SOA-C02 Hard Questions — 25 Difficult Questions

Question 1

A company runs a critical application on Amazon EC2 instances across multiple Availability Zones. The application stores state data on a shared Amazon EFS file system. The SysOps administrator needs to ensure that the file system remains available if an entire Availability Zone fails. The file system must also provide low-latency access from all instances. Which configuration meets these requirements?

Accepted Answer

Create an EFS file system with the Standard storage class in the same Region, and mount it from all instances using the regional mount target.. Option C is correct because the EFS Standard storage class stores data redundantly across multiple Availability Zones (AZs) within a Region, ensuring high availability and durability even if an entire AZ fails. By mounting the file system using the regional mount target (which resolves to the EFS file system's regional DNS name), instances in any AZ can access the file system with low latency, as EFS automatically routes traffic to the most appropriate mount target in the same AZ. This configuration meets both the availability and low-latency requirements without additional replication or failover complexity.

Answer

Create an EFS file system with the One Zone storage class and mount it from all instances.

Answer

Create an EFS file system with the Standard storage class, enable replication to another Region, and use DNS failover.

Answer

Create an EFS file system with the Standard storage class, and enable Multi-AZ deployment.

Question 2

A company manages multiple AWS accounts using AWS Organizations. The security team wants to restrict the use of Amazon EC2 instance types to only those that are approved for production workloads (e.g., m5.large, m5.xlarge). The policy should be applied to all member accounts in the organization, and it should prevent any non-approved instance type from being launched. The SysOps administrator should implement this with minimal operational overhead. Which solution should be used?

Accepted Answer

Create an AWS Organizations Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the approved list.. Option B is correct because AWS Organizations Service Control Policies (SCPs) can centrally enforce restrictions across all member accounts without requiring per-account configuration. By creating an SCP that denies ec2:RunInstances when the instance type is not in the approved list, the security team can prevent non-approved EC2 instance types from being launched with minimal operational overhead, as SCPs are applied at the organization, OU, or account level and do not require managing IAM policies in each account.

Answer

Create an IAM policy in each member account that denies ec2:RunInstances unless the instance type is in the approved list.

Answer

Use AWS Config with the managed rule 'ec2-instance-type-check' and an automatic remediation action that terminates non-compliant instances.

Answer

Use Amazon EventBridge to detect RunInstances API calls and invoke a Lambda function that terminates unapproved instances.

Question 3

A company runs a multi-tier application that uses an Amazon RDS for PostgreSQL database. The SysOps administrator needs to monitor the database for performance anomalies, such as sudden spikes in connections or query latencies. The administrator wants to receive alerts when metrics deviate from their expected baseline. The solution must automatically adjust to changes in normal behavior over time, such as seasonal patterns. Which AWS service or feature should the administrator use?

Accepted Answer

Configure Amazon CloudWatch Anomaly Detection on the relevant RDS metrics (e.g., DatabaseConnections, ReadLatency, WriteLatency) and set an alarm to notify when the metric breaches the anomaly band.. Amazon CloudWatch Anomaly Detection uses machine learning to continuously analyze metric patterns and establish a dynamic baseline that adapts to seasonal trends and gradual changes in normal behavior. By applying anomaly detection to RDS metrics like DatabaseConnections, ReadLatency, and WriteLatency, the administrator can set an alarm that triggers when a metric deviates outside the calculated anomaly band, automatically adjusting to evolving traffic patterns without manual threshold updates.

Answer

Use Amazon RDS Performance Insights to analyze database load and set CloudWatch alarms on the DBLoad metric with static thresholds.

Answer

Enable Amazon CloudWatch Metrics Explorer to create a dashboard that visualizes the metrics and manually review for anomalies.

Answer

Use AWS X-Ray to trace database queries and set alarms on trace segment durations.

Question 4

A company runs a critical MySQL database on an Amazon RDS DB instance in a single Availability Zone. The SysOps administrator needs to implement a disaster recovery solution with a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour, while minimizing costs. Which solution meets these requirements?

Accepted Answer

Enable cross-Region automated backups to another Region. Option C is correct because cross-Region automated backups replicate transaction logs to another AWS Region with a typical lag of a few minutes, enabling point-in-time recovery (PITR) that can meet an RPO of 5 minutes. When a disaster occurs, you can restore the automated backup to a new DB instance in the destination Region, and the RTO depends on the restore time, which can be under 1 hour for a properly sized instance. This solution minimizes costs by avoiding the continuous compute and storage overhead of a standby replica or read replica.

Answer

Enable Multi-AZ deployment with a synchronous standby replica in another Availability Zone

Answer

Create a cross-Region read replica and promote it to a standalone DB instance during a disaster

Answer

Take daily automated snapshots and copy them to another Region manually

Question 5

A company runs a critical stateful web application on Amazon EC2 instances in a single AWS region. The application stores user session data in an Amazon ElastiCache for Redis cluster. The SysOps administrator must design a disaster recovery (DR) strategy that can survive a complete regional outage with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The application must be able to redirect users to the DR region with minimal manual effort. Which combination of actions meets these requirements?

Accepted Answer

Create a read replica of the ElastiCache Redis cluster in the DR region using the native cross-region replication feature. Use Route 53 with failover routing to point to the DR region ALB when the primary health check fails. Pre-configure EC2 instances in an Auto Scaling group in the DR region.. Option B is correct because ElastiCache for Redis supports cross-region replication via a read replica in the DR region, which can keep session data synchronized with minimal lag, meeting the 15-minute RPO. Route 53 failover routing with health checks on the primary region's ALB automatically redirects traffic to the pre-configured DR region EC2 instances and ALB, achieving the 1-hour RTO with minimal manual effort. Pre-configuring the DR region with an Auto Scaling group ensures compute capacity is ready, while the read replica provides the required data availability.

Answer

Use Amazon Route 53 with weighted routing to distribute traffic between the two regions. Use a global DynamoDB table for session data, and launch EC2 instances in the DR region only when a failure is detected using AWS CloudFormation StackSets.

Answer

Use an Amazon CloudFront distribution with multiple origins (primary and DR). Enable session stickiness at the CloudFront level. Use EC2 instances in both regions behind separate ALBs. No special data replication is needed because sessions are stored in Redis.

Answer

Use EC2 instances with an Auto Scaling group in both regions. Schedule a Lambda function to take snapshots of the Redis cluster every 15 minutes and copy them to the DR region. Use Route 53 latency routing to direct users to the nearest region.

Question 6

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

Accepted Answer

AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.. AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Answer

AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications.

Answer

Amazon Macie to discover sensitive data and then manually encrypt buckets.

Question 7

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?

Accepted Answer

Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.. Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.

Answer

Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.

Answer

Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.

Answer

Create a resource-based policy on each EC2 instance that denies access from non-production accounts.

Question 8

A SysOps administrator needs to detect unauthorized changes to security groups and automatically notify the operations team. Which two AWS services should be part of the solution? (Choose 2.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to create, modify, or delete security groups, providing the audit trail needed to detect unauthorized changes. By enabling CloudTrail on the account and configuring a trail to deliver logs to Amazon S3, the administrator can monitor security group events such as AuthorizeSecurityGroupIngress or RevokeSecurityGroupEgress. This log data is essential for identifying when a change occurred, who made it, and from which source IP.

Answer

Amazon S3 Transfer Acceleration.

Answer

AWS Snowball Edge.

Question 9

A company uses CloudWatch Logs to store application logs. The logs must be retained for 3 years for compliance. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure an S3 lifecycle policy to transition objects to Glacier after 3 years.. Option A is correct because S3 lifecycle policies can transition objects to Glacier after a specified number of days, which allows long-term archival storage at low cost. This is a common approach for retaining logs beyond the CloudWatch Logs maximum retention period of 10 years, but here the requirement is 3 years, which is within CloudWatch Logs' capabilities. However, exporting to S3 and then applying a lifecycle policy is a valid method to ensure compliance with the 3-year retention requirement. Option E is correct because CloudWatch Logs export tasks can export log data to an S3 bucket, where it can be stored indefinitely and managed with lifecycle policies for long-term retention.

Answer

Enable CloudWatch Logs Insights.

Answer

Set the log group retention period to 3 years.

Answer

Use CloudWatch Logs subscription filter to stream logs to Amazon Kinesis Firehose.

Question 10

Which TWO options are valid ways to send custom metrics to Amazon CloudWatch?

Accepted Answer

Use the CloudWatch agent to collect and publish custom metrics.. Option A is correct because the CloudWatch agent can be installed on EC2 instances or on-premises servers to collect system-level metrics (like memory and disk usage) and custom application metrics, then publish them to CloudWatch. Option B is correct because the PutMetricData API call allows direct programmatic ingestion of custom metrics into CloudWatch, supporting up to 1,000 metrics per call with a maximum payload of 1 MB.

Answer

Use Amazon SQS to send metric data to CloudWatch.

Answer

Use AWS CloudTrail to log custom metrics.

Answer

Use Amazon Kinesis Data Firehose to deliver metrics to CloudWatch.

Question 11

A SysOps administrator is managing a fleet of EC2 instances that run a batch processing job. The job is completed when a certain metric in CloudWatch reaches a value. Currently, the administrator manually checks the metric and terminates the instances. Which AWS service can automate the termination of the instances when the metric threshold is breached?

Accepted Answer

Create a CloudWatch alarm that publishes to an SNS topic, which triggers a Lambda function to terminate the instance.. Option B is correct because CloudWatch alarms can trigger an SNS topic when a metric threshold is breached, and a Lambda function subscribed to that topic can execute custom code to terminate the EC2 instances. This provides a fully automated, event-driven remediation workflow without manual intervention.

Answer

Use AWS Config to detect the metric and terminate the instance.

Answer

Place the instances in an Auto Scaling group and use a lifecycle hook.

Answer

Configure a CloudWatch alarm to terminate the instance directly.

Question 12

An organization has a CloudWatch dashboard that displays metrics for multiple AWS services. The dashboard is shared with the operations team. Recently, some team members reported that the dashboard is not loading for them. Which action should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Confirm that the team members have the necessary IAM permissions for cloudwatch:GetDashboard.. The most likely cause of the dashboard not loading is that the team members lack the required IAM permission to retrieve the dashboard definition. CloudWatch dashboards are stored as JSON objects, and the `cloudwatch:GetDashboard` action is necessary to fetch and render that data in the console. Without this permission, the API call fails silently, resulting in a blank or non-loading dashboard.

Answer

Verify that the team members have subscribed to the metric streams.

Answer

Ensure the CloudWatch agent is installed on the instances displaying the dashboard.

Answer

Check that the dashboard is in the same region as the resources.

Question 13

A SysOps administrator is tasked with setting up a solution that automatically terminates EC2 instances that have been running for more than 24 hours. Which steps should the administrator take? (Select THREE.)

Accepted Answer

Tag each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp).. Options A, B, and D are correct. Option A creates a Lambda function to terminate instances. Option B creates an EventBridge rule that triggers the Lambda function. Option D tags instances with a launch time for the function to evaluate. Option C is wrong because CloudWatch alarms are for metric thresholds, not time-based. Option E is wrong because Auto Scaling lifecycle hooks are for lifecycle actions, not time-based termination.

Answer

Configure an Auto Scaling group lifecycle hook to terminate instances after 24 hours.

Answer

Create a CloudWatch alarm on the InstanceAge metric and set it to trigger the Lambda function.

Question 14

A company has an EC2 instance that needs to access an S3 bucket. The instance is launched in a private subnet with no internet gateway. What is the most secure way to provide access to S3 without traversing the internet?

Accepted Answer

Create an S3 VPC gateway endpoint. To provide access to S3 from a private subnet without an internet gateway, you can use an S3 VPC endpoint (Gateway type). This allows instances in the VPC to access S3 privately using the AWS network. Option C is correct. Option A is wrong because a NAT gateway would route traffic through the internet, which is less secure and requires an internet gateway. Option B is wrong because an internet gateway is needed for a NAT instance. Option D is wrong because AWS Direct Connect does not eliminate the need for a VPC endpoint; it provides a dedicated connection but still requires routing through the internet unless a VPC endpoint is used.

Answer

Use a NAT gateway in a public subnet

Answer

Set up an AWS Direct Connect connection

Answer

Attach an internet gateway to the VPC and a public IP to the instance

Question 15

A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires very low latency and high availability. The SysOps administrator notices that the application experiences increased latency during traffic spikes even though the Auto Scaling group is scaling out. Which solution would MOST effectively reduce latency?

Accepted Answer

Change the launch configuration to use a larger instance type with more CPU and memory.. Using a larger instance type (A) can handle more requests per instance, reducing latency. Pre-warming ELB (B) is not needed for ALB. Multi-AZ (C) improves availability but not necessarily latency. Increasing cooldown (D) would slow scaling, increasing latency.

Answer

Pre-warm the load balancer by contacting AWS Support.

Answer

Increase the Auto Scaling cooldown period.

Answer

Deploy the instances in multiple Availability Zones.

Question 16

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which THREE steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Configure the Lambda function to publish a custom metric to CloudWatch.. Options A, B, and D are correct. CloudTrail logs events in JSON, so a CloudWatch Logs subscription filter can be used to match the event name 'CreateAccessKey' and send matching events to Lambda for processing. The Lambda function can then publish a custom metric to CloudWatch, and a CloudWatch alarm can be set on that metric. Option C is wrong because EventBridge can directly match events without needing a CloudWatch Logs subscription; but the scenario asks for three steps, and using EventBridge alone is simpler but does not include the metric/alarm path. Option E is wrong because SNS can send notifications but does not provide filtering logic; it would receive all events.

Answer

Configure the CloudTrail trail to deliver logs directly to an SNS topic.

Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an SNS notification.

Question 17

A company uses AWS KMS to encrypt EBS volumes. Which TWO statements about using KMS with EBS are correct? (Choose two.)

Accepted Answer

AWS managed KMS keys are automatically rotated each year. EBS can use both customer managed and AWS managed KMS keys. AWS managed keys are automatically rotated. Option A and Option D are correct. Option B is wrong because EBS does not support asymmetric KMS keys. Option C is wrong because you cannot specify a KMS key when creating a snapshot; you can only encrypt snapshots with a key. Option E is wrong because EBS does not support importing key material.

Answer

You can import key material for EBS encryption

Answer

EBS supports asymmetric KMS keys

Answer

You must specify a KMS key when creating a snapshot

Question 18

A company has an AWS account with multiple VPCs connected via a transit gateway. The SysOps administrator needs to ensure that all traffic between VPCs is encrypted in transit. Which solution should the administrator implement?

Accepted Answer

Set up AWS Site-to-Site VPN connections between the VPCs via the transit gateway.. Option B is correct because VPN connections between VPCs or using AWS VPN CloudHub can encrypt traffic. Option A is wrong because VPC Peering does not encrypt traffic. Option C is wrong because VPC endpoints are for accessing AWS services. Option D is wrong because NACLs are stateless packet filters, not encryption.

Answer

Use VPC peering connections between the VPCs.

Answer

Use VPC endpoints to route traffic through AWS PrivateLink.

Answer

Configure network ACLs to deny unencrypted traffic.

Question 19

A company is using AWS Organizations and wants to delegate administration of a specific member account to a user in the management account. Which TWO steps are required?

Accepted Answer

Grant the user in the management account permissions to assume the role in the member account.. Correct options: A and D. Option A is correct because you need to create an IAM role in the member account with a trust policy allowing the management account to assume it. Option D is correct because the user must have permissions to assume that role. Option B is wrong because SCPs do not grant permissions; they restrict. Option C is wrong because AWS SSO is not required; IAM roles suffice. Option E is wrong because the management account already has full access; delegation is about giving specific users access.

Answer

Create an IAM user in the member account with the same name as the management account user.

Answer

Enable AWS Single Sign-On (SSO) for the member account.

Answer

Create a service control policy (SCP) that allows the member account to be administered.

Question 20

Refer to the exhibit. A SysOps administrator applies this bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows all HTTPS requests and denies HTTP requests.. Option C is correct because the policy Denies all S3 actions on objects if the request is not using HTTPS (secure transport false). Requests over HTTP are denied. Option A is wrong because the policy allows HTTPS requests (no allow statement needed; default allow if no explicit deny). Option B is wrong because the policy only denies if SecureTransport is false, not always. Option D is wrong because the policy does not affect bucket-level operations (note the resource is bucket/*).

Answer

Allows all requests regardless of encryption.

Answer

Denies all requests to the bucket.

Answer

Denies access to the bucket from any IP other than the VPC.