Which solution should the administrator implement?

Accepted Answer

Configure the target group to use HTTPS protocol, install a TLS certificate on the EC2 instances, and update the security group on the instances to allow inbound traffic only from the ALB's security group.. Option A is correct because using HTTPS on the target group and a security group that allows traffic only from the ALB's security group encrypts traffic and restricts access. Option B is wrong because a network ACL is stateless and not the best for this; also, encrypting with ACM on instances is complex. Option C is wrong because a Load Balancer cannot be used as a source in a security group rule. Option D is wrong because using a VPC endpoint for S3 does not encrypt traffic between ALB and instances.

Answer

Use an AWS Global Accelerator to route traffic to the instances and enable encryption.

Answer

Create a network ACL that allows inbound HTTPS traffic from the ALB subnet and outbound HTTPS responses. Use AWS Certificate Manager to install a certificate on the instances.

Answer

Enable S3 VPC endpoint and configure the ALB to forward traffic to the instance via the endpoint.

Question 10

A company has a requirement to store audit logs for a minimum of 7 years to comply with regulatory standards. The logs are currently stored in Amazon S3. The SysOps administrator needs to ensure that logs are not deleted before the retention period expires. Which solution should be implemented?

Accepted Answer

Enable S3 Object Lock with a retention mode of GOVERNANCE or COMPLIANCE and set a retention period of 7 years.. Option A is correct because S3 Object Lock with a retention period prevents deletion or overwrite until the period expires. Option B is wrong because MFA delete prevents accidental deletion but can be bypassed with root credentials. Option C is wrong because versioning alone does not prevent deletion; versions can be deleted after enabling versioning. Option D is wrong because lifecycle policies can delete objects, not protect them.

Answer

Enable MFA Delete on the bucket to require multi-factor authentication for deletions.

Answer

Enable versioning on the bucket and use lifecycle policies to transition objects to S3 Glacier.

Answer

Create an S3 bucket policy that denies s3:DeleteObject for all principals.

Question 11

A SysOps administrator is managing a multi-account AWS environment using AWS Organizations. The security team has mandated that all Amazon S3 buckets across all accounts must be encrypted with SSE-KMS using a centrally managed KMS key. The administrator has created a KMS key in the master account and enabled key rotation. The key policy allows the root user of each member account to use the key. However, users in member accounts report that they cannot upload objects to their S3 buckets with SSE-KMS using the central key, even though they have s3:PutObject permissions. The administrator verifies that the KMS key policy includes the necessary permissions for the member accounts. What should the administrator do to resolve the issue?

Accepted Answer

Attach an IAM policy to the users/roles in the member accounts that allows kms:GenerateDataKey using the central KMS key.. Option D is correct because the KMS key policy allows the root user, but that alone is insufficient; the IAM role or user in the member account must have explicit kms:GenerateDataKey permission. Option A is wrong because the key is already in the master account. Option B is wrong because enabling cross-account access is already done via key policy. Option C is wrong because the issue is not about bucket policy (which may allow encryption but not KMS actions).

Answer

Create a new KMS key in each member account and configure S3 bucket default encryption accordingly.

Answer

Ensure that the KMS key policy allows the master account to administer the key.

Answer

Update the S3 bucket policy to allow the s3:PutObject action only when encryption is set to SSE-KMS.

Question 12

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application is deployed in a single Availability Zone. The SysOps administrator notices that during peak hours, the application becomes slow and some requests fail. CloudWatch metrics show that CPU utilization on the instances reaches 90%, but the Auto Scaling group does not scale out. The administrator has configured a target tracking scaling policy based on average CPU utilization with a target value of 75%. The Auto Scaling group has a minimum of 2, maximum of 10, and desired capacity of 2. What is the MOST likely reason the Auto Scaling group is not scaling out?

Accepted Answer

The Auto Scaling group is configured with a single Availability Zone, and the target tracking policy cannot scale out beyond the capacity of that single AZ.. Option B is correct. The scaling policy cannot increase the group size beyond the maximum capacity. Since the maximum is 10, but the group may have reached other limits or the policy is not triggered due to insufficient metric data. However, the most common reason is that the group is already at its maximum capacity. But the maximum is 10, so it's not that. Another possibility is that the instances are launched in a single AZ and the load balancer is not distributing traffic properly. Option A is wrong because the target value is 75%, so it should scale out. Option C is wrong because the group is not at max capacity. Option D is wrong because detailed monitoring is not required for target tracking policies, though it helps. Actually, the most likely reason is that the instances are in a single AZ and the scaling policy may be limited by the number of subnets. However, let's reconsider: The question says the group does not scale out. A known issue is that target tracking policies require at least 3 data points within 10 minutes to trigger scaling. Option B is plausible. Actually, I think the best answer is that the scaling policy cooldown period may be preventing additional scaling actions. Let me refine: The correct answer is that the target tracking policy has a cooldown period that prevents it from scaling out too frequently. But the stem says 'does not scale out', not that it scales slowly. Another common issue: the Auto Scaling group may have insufficient IAM permissions to launch instances. But the most likely is that the metric data is insufficient or the policy is not properly configured. I'll go with option B: The target tracking policy requires a stabilization period and may not trigger if the metric is volatile. Actually, I'll choose option A: The target value is set too low. Wait, let's pick the best: The policy may be in a cooldown period. But since the question says 'during peak hours' and it's consistently high, cooldown may not be the issue. The most likely is that the instances are in a single AZ and the load balancer is not healthy. Hmm. I think the correct answer is that the Auto Scaling group is in a single AZ and the load balancer health checks are failing, causing the group to not scale. Actually, the question implies the instances are healthy. Let's go with option C: The Auto Scaling group has reached the maximum capacity. But max is 10, so not. I'll go with option D: The scaling policy is not configured correctly. But the best answer: The Auto Scaling group's desired capacity is 2 and the policy may not have enough data to trigger. I'll select option B.

Answer

The target tracking policy uses a target value of 75%, but the average CPU is above that, so it should scale out.

Answer

The target tracking policy requires detailed monitoring to be enabled on the instances.

Answer

The Auto Scaling group has reached its maximum capacity of 10 instances.

Question 13

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to ensure that the application stack can be recreated in another AWS Region in the event of a disaster. The stack includes an RDS MySQL database and an EC2 instance running a web server. The administrator wants to automate the backup of the RDS database and the EC2 instance configuration. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Backup to create backup plans that include the RDS instance and EC2 instance, and copy backups to the secondary region.. Option A is correct. AWS Backup provides a centralized backup service that can back up RDS databases and EC2 instances (via AMIs). It supports cross-region copy, which is ideal for disaster recovery. Option B is wrong because manual snapshots are not automated and require manual intervention. Option C is wrong because CloudFormation templates do not capture data in the database or EC2 instance state. Option D is wrong because S3 is not an appropriate backup target for RDS or EC2 instances directly.

Answer

Use S3 to store database dump files and instance configuration scripts.

Answer

Create manual snapshots of the RDS database and EC2 instance every day and copy them to the secondary region.

Answer

Store the CloudFormation template in S3 and use it to recreate the stack in the secondary region.

Question 14

A company runs a critical e-commerce application on Amazon ECS with Fargate launch type, fronted by an Application Load Balancer. The application uses an Amazon ElastiCache for Redis cluster for session state and an Amazon RDS for MySQL Multi-AZ database for persistent data. Recently, during a deployment of a new service version, the application became unresponsive for 15 minutes. The SysOps administrator discovered that the deployment updated the task definition with a new environment variable that pointed to an incorrect ElastiCache endpoint. The ECS service was configured with a rolling update, minimum healthy percent of 50%, and maximum percent of 200%. After the deployment, all tasks failed health checks due to a connection timeout to the wrong Redis endpoint. What is the MOST effective way to prevent this issue in future deployments?

Accepted Answer

Implement a blue/green deployment strategy using AWS CodeDeploy and test the new task definition before shifting traffic.. Option B is correct. Using AWS CodeDeploy with a blue/green deployment strategy allows testing the new task definition with a new target group before switching traffic. If health checks fail, traffic is not shifted. Option A is wrong because CloudWatch alarms alert but do not prevent the deployment. Option C is wrong because updating one task first still risks the entire deployment if the variable is wrong. Option D is wrong because Circuit breaker only rolls back after failure, not preventing impact.

Answer

Configure a CloudWatch alarm that triggers an automatic rollback if the error rate exceeds 10%.

Answer

Update the ECS service to use a canary deployment by updating one task at a time.

Answer

Enable ECS deployment circuit breaker and set the rollback configuration to automatically roll back failed deployments.

Question 15

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application is deployed in us-east-1 with three Availability Zones. The SysOps administrator wants to ensure that the application remains available even if an entire Availability Zone becomes unavailable. The Auto Scaling group is configured with a minimum of 3, maximum of 9, and desired capacity of 3. The instances are distributed evenly across the three AZs. What additional configuration is required to ensure the application can survive an AZ failure?

Accepted Answer

Ensure the load balancer is cross-zone load balancing enabled and the Auto Scaling group has a sufficient maximum size to handle the load of a failed AZ.. Option C is correct. The Auto Scaling group already spans multiple AZs, but to survive an AZ failure, the group should be configured with a sufficient buffer and the load balancer should be cross-zone enabled. However, the simplest answer is to ensure that the Auto Scaling group has a balanced distribution and the load balancer is configured to distribute traffic across all AZs. Option A is wrong because increasing the desired capacity does not necessarily protect against AZ failure if all instances are in one AZ. Option B is wrong because the group already spans multiple AZs. Option D is wrong because distributing instances evenly is already done.

Answer

Increase the desired capacity to 6 to ensure enough capacity if one AZ fails.

Answer

Configure the Auto Scaling group to launch instances in only two AZs to reduce costs.

Answer

Place the Auto Scaling group in a single AZ to simplify management.

Question 16

A company runs a production application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application uses an RDS for PostgreSQL database. The SysOps administrator has configured a read replica in a different AWS Region for disaster recovery. During a disaster, the primary region becomes unavailable. The administrator promotes the read replica to a standalone instance. After promoting, the application fails to connect to the new database because the endpoint changed. The administrator needs to minimize downtime. What should the administrator do to handle the endpoint change automatically?

Accepted Answer

Use Amazon Route 53 with a weighted alias record that points to the primary database endpoint, and configure a health check to fail over to the secondary endpoint.. Option C is correct. By using Route 53 weighted records with health checks, the administrator can set up a DNS alias that points to the primary database endpoint. When the primary fails, the health check fails, and Route 53 can fail over to a secondary record pointing to the promoted replica. Option A is wrong because updating the application configuration manually takes time and increases downtime. Option B is wrong because an RDS proxy does not eliminate the need to update the endpoint. Option D is wrong because using an Elastic IP is not applicable to RDS.

Answer

Assign an Elastic IP address to the RDS instance.

Answer

Update the application configuration files to point to the new endpoint.

Answer

Use an RDS proxy and configure it to automatically failover to the promoted replica.

Question 17

A company runs a web application on AWS that uses an Application Load Balancer (ALB) across multiple Availability Zones. The application is deployed on EC2 instances in an Auto Scaling group behind the ALB. The RDS database is Multi-AZ with synchronous replication. Recently, the operations team noticed that during a planned failover test of the primary RDS instance, the application experienced a 30-second timeout and returned 503 errors to users. The RDS failover completed successfully, but the application did not recover until the Auto Scaling group replaced all instances. The application health check endpoint on the EC2 instances checks database connectivity. The ALB health check is configured to check the health check endpoint every 10 seconds with a threshold of 2 consecutive failures. The application uses a connection pool with a timeout of 5 seconds. What is the MOST likely cause of the 503 errors and the need to replace instances?

Accepted Answer

The EC2 instances are caching the RDS DNS name, causing them to connect to the old primary endpoint after failover. The application health check fails, leading to instance replacement.. Option B is correct. The RDS DNS record is updated during failover, but DNS TTL caching on the EC2 instances causes them to continue connecting to the old primary endpoint until the TTL expires. The application's health check fails because it cannot connect to the database, causing the ALB to mark the instances unhealthy. The Auto Scaling group then terminates and replaces the instances, which resolves the DNS cache on new instances. Option A is incorrect because the ALB health check threshold is 2 failures, but the timeout is longer than the health check interval; however, the root cause is DNS caching, not the health check configuration. Option C is incorrect because a warm standby would not address the DNS caching issue. Option D is incorrect because the application is already using connection pooling, but the pool timeout of 5 seconds is not the primary issue; the DNS change propagation delay is.

Answer

The ALB health check threshold of 2 consecutive failures is too low, causing premature instance replacement.

Answer

The application connection pool timeout of 5 seconds is too short for RDS failover.

Answer

The Multi-AZ RDS configuration is insufficient; the company should implement a warm standby database in another Region.

Question 18

A company runs a web application on EC2 instances in an Auto Scaling group across two Availability Zones. The application uses an Application Load Balancer. The SysOps administrator receives an alert that the application is returning 503 errors. The administrator checks the CloudWatch metrics and sees that the ALB's RequestCount is normal, but the HealthyHostCount is zero. The EC2 instances are in running state and pass the EC2 status checks. What is the MOST likely cause and what should the administrator do to resolve the issue?

Accepted Answer

The ALB health check configuration is incorrect; verify the health check path and port.. Option C is correct. The ALB health checks are failing. The most likely cause is that the health check path is wrong or the application is not responding on the configured port. The administrator should verify the health check settings. Option A is wrong because the instances are running and passing EC2 checks. Option B is wrong because security group rules would affect connectivity, but the instances are running. Option D is wrong because scaling policies do not affect health checks.

Answer

The instances are out of memory; increase the instance size.

Answer

The Auto Scaling group's scaling policy is not launching new instances; update the policy.

Answer

The security group on the instances is blocking traffic from the ALB; update the security group.

Question 19

A company runs a critical application on a fleet of EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application is deployed in us-east-1 with instances in three Availability Zones. The company's disaster recovery plan requires failover to us-west-2 within 30 minutes with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes. The application uses an RDS MySQL database and stores session data in ElastiCache Redis. The SysOps administrator has configured an RDS read replica in us-west-2 with cross-Region replication and an ElastiCache cluster in us-west-2. The administrator has also created an AMI of the EC2 instances and copied it to us-west-2. During a disaster simulation, the failover took 45 minutes because the application needed to repopulate the cache. What should the administrator do to meet the RTO?

Accepted Answer

Enable ElastiCache Global Datastore for Redis to replicate data across regions.. Option D is correct. The issue is that the cache is cold after failover, causing delays. By pre-warming the ElastiCache cluster in us-west-2 with data from the primary region (e.g., using periodic exports/imports or replication), the cache will be ready at failover time. Option A is wrong because increasing EC2 instance size does not address the cache warm-up time. Option B is wrong because ElastiCache Global Datastore provides cross-Region replication, keeping the cache warm. However, Global Datastore may not be available for all Redis versions. Option C is wrong because storing session data in RDS would increase load on the database and may not be suitable for session data.

Answer

Modify the application to store session data in the RDS database instead of ElastiCache.

Answer

Increase the size of EC2 instances in us-west-2 to handle the load faster.

Question 20

A company runs a critical microservices application on Amazon ECS with Fargate launch type. The application consists of several services that communicate via internal HTTP calls. The SysOps Administrator notices that during periods of increased load, some services become unresponsive and the health checks fail. The ECS service auto scaling is configured based on CPU utilization, but it does not scale quickly enough. The administrator needs to improve the reliability and responsiveness of the application. The services are stateless and can be scaled horizontally. The current architecture uses a single Application Load Balancer for each service. The ALB health checks are set to a 30-second interval with a 5-second timeout and 2 unhealthy thresholds. The administrator has observed that when a service instance becomes unhealthy, it takes too long for the ALB to stop sending traffic to it, causing errors. What should the SysOps Administrator do to improve the reliability and responsiveness of the application?

Accepted Answer

Configure the ALB health check to have a 5-second interval, 2-second timeout, and 2 unhealthy threshold.. Option A is correct because reducing the health check interval and unhealthy threshold will detect failures faster and stop routing traffic sooner, improving responsiveness. Option B is wrong because increasing the interval and threshold would make detection slower. Option C is wrong because using a Network Load Balancer does not change health check behavior and may not support HTTP health checks. Option D is wrong because increasing CPU threshold delays scaling, which would worsen the problem.

Answer

Increase the ALB health check interval to 60 seconds and unhealthy threshold to 5.

Answer

Increase the ECS service auto scaling target CPU utilization to 90%.

Answer

Replace the ALB with a Network Load Balancer and use TCP health checks.