SOA-C02 Practice Test 9 — 10 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application reads data from an Amazon RDS for MySQL database. During peak hours, the database CPU utilization is consistently high, and the application experiences increased latency. The SysOps administrator observes that 90% of database queries are read-only. Which combination of actions will both improve performance and optimize costs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a read replica for the RDS instance and modify the application to route read queries to the read replica. Implementing a read replica offloads read-heavy (90%) queries from the primary RDS instance, reducing CPU utilization and latency. Modifying the application to route read queries to the replica distributes the workload, improving performance while avoiding costly vertical scaling. This optimizes costs by using a smaller primary instance and paying only for the replica's resources.

Answer

Enable Multi-AZ for the RDS instance and scale up the instance size

Answer

Enable Amazon RDS Performance Insights and increase the storage allocation

Answer

Implement Amazon ElastiCache for Memcached in front of the database and migrate read-heavy queries to cache

Question 2

Drag and drop the steps to set up an Amazon S3 bucket policy to grant cross-account access into the correct order.

Accepted Answer

Identify the bucket and account, then write the policy with correct principal and actions, then save the policy, then test access.. Identify the bucket and account, write the policy with correct principal and actions, save, and test.

Answer

Write the policy with correct principal and actions, then identify the bucket and account, then save the policy, then test access.

Answer

Identify the bucket and account, then write the policy with correct principal and actions, then test access, then save the policy.

Answer

Identify the bucket and account, then save the policy, then write the policy with correct principal and actions, then test access.

Question 3

A company runs a stateless web application on Amazon EC2 instances in an Auto Scaling group across two Availability Zones. The SysOps administrator needs to ensure that the application can tolerate a failure of an entire Availability Zone. Which configuration is required?

Accepted Answer

Use an Application Load Balancer (ALB) that spans both Availability Zones with health checks enabled.. An Application Load Balancer (ALB) that spans both Availability Zones with health checks enabled distributes incoming traffic across EC2 instances in multiple AZs. If an entire AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZ, ensuring the stateless web application remains available. Health checks detect instance or AZ failure and remove unhealthy targets from the load balancer's target group, which is essential for fault tolerance.

Answer

Enable termination protection on all Amazon EC2 instances.

Answer

Place the Amazon EC2 instances in a cluster placement group.

Answer

Associate an Elastic IP address with the primary instance.

Question 4

A company has an Amazon VPC with public and private subnets across two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an Amazon S3 bucket to upload and download files. The SysOps administrator must ensure that traffic to S3 does not traverse the internet and minimizes data transfer costs. Which solution should the administrator implement?

Accepted Answer

Create an S3 VPC Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.. An S3 VPC Gateway Endpoint provides a private, cost-effective connection to S3 from within the VPC without traversing the internet. By associating the endpoint with the route tables of the private subnets, traffic destined for S3 is routed directly through AWS's internal network, avoiding data transfer costs and internet egress charges.

Answer

Create an S3 VPC Interface Endpoint in the VPC and associate it with the security groups of the private subnets.

Answer

Set up a NAT Gateway in the public subnets and add a route to the private subnets' route tables pointing to the NAT Gateway for S3 traffic.

Answer

Use AWS PrivateLink with an S3 endpoint service hosted in a different VPC.

Question 5

A company has an on-premises data center connected to AWS via an AWS Direct Connect private virtual interface (VIF). The SysOps administrator needs to ensure that all traffic between the on-premises network and Amazon S3 in the same AWS Region stays within the AWS network and does not traverse the internet. Which solution should the administrator implement?

Accepted Answer

Use a Direct Connect gateway and a private VIF with VPC endpoints for S3. A private VIF with VPC endpoints for S3 (Gateway Endpoints) ensures that traffic from on-premises to S3 stays within the AWS network. The private VIF provides connectivity to the VPC, and the Gateway Endpoint routes S3 traffic through the AWS backbone without traversing the internet. This combination meets the requirement of keeping traffic within the AWS network.

Answer

Use a Direct Connect gateway and a public VIF with a route to S3 prefix lists

Answer

Use a VPN connection over Direct Connect to access S3

Answer

Use a Transit Gateway with a private VIF and route S3 traffic through a NAT instance

Question 6

A company runs a critical MySQL database on an Amazon RDS DB instance in a single Availability Zone. The SysOps administrator needs to implement a disaster recovery solution with a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour, while minimizing costs. Which solution meets these requirements?

Accepted Answer

Enable cross-Region automated backups to another Region. Cross-Region automated backups replicate transaction logs to another AWS Region with a typical lag of a few minutes, enabling point-in-time recovery (PITR) that can meet an RPO of 5 minutes. When a disaster occurs, you can restore the automated backup to a new DB instance in the destination Region, and the RTO depends on the restore time, which can be under 1 hour for a properly sized instance. This solution minimizes costs by avoiding the continuous compute and storage overhead of a standby replica or read replica.

Answer

Enable Multi-AZ deployment with a synchronous standby replica in another Availability Zone

Answer

Create a cross-Region read replica and promote it to a standalone DB instance during a disaster

Answer

Take daily automated snapshots and copy them to another Region manually

Question 7

A SysOps administrator manages a fleet of Amazon EC2 instances. The administrator needs to identify underutilized instances and receive recommendations for instance type changes to reduce costs. Which AWS service should be used to provide these rightsizing recommendations?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, network, and storage) of EC2 instances and generates rightsizing recommendations, including instance type changes, to reduce costs and improve performance. It directly addresses the need to identify underutilized instances and provide actionable recommendations for cost optimization.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Dashboard

Question 8

A company runs a REST API on Amazon EC2 instances behind an Application Load Balancer. The SysOps administrator needs to monitor the API endpoint from multiple geographic locations and receive an alarm if the p90 latency exceeds 2 seconds for two consecutive checks. The solution must use AWS managed services and not require custom code running on EC2. Which approach should the administrator use?

Accepted Answer

Set up Amazon CloudWatch Synthetics canaries to run from multiple AWS Regions and publish custom metrics. Create a CloudWatch alarm on the p90 latency metric.. Amazon CloudWatch Synthetics canaries are AWS-managed Node.js scripts that run on a schedule to monitor endpoints from multiple AWS Regions, capturing metrics like duration and latency. By configuring canaries to report p90 latency as a custom metric, you can create a CloudWatch alarm that triggers when p90 exceeds 2 seconds for two consecutive data points, meeting all requirements without custom EC2 code.

Answer

Configure VPC Flow Logs on the Application Load Balancer and use Amazon CloudWatch Logs Insights to query for high-latency requests.

Answer

Enable Amazon CloudWatch RUM (Real User Monitoring) on the client side and create a CloudWatch alarm on the Duration metric.

Answer

Use AWS CloudTrail to log API calls and set a CloudWatch alarm on the event count for errors.

Question 9

A company has multiple on-premises branch offices, each with a site-to-site VPN connection to a single VPC in AWS. The SysOps administrator needs to enable communication between the branch offices using the AWS cloud as a hub. Which configuration should be implemented to achieve this with the least operational overhead?

Accepted Answer

Use dynamic routing (BGP) on all VPN connections and enable route propagation on the virtual private gateway (VGW).. Enabling dynamic routing (BGP) on all VPN connections and propagating routes from the virtual private gateway (VGW) into the VPC route table allows each branch office to learn the CIDR blocks of all other branch offices automatically. This eliminates the need for manual static route entries and ensures that traffic between branch offices is routed through the VPC hub with minimal operational overhead, as BGP handles failover and route updates dynamically.

Answer

Configure static routes in the VPC route table pointing to each VPN connection.

Answer

Create a separate Transit VPC with EC2-based VPN appliances to route traffic between branch offices.

Answer

Place all branch offices in the same IPsec tunnel by configuring identical pre-shared keys.

Question 10

A company's security policy requires that all IAM user passwords must be at least 12 characters long. The SysOps administrator needs to enforce this requirement across the AWS account. Which action should the administrator take?

Accepted Answer

Update the IAM account password policy to require a minimum length of 12 characters.. The IAM account password policy is the native AWS mechanism for enforcing password requirements across all IAM users in an account. By updating this policy to require a minimum length of 12 characters, the administrator ensures that any new or changed password must comply, and existing passwords are not affected until the next change. This is a direct, account-wide setting that requires no additional services or custom logic.

Answer

Create an AWS Config rule to check password length and auto-remediate.

Answer

Enable AWS CloudTrail to monitor for password changes and alert the administrator.

Answer

Attach a service control policy (SCP) that denies IAM user creation if the password is less than 12 characters.