SOA-C02 Hard Questions — 25 Difficult Questions

Question 1

A SysOps administrator is managing a fleet of EC2 instances in an Auto Scaling group. The instances are behind an Application Load Balancer. The administrator notices that the 'SurgeQueueLength' metric for the ALB is frequently high. What does this indicate, and what is the BEST remediation action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The targets are not able to handle the request rate; increase the desired capacity or add scaling policies.. The SurgeQueueLength metric measures the number of requests that are queued by the Application Load Balancer (ALB) because no healthy target is available to process them. A frequently high value indicates that the targets (EC2 instances) are overwhelmed and cannot keep up with the incoming request rate. The best remediation is to increase the desired capacity of the Auto Scaling group or add scaling policies (e.g., based on SurgeQueueLength or RequestCountPerTarget) to automatically add more instances to handle the load.

Answer

The targets are unhealthy; decrease the desired capacity to reduce load.

Answer

The load balancer is accepting too many connections; increase the idle timeout.

Answer

The load balancer is overloaded; replace it with a Network Load Balancer.

Question 2

Which THREE measures help protect an S3 bucket from accidental data loss? (Choose 3)

Accepted Answer

Enable MFA Delete on the bucket.. Enabling MFA Delete on an S3 bucket requires multi-factor authentication for any delete operations, adding an extra layer of protection against accidental or unauthorized deletion of objects. This helps prevent data loss by ensuring that even if credentials are compromised, a delete action cannot be performed without the MFA token.

Answer

Create a lifecycle policy to transition objects to S3 Glacier.

Answer

Enable server-side encryption on the bucket.

Question 3

A company runs a critical production workload on a fleet of EC2 instances managed by an Auto Scaling group. The instances are behind an Application Load Balancer (ALB). Recently, the company experienced a regional outage that caused all instances to become unhealthy. The SysOps administrator must design a solution to automatically recover from such an outage with minimal downtime. The solution must be cost-effective and not require manual intervention. The administrator considers four options. Which option meets the requirements?

Accepted Answer

Create a warm standby environment in another AWS Region with a smaller Auto Scaling group. Use Route53 failover routing to switch traffic.. A regional outage takes down all Availability Zones in a Region, so only a cross-Region strategy can recover. A warm standby environment in another Region with a smaller Auto Scaling group, combined with Route 53 failover routing, provides automatic, low-downtime recovery without manual intervention. This is the AWS-recommended pattern for regional resilience and is more cost-effective than a fully active-active multi-Region deployment.

Answer

Configure the Auto Scaling group to launch instances across multiple Availability Zones and configure the ALB to route traffic to healthy targets.

Answer

Increase the desired capacity of the Auto Scaling group and use larger instance types to absorb the load during failover.

Answer

Use AWS Lambda to periodically check the health of instances and automatically relaunch failed instances in another region.

Question 4

A company runs a critical stateful web application on Amazon EC2 instances in a single AWS region. The application stores user session data in an Amazon ElastiCache for Redis cluster. The SysOps administrator must design a disaster recovery (DR) strategy that can survive a complete regional outage with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The application must be able to redirect users to the DR region with minimal manual effort. Which combination of actions meets these requirements?

Accepted Answer

Create a read replica of the ElastiCache Redis cluster in the DR region using the native cross-region replication feature. Use Route 53 with failover routing to point to the DR region ALB when the primary health check fails. Pre-configure EC2 instances in an Auto Scaling group in the DR region.. ElastiCache for Redis supports cross-region replication via a read replica in the DR region, which can keep session data synchronized with minimal lag, meeting the 15-minute RPO. Route 53 failover routing with health checks on the primary region's ALB automatically redirects traffic to the pre-configured DR region EC2 instances and ALB, achieving the 1-hour RTO with minimal manual effort. Pre-configuring the DR region with an Auto Scaling group ensures compute capacity is ready, while the read replica provides the required data availability.

Answer

Use Amazon Route 53 with weighted routing to distribute traffic between the two regions. Use a global DynamoDB table for session data, and launch EC2 instances in the DR region only when a failure is detected using AWS CloudFormation StackSets.

Answer

Use an Amazon CloudFront distribution with multiple origins (primary and DR). Enable session stickiness at the CloudFront level. Use EC2 instances in both regions behind separate ALBs. No special data replication is needed because sessions are stored in Redis.

Answer

Use EC2 instances with an Auto Scaling group in both regions. Schedule a Lambda function to take snapshots of the Redis cluster every 15 minutes and copy them to the DR region. Use Route 53 latency routing to direct users to the nearest region.

Question 5

A company runs a critical database workload on an Amazon RDS for MySQL DB instance with Multi-AZ deployment in the us-east-1 region. The SysOps administrator must design a disaster recovery strategy that can recover from a complete regional outage. The Recovery Time Objective (RTO) is 2 hours and the Recovery Point Objective (RPO) is 1 hour. Which solution meets these requirements at the lowest cost?

Accepted Answer

Create a cross-Region read replica in another Region and promote it to a standalone DB instance during a disaster.. A cross-Region read replica continuously replicates data from the primary RDS MySQL instance to another Region with minimal lag, typically achieving an RPO of seconds to minutes, well within the 1-hour requirement. Promoting the replica to a standalone instance during a disaster can be done in minutes, meeting the 2-hour RTO. This approach is the lowest cost among the viable options as it uses existing replication infrastructure without additional data transfer fees for snapshots or DMS replication instances.

Answer

Create manual snapshots of the DB instance every hour and copy them to another AWS Region.

Answer

Enable automated backups with a retention period of 35 days and restore to a different Region when needed.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to a DB instance in another Region.

Question 6

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?

Accepted Answer

Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.. Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.

Answer

Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.

Answer

Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.

Answer

Create a resource-based policy on each EC2 instance that denies access from non-production accounts.

Question 7

A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?

Accepted Answer

Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional. A CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.

Answer

Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it

Answer

Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement

Answer

Add a DeletionPolicy: Retain attribute to the RDS resource in the template

Question 8

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The admin has a template that creates an EC2 instance with a custom software stack. The software stack must be installed and configured using PowerShell scripts. The admin wants to minimize operational overhead by automating the creation of an AMI that includes the software stack, and the AMI should be rebuilt on a weekly basis to include the latest security patches. Which combination of AWS services should be used?

Accepted Answer

Use EC2 Image Builder to define a component with the PowerShell scripts, create a recipe, and schedule a pipeline to run weekly.. EC2 Image Builder is purpose-built for automating the creation, patching, and testing of custom AMIs. By defining a component that encapsulates the PowerShell scripts, creating a recipe that references that component, and scheduling a pipeline to run weekly, the administrator achieves fully automated, repeatable AMI builds with minimal operational overhead. This directly meets the requirement for weekly rebuilds with the latest security patches.

Answer

Use AWS Systems Manager Automation to run a PowerShell script on an existing EC2 instance, then manually create an AMI each week.

Answer

Use AWS CodePipeline with CodeBuild to run the PowerShell scripts and create an AMI using the AWS CLI, triggered by a weekly CloudWatch Events schedule.

Answer

Use Amazon EC2 Auto Scaling with a lifecycle hook to run the PowerShell script on instance launch, and schedule a weekly instance refresh.

Question 9

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

Accepted Answer

AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.. AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Answer

AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications.

Answer

Amazon Macie to discover sensitive data and then manually encrypt buckets.

Question 10

A company runs a critical application on Amazon EC2 instances across multiple Availability Zones. The application stores state data on a shared Amazon EFS file system. The SysOps administrator needs to ensure that the file system remains available if an entire Availability Zone fails. The file system must also provide low-latency access from all instances. Which configuration meets these requirements?

Accepted Answer

Create an EFS file system with the Standard storage class in the same Region, and mount it from all instances using the regional mount target.. The EFS Standard storage class stores data redundantly across multiple Availability Zones (AZs) within a Region, ensuring high availability and durability even if an entire AZ fails. By mounting the file system using the regional mount target (which resolves to the EFS file system's regional DNS name), instances in any AZ can access the file system with low latency, as EFS automatically routes traffic to the most appropriate mount target in the same AZ. This configuration meets both the availability and low-latency requirements without additional replication or failover complexity.

Answer

Create an EFS file system with the One Zone storage class and mount it from all instances.

Answer

Create an EFS file system with the Standard storage class, enable replication to another Region, and use DNS failover.

Answer

Create an EFS file system with the Standard storage class, and enable Multi-AZ deployment.

Question 11

A company uses Amazon CloudFront to deliver content to a global audience. The origin is an Application Load Balancer in us-east-1. The SysOps administrator wants to reduce costs by minimizing the number of requests that reach the origin server. Which action should the administrator take?

Accepted Answer

Enable CloudFront Origin Shield.. CloudFront Origin Shield acts as an additional caching layer in front of the origin, reducing the load on the origin by consolidating requests from multiple edge locations. This minimizes the number of requests that reach the Application Load Balancer, directly lowering origin request costs and improving cache hit ratio.

Answer

Configure multiple origins for failover.

Answer

Enable CloudFront Web Application Firewall (WAF) integration.

Answer

Increase the cache TTL for CloudFront distributions.

Question 12

A company runs a critical application on a fleet of EC2 instances that process real-time financial transactions. The application requires consistent low latency. The SysOps administrator notices that the application's latency increases periodically due to noisy neighbors. The administrator wants to optimize performance predictability. Which instance type should the administrator choose?

Accepted Answer

Dedicated Instances. Dedicated Instances run on hardware dedicated to a single customer, eliminating the noisy-neighbor problem because no other AWS accounts share the underlying physical host. This provides the performance predictability required for consistent low-latency financial transaction processing.

Answer

Burstable Performance Instances (T3)

Answer

Spot Instances

Answer

Reserved Instances

Question 13

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The data center has multiple VLANs that need to connect to separate VPCs in AWS. The company wants to maintain isolation between the VPCs while maximizing bandwidth utilization. Which solution should the SysOps administrator recommend?

Accepted Answer

Configure a single Direct Connect connection with multiple private virtual interfaces, each tagged with a different VLAN ID and associated with a different VPC.. A single Direct Connect connection can support multiple private virtual interfaces (VIFs), each tagged with a unique 802.1Q VLAN ID. This allows the on-premises data center to connect to separate VPCs while maintaining traffic isolation via VLAN tagging, and it maximizes bandwidth utilization by sharing the single connection's capacity across all VIFs.

Answer

Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway, then configure route tables to isolate traffic.

Answer

Provision multiple Direct Connect connections, one for each VPC, and use a different VLAN on each connection.

Answer

Establish a single Direct Connect connection and use IPsec VPN tunnels over it to connect to each VPC.

Question 14

A SysOps administrator examines the output of the describe-alarms command for the 'HighCPU' alarm. The alarm is in ALARM state. What action will be taken automatically?

Accepted Answer

Send a notification to an SNS topic.. The 'HighCPU' alarm is a CPU utilization metric alarm. EC2 instance recovery actions are only valid for alarms based on StatusCheckFailed metrics, not for CPU alarms. Without specific configuration indicating an Auto Scaling policy, the most common automatic action for a CPU alarm is to send a notification to an SNS topic if one is configured. Therefore, the correct answer is D.

Answer

Recover the EC2 instance using EC2 instance recovery.

Answer

Launch a new EC2 instance in an Auto Scaling group.

Answer

Reboot the EC2 instance.

Question 15

A company is deploying a critical application using AWS CloudFormation. The deployment must be resilient to failures and ensure that resources are created in a specific order. The template defines a stack that includes an Amazon RDS database and an Auto Scaling group. The Auto Scaling group depends on the database being available. Which CloudFormation feature should the SysOps administrator use to ensure the database is fully created and available before the Auto Scaling group is created?

Accepted Answer

Use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use a CreationPolicy on the RDS instance to signal when it is ready.. The correct approach is to use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use a CreationPolicy on the RDS instance so that it sends a signal only after it is fully available. DependsOn alone only waits until CloudFormation marks the RDS as created, which may not mean it is ready to accept connections. The CreationPolicy ensures that the RDS signals its readiness, and the DependsOn then causes the Auto Scaling group to wait for that signal. Option A is wrong because reversing the DependsOn would not help. Option C is wrong because cfn-signal is used with CreationPolicy, but placing it on the Auto Scaling group would wait for a signal from the database, not the other way around. Option D is wrong because DeletionPolicy affects deletion behavior, not creation order.

Answer

Use the DependsOn attribute on the RDS instance to wait for the Auto Scaling group.

Answer

Use the DependsOn attribute on the Auto Scaling group to wait for the RDS instance, and also use cfn-signal on the Auto Scaling group to wait for the database.

Answer

Use the DeletionPolicy attribute on the Auto Scaling group to ensure it is not deleted.

Question 16

A company runs a web application on Amazon EC2 instances. The application's traffic pattern is unpredictable, often spiking to 3x normal load for short periods. The SysOps administrator needs to ensure that the application can handle spikes without performance degradation while minimizing costs. Which combination of purchasing options and scaling strategies should the administrator use?

Accepted Answer

Use a mix of Reserved Instances for baseline and On-Demand for spikes, with a target tracking scaling policy.. It combines Reserved Instances for the predictable baseline load, which reduces costs through a significant discount, with On-Demand Instances to handle unpredictable spikes. The target tracking scaling policy automatically adjusts capacity based on a target metric (e.g., average CPU utilization), ensuring performance is maintained during spikes without manual intervention or over-provisioning.

Answer

Use all Spot Instances with a simple scaling policy.

Answer

Use all On-Demand Instances with a scheduled scaling policy.

Answer

Use only Reserved Instances with a manual scaling policy.

Question 17

A SysOps Administrator manages a VPC with public and private subnets. The private subnets need to access the internet for software updates. The Administrator creates a NAT Gateway in a public subnet and updates the private subnet route table to point 0.0.0.0/0 to the NAT Gateway. However, instances in the private subnet still cannot reach the internet. What is the MOST likely reason?

Accepted Answer

The NAT Gateway does not have an Elastic IP address assigned.. A NAT Gateway must have an Elastic IP (EIP) address assigned to it in order to function as an internet gateway for private subnets. Without an EIP, the NAT Gateway cannot communicate with the internet. Option A is unlikely because security groups allow outbound traffic by default. Option B is incorrect because the internet gateway attaches to the VPC, not to the NAT Gateway. Option D is incorrect because NAT Gateways do not have security groups; they use network ACLs at the subnet level, but the issue here is the missing EIP.

Answer

The security group on the private instances blocks outbound HTTPS traffic.

Answer

The internet gateway is not attached to the NAT Gateway.

Answer

The NAT Gateway's security group is blocking inbound traffic from the private subnet.

Question 18

An application runs on EC2 instances in an Auto Scaling group. The instances process messages from an SQS queue. To ensure high availability, the SysOps administrator has configured the Auto Scaling group to span three Availability Zones. However, during a recent failure of one AZ, the application experienced a temporary increase in processing latency. What is the MOST likely cause of this latency?

Accepted Answer

SQS messages in the failed AZ are temporarily unavailable until they are replicated to other AZs.. SQS stores messages redundantly across multiple AZs within a region, but when an AZ fails, messages that were in-flight or stored in that AZ become temporarily unavailable until the SQS service completes its internal replication and recovery processes. This transient unavailability causes a spike in processing latency because the application cannot retrieve those messages until they are replicated to healthy AZs. The latency resolves once SQS finishes replicating the messages to the remaining AZs.

Answer

The SQS queue is configured to use a single AZ for message storage.

Answer

The application is not configured to process messages from multiple AZs.

Answer

The Auto Scaling group's minimum size is too low to handle the load after the AZ failure.

Question 19

A company uses Amazon S3 to store backups and logs. The total data volume is 50 TB and grows by 2 TB per month. The company requires that data be retained for 7 years. Which THREE actions will optimize storage costs? (Choose THREE.)

Accepted Answer

Use S3 Lifecycle policies to transition data to S3 Glacier Deep Archive after 30 days.. The correct answers are A, B, and D. S3 Lifecycle policies help optimize storage costs. Option A transitions data to S3 Glacier Deep Archive, the lowest-cost storage class for long-term retention. Option B expires incomplete multipart uploads, preventing unnecessary storage charges. Option D uses S3 Intelligent-Tiering, which automatically moves data between tiers based on changing access patterns, reducing costs for infrequently accessed data with unknown patterns. Option C is incorrect because deleting data after one year fails to meet the 7-year retention requirement. Option E is incorrect because S3 Glacier Flexible Retrieval is more expensive than S3 Glacier Deep Archive and is not necessary for data that is rarely accessed.

Answer

Store all data in S3 Standard for the first year, then delete.

Answer

Use S3 Glacier Flexible Retrieval to allow data retrieval in minutes.

Question 20

A company is using AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Machine Image (AMI) that includes specific software. The administrator creates a custom AMI and configures the Elastic Beanstalk environment to use it. However, new instances launched during scaling use the default platform AMI instead. What is the MOST likely cause?

Accepted Answer

The custom AMI is configured in the environment's launch configuration, but the environment has not been updated to replace existing instances.. When you update the launch configuration in an Elastic Beanstalk environment to use a custom AMI, existing instances are not automatically replaced. The new AMI only applies to instances launched during scaling or environment updates that trigger instance replacement. Since the administrator did not perform an environment update that replaces existing instances, the running instances continue to use the default platform AMI.

Answer

The custom AMI ID is specified in the environment properties instead of the launch configuration.

Answer

The custom AMI is encrypted, and the instance profile does not have permissions to decrypt it.

Answer

The Elastic Beanstalk platform version is incompatible with the custom AMI.