SOA-C02 Mock Exam 87 — 25 Questions

Question 1

A company uses Amazon S3 to store sensitive financial documents. The company's compliance team requires that all objects be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Additionally, the compliance team requires that if an object is not accessed for 90 days, it should be automatically moved to Amazon S3 Glacier to reduce costs. The SysOps administrator is tasked with implementing these requirements. The administrator creates an S3 bucket and enables default encryption with SSE-KMS. Then, the administrator creates a lifecycle policy with a transition action to Glacier after 90 days. During testing, the administrator notices that objects uploaded to the bucket are not being transitioned to Glacier after 90 days. What is the most likely cause of this issue?

Accepted Answer

The lifecycle policy was created after the test objects were uploaded, and the policy does not apply to existing objects.. Option D is correct because lifecycle policies only apply to objects that are uploaded after the policy is created, unless the policy is applied to the entire bucket and includes existing objects. If the lifecycle policy was created after the test objects were uploaded, those objects are not affected unless the policy is configured to cover existing objects. Option A is wrong because SSE-KMS does not prevent lifecycle transitions. Option B is wrong because S3 Versioning does not block transitions. Option C is wrong because S3 Object Lock can prevent deletion but not transitions to Glacier.

Answer

The bucket has S3 Versioning enabled, and the lifecycle policy does not apply to previous versions.

Answer

The bucket's default encryption setting overwrites the lifecycle policy.

Answer

The bucket has S3 Object Lock enabled, which prevents objects from being transitioned to Glacier.

Question 2

A company runs a containerized application on Amazon ECS with the Fargate launch type. The application is deployed across two Availability Zones and uses an Application Load Balancer (ALB) to distribute traffic. The application stores state in an Amazon ElastiCache Redis cluster. Recently, the development team deployed a new version of the application that introduced a memory leak. The leak causes the ECS tasks to consume more memory over time until they are OOM-killed. The SysOps administrator is asked to ensure that the application remains available and responsive. The administrator has configured an ECS service auto scaling based on average CPU utilization, but the memory leak causes tasks to fail before CPU utilization triggers scaling. Which action should the administrator take to automatically detect and replace failing tasks?

Accepted Answer

Create a custom CloudWatch metric for memory utilization and configure an ECS service auto scaling with a step scaling policy that adds tasks when memory exceeds a threshold.. Option B is correct because configuring an ECS service auto scaling with a step scaling policy based on a custom CloudWatch metric for memory utilization (e.g., from CloudWatch agent) allows scaling out before tasks are OOM-killed. Option A is wrong because increasing task memory limit does not prevent the leak; it only delays failure. Option C is wrong because using a target tracking policy based on CPU does not address memory issues. Option D is wrong because an ALB health check only detects HTTP failures, not memory exhaustion if the process is still responding.

Answer

Increase the task memory limit to the maximum allowed for the Fargate task size. This will prevent OOM-kills.

Answer

Configure an ECS service auto scaling with a target tracking policy based on average CPU utilization. Set the target value to 50%.

Answer

Configure the ALB health check to use a more sensitive path that fails when memory is low. The ECS service will automatically replace unhealthy tasks.

Question 3

A company runs a critical application on EC2 instances in an Auto Scaling group. The application processes messages from an Amazon SQS queue. The SysOps administrator notices that during periods of high load, the SQS queue depth increases significantly, and the application takes a long time to recover. The administrator wants to improve the application's ability to handle spikes in traffic without over-provisioning resources. The application is stateless and can scale horizontally. What should the administrator do?

Accepted Answer

Configure an auto scaling policy for the Auto Scaling group based on the SQS queue depth (ApproximateNumberOfMessagesVisible).. Option B is correct because configuring auto scaling based on the SQS queue depth (e.g., ApproximateNumberOfMessagesVisible) allows the Auto Scaling group to scale out proactively as the queue grows and scale in as it shrinks. Option A is wrong because increasing instance size (vertical scaling) is less elastic than horizontal scaling. Option C is wrong because using a larger instance type with more vCPUs still has limits. Option D is wrong because changing to a FIFO queue does not affect throughput scaling; FIFO queues have lower throughput.

Answer

Change the SQS queue from standard to FIFO to ensure messages are processed in order.

Answer

Use a larger EC2 instance type with enhanced networking to process messages faster.

Answer

Increase the EC2 instance size to a larger type with more CPU and memory.

Question 4

A company runs a production web application on AWS using Auto Scaling groups (ASGs) behind an Application Load Balancer (ALB). The application state is stored in an Amazon RDS for MySQL Multi-AZ DB instance. The application experiences periodic traffic spikes, and the current ASG uses a simple scaling policy based on average CPU utilization. Recently, during a spike, the application became unresponsive for several minutes. The CloudWatch metrics show that the CPU utilization on the RDS instance peaked at 80%, and the DB Connections metric reached the maximum allowed. The read replica lag increased to over 10 seconds during the spike. The web servers are stateless and scale out quickly. The operations team needs to improve the reliability and performance of the application to handle future spikes. Which solution should the team implement?

Accepted Answer

Increase the DB instance size to a larger instance class and implement an Amazon ElastiCache cluster to cache frequent database queries.. Option B is correct because increasing the DB instance size provides more CPU and memory capacity to handle the load, and caching with ElastiCache reduces read load on the database by serving frequent queries from cache. This directly addresses high CPU and connection limits on RDS, and reduces read replica lag. Option A is wrong because increasing ASG size and adding more read replicas may increase database load further due to more connections and replication overhead. Option C is wrong because switching to DynamoDB and Lambda would require significant application changes and DynamoDB may not be suitable for complex queries. Option D is wrong because reducing MaxConnections on RDS would make the problem worse, and modifying application code to reduce queries is not a quick fix.

Answer

Increase the desired capacity of the ASG and add more read replicas to distribute the database load.

Answer

Migrate the database to Amazon DynamoDB with auto scaling and rewrite the application to use a serverless architecture with AWS Lambda.

Answer

Reduce the maximum connections parameter on the RDS instance to prevent connection exhaustion and modify the application code to reduce the number of database queries.

Question 5

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application is deployed using a custom AMI that is updated monthly. The SysOps administrator uses a launch template that references the latest AMI ID via an AWS Systems Manager parameter. During a recent deployment, the administrator updated the AMI ID in the parameter, but the new instances launched by the Auto Scaling group still use the old AMI. The administrator confirms that the launch template is configured to reference the parameter. The Auto Scaling group has a desired capacity of 5, and the administrator manually terminates one instance to trigger a replacement. The new instance also uses the old AMI. What is the MOST likely cause?

Accepted Answer

The Auto Scaling group is using a cached version of the launch template and needs to be updated or have its instances replaced.. Option B is correct because the Auto Scaling group caches the resolved AMI ID from the launch template at the time of creation or when the launch template is updated. If the launch template is not updated or the group is not refreshed, the group continues to use the cached value. Option A is incorrect because the Systems Manager parameter does not need special permissions for the launch template to reference it; the launch template resolution happens at the account level. Option C is incorrect because instance metadata does not affect which AMI is used for launch. Option D is incorrect because Amazon CloudWatch does not control AMI resolution.

Answer

The Amazon CloudWatch alarm that triggers scaling is not configured correctly.

Answer

The IAM role associated with the Auto Scaling group does not have permission to read the Systems Manager parameter.

Answer

The instance metadata service (IMDS) is disabled on the launch template.

Question 6

A company uses AWS CodeCommit to store its source code and AWS CodeBuild to compile and test the code. The SysOps administrator is setting up a new build project that needs to access a private Amazon S3 bucket to download build dependencies. The build project runs in a VPC. The administrator has attached an IAM role to the build project with permissions to access the S3 bucket. However, the build fails with an access denied error when trying to download the dependencies. The S3 bucket is in the same region and account. What should the administrator do to resolve the issue?

Accepted Answer

Create a VPC endpoint for Amazon S3 and associate it with the VPC where CodeBuild runs.. Option A is correct because when CodeBuild runs in a VPC, it does not have internet access by default, and S3 endpoints are required to access S3 buckets without going through a NAT gateway or internet. Option B is incorrect because the IAM role permissions appear correct, but the issue is network connectivity. Option C is incorrect because security groups control traffic at the instance level, not for S3 access. Option D is incorrect because the VPC does not need internet access if VPC endpoints are used.

Answer

Attach an internet gateway to the VPC to provide internet access.

Answer

Configure the security group for CodeBuild to allow outbound traffic to the S3 bucket.

Answer

Update the IAM role to include 's3:ListBucket' permission.

Question 7

A SysOps administrator is deploying a new web application using AWS Elastic Beanstalk. The application requires a high-performance relational database that can scale read capacity. The administrator needs to ensure that the database is highly available and can handle read replicas. The administrator creates an Elastic Beanstalk environment and adds an Amazon RDS DB instance. However, the database is deployed in a single Availability Zone. The administrator wants to modify the environment to use a Multi-AZ deployment for high availability and add read replicas. The administrator has the following options. Which option should the administrator choose?

Accepted Answer

Create a new Multi-AZ RDS DB instance with read replicas outside of Elastic Beanstalk. Update the environment's environment properties to point to the new database. Then delete the old DB instance.. Option A is correct because Elastic Beanstalk cannot add Multi-AZ or read replicas to an RDS instance that was created as part of the environment; the recommended approach is to decouple the database by creating a separate RDS instance outside of Elastic Beanstalk and then configuring the environment to connect to it. Option B is wrong because Elastic Beanstalk does not support converting a single-AZ DB to Multi-AZ after creation. Option C is wrong because read replicas require Multi-AZ or single-AZ with backups, but the environment's DB is not easily modified. Option D is wrong because increasing DB instance class does not provide Multi-AZ.

Answer

Increase the DB instance class size to improve performance and then create a read replica.

Answer

Create a read replica of the existing DB instance and then modify the environment to use the replica.

Answer

Modify the Elastic Beanstalk environment configuration to enable Multi-AZ for the existing DB instance.

Question 8

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application is deployed using AWS Elastic Beanstalk with a rolling update deployment policy. Recently, the development team pushed a new application version that introduced a memory leak. Within minutes, the instances started failing health checks, and Elastic Beanstalk initiated a replacement of the instances. However, during the replacement, the application experienced downtime because the new instances were not passing health checks, and the old instances were already terminated. The SysOps Administrator must modify the deployment to prevent downtime during future failed deployments. Which solution should the administrator implement?

Accepted Answer

Implement a Blue/Green deployment using a separate Elastic Beanstalk environment and swap CNAMEs after testing.. Option B is correct. Using a Blue/Green deployment with an immutable environment ensures that the new environment is fully tested before traffic is switched. If the new environment fails health checks, the old environment remains serving traffic, preventing downtime. Option A is wrong because All at once deployment would cause downtime even without failure. Option C is wrong because a classic load balancer does not provide the same health check granularity. Option D is wrong because Auto Scaling alone does not control deployment strategy.

Answer

Increase the Auto Scaling group's minimum and maximum size to handle more instances.

Answer

Replace the ALB with a Classic Load Balancer to reduce complexity.

Answer

Change the deployment policy to All at once to speed up the deployment.

Question 9

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline has three stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). Recently, the deployment stage started failing with the error 'The deployment failed because a deployment already exists for the deployment group'. The SysOps Administrator needs to fix the pipeline to allow deployments to proceed without manual intervention. The pipeline should only deploy if the previous deployment is successful. What should the administrator do?

Accepted Answer

Configure the CodePipeline Deploy action to wait for the previous deployment to finish before starting a new one.. Option D is correct. Configuring the deployment stage to wait for the previous deployment to complete before starting a new one ensures no concurrent deployments. Option A is wrong because disabling concurrent deployments does not prevent the pipeline from triggering a new deployment while one is in progress. Option B is wrong because enabling rollback does not address the concurrency issue. Option C is wrong because using a different deployment group for each pipeline execution is not practical.

Answer

Disable the concurrent deployment setting in the CodeDeploy deployment group.

Answer

Modify the pipeline to use a new deployment group for each execution.

Answer

Enable automatic rollback in the CodeDeploy deployment group.

Question 10

A company is using AWS OpsWorks for configuration management of their EC2 instances. The SysOps Administrator wants to migrate to AWS Systems Manager for a more modern approach. The administrator needs to ensure that existing instances running Amazon Linux 2 can be managed by Systems Manager without downtime. The instances are currently in a running state and are critical to operations. What should the administrator do?

Accepted Answer

Install the SSM Agent on the existing instances using a script or AWS Systems Manager Run Command.. Option B is correct. Installing the AWS Systems Manager Agent (SSM Agent) on the existing instances allows them to be managed by Systems Manager without downtime. Option A is wrong because creating a new AMI and launching new instances would cause downtime. Option C is wrong because replacing OpsWorks with Systems Manager is not a simple switch; the agent must be installed. Option D is wrong because recreating the stack would be disruptive.

Answer

Change the OpsWorks stack configuration to use Systems Manager instead of OpsWorks agent.

Answer

Create a custom AMI with the SSM Agent pre-installed and launch new instances from it.

Answer

Delete the OpsWorks stack and recreate it with Systems Manager integration.

Question 11

A company runs a critical production workload on a fleet of EC2 instances managed by an Auto Scaling group. The instances are behind an Application Load Balancer (ALB). Recently, the company experienced a regional outage that caused all instances to become unhealthy. The SysOps administrator must design a solution to automatically recover from such an outage with minimal downtime. The solution must be cost-effective and not require manual intervention. The administrator considers four options. Which option meets the requirements?

Accepted Answer

Configure the Auto Scaling group to launch instances across multiple Availability Zones and configure the ALB to route traffic to healthy targets.. Option C is correct because using an Auto Scaling group across multiple Availability Zones ensures that if one AZ fails, the ASG can launch instances in other AZs, and the ALB will route traffic to healthy instances. Option A is wrong because a warm standby in another region can be costly and may not be fully automated. Option B is wrong because increasing instance size does not provide AZ failover. Option D is wrong because manual scripts introduce single points of failure and latency.

Answer

Increase the desired capacity of the Auto Scaling group and use larger instance types to absorb the load during failover.

Answer

Create a warm standby environment in another AWS Region with a smaller Auto Scaling group. Use Route53 failover routing to switch traffic.

Answer

Use AWS Lambda to periodically check the health of instances and automatically relaunch failed instances in another region.

Question 12

A company has a multi-account AWS environment using AWS Organizations. The SysOps Administrator needs to deploy a standardized set of baseline resources (VPC, subnets, security groups, and an S3 bucket for logs) into each new member account as soon as the account is created. The administrator wants to automate this process using AWS CloudFormation and ensure that the baseline resources are deployed without manual intervention. The organization uses AWS CloudTrail and AWS Config for governance. What solution should the administrator implement?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to accounts in the organization.. Option C is correct. AWS CloudFormation StackSets allow deploying stacks across multiple accounts and regions from a management account. Combined with AWS Organizations, StackSets can automatically deploy to new accounts when they join the organization. Option A is wrong because AWS Config rules do not deploy resources. Option B is wrong because AWS CloudFormation templates deployed via S3 events require manual triggering. Option D is wrong because AWS Service Catalog allows provisioning but requires users to launch products manually.

Answer

Create an AWS Config rule that triggers an AWS Lambda function to deploy the baseline resources when a new account is created.

Answer

Store the CloudFormation template in Amazon S3 and use S3 event notifications to trigger a Lambda function that deploys the stack into the new account.

Answer

Use AWS Service Catalog to create a portfolio with the baseline products and grant access to the organization.

Question 13

A SysOps Administrator is responsible for deploying a new microservice using AWS Elastic Beanstalk. The microservice requires an Amazon RDS MySQL database. The administrator creates an Elastic Beanstalk environment and adds an RDS DB instance using the Elastic Beanstalk console. However, during the next deployment of the application, the database connection string in the environment properties gets overwritten, causing the application to fail to connect to the database. The administrator needs to ensure that the database configuration persists across deployments. What should the administrator do?

Accepted Answer

Provision the RDS instance separately using AWS CloudFormation and pass the connection string as an environment property using a custom resource.. Option A is correct. Using AWS CloudFormation to provision the RDS instance separately and then passing the connection string as an Elastic Beanstalk environment property using a custom resource ensures the database is not tied to the Elastic Beanstalk lifecycle. Option B is wrong because storing the connection string in a parameter store or secrets manager but still using the Elastic Beanstalk RDS integration does not solve the overwriting issue. Option C is wrong because using the Elastic Beanstalk RDS integration is the cause of the problem. Option D is wrong because .ebextensions are part of the application source and could still be overwritten.

Answer

Add the database configuration to the application source code using .ebextensions.

Answer

Store the database connection string in AWS Systems Manager Parameter Store and retrieve it in the application code.

Answer

Use the Elastic Beanstalk RDS integration but lock the environment properties using a configuration file.

Question 14

A SysOps Administrator is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance with an AWS Systems Manager Association that installs software. The stack creation fails because the association fails to apply, and the stack rolls back. The administrator needs to ensure that the stack creation succeeds even if the association fails, and then fix the association later. What should the administrator do?

Accepted Answer

Modify the CloudFormation template to set the AWS::SSM::Association resource's 'ComplianceSeverity' or 'WaitForSuccessTimeout' to a value that allows the stack to continue.. Option A is correct. Setting the association's failure target to a value that allows the stack to proceed (e.g., 'All') or using 'no error' will prevent the stack from failing. Option B is wrong because the deletion policy does not affect creation. Option C is wrong because removing the association does not meet the requirement to fix it later. Option D is wrong because adding a depends on does not change the failure behavior.

Answer

Add a 'DependsOn' attribute to the association to ensure it runs after the instance is fully ready.

Answer

Remove the association from the CloudFormation template and apply it manually after stack creation.

Answer

Set the deletion policy of the association to 'Retain' in the template.

Question 15

A company uses AWS KMS to encrypt data stored in S3. The security team wants to rotate the KMS key automatically every year. The SysOps administrator enabled automatic key rotation for the KMS key. However, after a year, the security team finds that the key has not been rotated. What is the most likely cause?

Accepted Answer

The KMS key was created by importing key material.. Option C is correct because automatic key rotation is not supported for imported key material. Option A is wrong because the key is enabled. Option B is wrong because the policy does not affect rotation. Option D is wrong because rotation does not require deletion of old keys.

Answer

The KMS key is disabled.

Answer

The KMS key policy does not allow rotation.

Answer

The KMS key has not been used in the last year.

Question 16

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive data in an S3 bucket. The security team has mandated that all data in transit to the S3 bucket must be encrypted using TLS. The SysOps administrator configured the application to use HTTPS endpoints for S3. However, a security audit reveals that some requests to S3 are still being sent over HTTP. The administrator checks the VPC Flow Logs and sees that the EC2 instances are communicating with the S3 bucket via a VPC endpoint. The company also uses an S3 bucket policy that allows access only from the VPC endpoint. What is the most likely reason that some requests are sent over HTTP?

Accepted Answer

The application is not configured to use HTTPS for all S3 requests.. Option B is correct because the VPC endpoint for S3 uses AWS API calls; the encryption (HTTPS) is handled at the application level, not the endpoint. If the application does not use HTTPS, the traffic will be plain HTTP. Option A is wrong because the bucket policy does not enforce encryption. Option C is wrong because the endpoint is for S3, not for enforcing encryption. Option D is wrong because the VPC endpoint does not automatically encrypt traffic.

Answer

The VPC endpoint is not encrypting traffic between the instances and the endpoint.

Answer

The VPC endpoint is configured for HTTP instead of HTTPS.

Answer

The S3 bucket policy does not require HTTPS for requests.

Question 17

A company has a single AWS account with multiple IAM users. The security team wants to ensure that no IAM user can create or modify VPC resources. The SysOps administrator creates a managed policy that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions. The policy is attached to all IAM users via a group. However, after a week, a user reports that they were able to create a VPC. The administrator checks CloudTrail and confirms that the user created the VPC. What is the most likely cause?

Accepted Answer

The user created the VPC using AWS CloudFormation with a service role that had full EC2 access.. Option D is correct because if the user has a service control policy (SCP) attached to the account that allows VPC creation, the SCP would override the IAM policy if the IAM policy is not properly denying. However, SCPs are for Organizations. Option A is correct because if the user has an inline policy that allows CreateVpc, that would override the deny from the group policy? Actually, an explicit allow would not override a deny; deny always wins. So Option A is wrong. Option B is wrong because the policy was attached to the group. Option C is wrong because the user was using the console. The correct answer is that the user might have an inline policy that explicitly allows the action, but since deny overrides allow, that cannot be the cause. Actually, if the user has an inline policy that allows, the deny from the group policy would still prevent it. So the most likely cause is that the policy was not attached to the user or the policy did not include all necessary actions. However, the question says the policy denies VPC creation. The user could have used a different API call like RunInstances with VPC creation? No. The most plausible is that the user used an AWS service that creates VPCs on behalf of the user, such as AWS CloudFormation or AWS Service Catalog, and the user had permissions to those services. Option D is correct because the user might have used AWS CloudFormation with a role that allows VPC creation.

Answer

The user used the AWS Management Console, which does not enforce IAM policies.

Answer

The user had an inline policy that allowed ec2:CreateVpc, overriding the group policy.

Answer

The policy was attached to the user's group, but the user was not a member of that group.

Question 18

A company hosts a critical web application on EC2 instances behind an Application Load Balancer. The security team enabled AWS WAF on the ALB to block SQL injection and XSS attacks. They also use AWS Shield Advanced for DDoS protection. Recently, the application experienced intermittent performance degradation during normal traffic patterns. The security team reviewed the WAF logs and found that legitimate user requests with query strings containing the word "select" (e.g., ?category=select+option) were being blocked. The team wants to ensure that only actual SQL injection attempts are blocked, not legitimate requests with similar patterns. What course of action should the SysOps administrator take to resolve this issue while maintaining security?

Accepted Answer

Create a custom WAF rule that inspects specific query string parameters with a more precise regex pattern to reduce false positives.. Option C is correct because AWS WAF allows you to create custom rules with conditions that can be scoped to specific parts of the request (e.g., URI path, query string). By creating a custom rule that targets the specific parameter (e.g., 'category') and uses a more precise regex pattern (like looking for SQL keywords in specific contexts), you can reduce false positives while still blocking actual SQL injection attempts. Option A is wrong because disabling the SQL injection rule entirely removes protection. Option B is wrong because switching to rate-based rules does not address SQL injection false positives. Option D is wrong because Shield Advanced does not have the ability to fine-tune WAF rules; it focuses on DDoS protection.

Answer

Disable the SQL injection rule in AWS WAF and rely solely on AWS Shield Advanced for protection.

Answer

Enable AWS Shield Advanced's automatic mitigation feature to handle all layer 7 attacks.

Answer

Replace the WAF SQL injection rule with a rate-based rule to limit request rates from specific IPs.

Question 19

A company uses Amazon CloudFront to deliver video content to users worldwide. The content is stored in an S3 bucket. The SysOps administrator notices that users in some geographic regions experience high latency when loading the video. The administrator wants to improve the performance for these users without changing the existing infrastructure. The CloudFront distribution is configured with the default cache behavior. What is the MOST cost-effective solution to reduce latency for users in those regions?

Accepted Answer

Change the CloudFront distribution's price class to include all edge locations.. Option A is correct. CloudFront's Price Class All uses all edge locations, reducing latency for users worldwide. If the distribution is currently using a limited price class, changing to Price Class All improves performance. Option B is wrong because adding more origins does not reduce latency. Option C is wrong because multiple distributions increase complexity and cost. Option D is wrong because increasing TTL does not reduce latency for initial requests.

Answer

Increase the cache TTL for the content.

Answer

Add additional S3 buckets in different regions and configure multiple origins.

Answer

Use multiple CloudFront distributions for different geographic regions.

Question 20

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) across three Availability Zones. Each AZ has one public and one private subnet. The EC2 instances are in the private subnets. The ALB is internet-facing. Recently, during a traffic spike, some users experienced intermittent timeouts. The SysOps administrator reviews the ALB access logs and finds that the timeouts correspond to periods when the target group had 'unhealthy' instances. The health check is configured to check a health endpoint on port 80 with a path of '/health'. The SysOps administrator checks the EC2 instances and finds that the health endpoint responds correctly. However, the health checks are failing intermittently. The administrator notices that the security group for the EC2 instances allows inbound traffic from the ALB's security group on port 80. The network ACL for the private subnets allows inbound HTTP and outbound ephemeral ports. What is the MOST likely cause of the health check failures?

Accepted Answer

The network ACL for the private subnets is blocking the return traffic from health checks.. Option B is correct. The NACL is stateless and must allow inbound ephemeral ports for the return traffic from health checks. The current NACL allows inbound HTTP (port 80) but does not explicitly allow inbound ephemeral ports (1024-65535) from the ALB's IP range. This causes the health check responses to be dropped. Option A is wrong because the security group is configured correctly. Option C is wrong because the health endpoint works when tested locally. Option D is wrong because cross-zone load balancing does not affect health checks.

Answer

The health check endpoint on the EC2 instances is not responding correctly.

Answer

The security group on the EC2 instances is blocking health check traffic from the ALB.

Answer

The ALB does not have cross-zone load balancing enabled.