SOA-C02 Multiple Select — 10 Questions

Question 1

A SysOps administrator needs to detect unauthorized changes to security groups and automatically notify the operations team. Which two AWS services should be part of the solution? (Choose 2.)

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is correct because it records API calls made to create, modify, or delete security groups, providing the audit trail needed to detect unauthorized changes. By enabling CloudTrail on the account and configuring a trail to deliver logs to Amazon S3, the administrator can monitor security group events such as AuthorizeSecurityGroupIngress or RevokeSecurityGroupEgress. This log data is essential for identifying when a change occurred, who made it, and from which source IP.

Answer

Amazon S3 Transfer Acceleration.

Answer

AWS Snowball Edge.

Question 2

A company uses CloudWatch Logs to store application logs. The logs must be retained for 3 years for compliance. Which TWO steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure an S3 lifecycle policy to transition objects to Glacier after 3 years.. Option A is correct because S3 lifecycle policies can transition objects to Glacier after a specified number of days, which allows long-term archival storage at low cost. This is a common approach for retaining logs beyond the CloudWatch Logs maximum retention period of 10 years, but here the requirement is 3 years, which is within CloudWatch Logs' capabilities. However, exporting to S3 and then applying a lifecycle policy is a valid method to ensure compliance with the 3-year retention requirement. Option E is correct because CloudWatch Logs export tasks can export log data to an S3 bucket, where it can be stored indefinitely and managed with lifecycle policies for long-term retention.

Answer

Enable CloudWatch Logs Insights.

Answer

Set the log group retention period to 3 years.

Answer

Use CloudWatch Logs subscription filter to stream logs to Amazon Kinesis Firehose.

Question 3

Which TWO AWS services can be used to monitor the performance of an Amazon RDS database and set alarms based on metrics?

Accepted Answer

Amazon RDS Performance Insights. Amazon CloudWatch (Option D) is the primary monitoring service for AWS resources, including Amazon RDS. It collects metrics like CPU utilization, database connections, and read/write latency, and allows you to set CloudWatch Alarms that trigger actions (e.g., SNS notifications) when thresholds are breached. Amazon RDS Performance Insights (Option B) provides deeper database performance analysis by visualizing database load and identifying bottlenecks, and it can also publish metrics to CloudWatch for alarm purposes.

Answer

AWS Lambda

Answer

Amazon S3

Answer

AWS CloudTrail

Question 4

Which TWO options are valid ways to send custom metrics to Amazon CloudWatch?

Accepted Answer

Use the CloudWatch agent to collect and publish custom metrics.. Option A is correct because the CloudWatch agent can be installed on EC2 instances or on-premises servers to collect system-level metrics (like memory and disk usage) and custom application metrics, then publish them to CloudWatch. Option B is correct because the PutMetricData API call allows direct programmatic ingestion of custom metrics into CloudWatch, supporting up to 1,000 metrics per call with a maximum payload of 1 MB.

Answer

Use Amazon SQS to send metric data to CloudWatch.

Answer

Use AWS CloudTrail to log custom metrics.

Answer

Use Amazon Kinesis Data Firehose to deliver metrics to CloudWatch.

Question 5

A SysOps administrator is setting up monitoring for an RDS MySQL database. The administrator needs to be notified when the database connection count exceeds 100. Which steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.. Option A is correct because Amazon CloudWatch alarms can send notifications to an Amazon SNS topic when the alarm state changes. This allows the SysOps administrator to receive alerts (e.g., via email, SMS, or HTTP) when the database connection count exceeds the threshold. Option B is correct because the 'DatabaseConnections' metric is a standard CloudWatch metric for RDS MySQL that tracks the number of current connections to the database instance. Creating an alarm on this metric with a threshold of 100 will trigger when the connection count exceeds that value.

Answer

Enable Enhanced Monitoring for RDS.

Answer

Enable CloudTrail to log RDS API calls.

Answer

Create an Amazon EventBridge rule that triggers on RDS events.

Question 6

A SysOps administrator wants to be alerted when the root user of the AWS account signs in. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail logs all API calls, including root user sign-ins, as `RootLogin` events in the management events trail. Option D is correct because Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches these CloudTrail log events and triggers a notification action, such as sending an SNS alert, when the root user signs in.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 7

A company wants to monitor AWS API calls for suspicious activity. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. Options B and C are correct. CloudTrail logs API calls, and CloudWatch Logs can ingest those logs and use metric filters to detect suspicious patterns. Option A (AWS Config) records resource changes, not API calls. Option D (VPC Flow Logs) captures network traffic. Option E (Amazon Inspector) is for security assessments.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS Config

Question 8

A SysOps administrator is tasked with setting up a solution that automatically terminates EC2 instances that have been running for more than 24 hours. Which steps should the administrator take? (Select THREE.)

Accepted Answer

Tag each EC2 instance with its launch time (e.g., key: LaunchTime, value: timestamp).. Options A, B, and D are correct. Option A creates a Lambda function to terminate instances. Option B creates an EventBridge rule that triggers the Lambda function. Option D tags instances with a launch time for the function to evaluate. Option C is wrong because CloudWatch alarms are for metric thresholds, not time-based. Option E is wrong because Auto Scaling lifecycle hooks are for lifecycle actions, not time-based termination.

Answer

Configure an Auto Scaling group lifecycle hook to terminate instances after 24 hours.

Answer

Create a CloudWatch alarm on the InstanceAge metric and set it to trigger the Lambda function.

Question 9

Which TWO actions should a SysOps administrator take to set up centralized logging from multiple Amazon EC2 instances running Amazon Linux 2 to Amazon CloudWatch Logs?

Accepted Answer

Attach an IAM role to each EC2 instance that includes permission for logs:PutLogEvents.. Options A and C are correct. Installing and configuring the CloudWatch Logs agent on each EC2 instance is required to send logs to CloudWatch. The IAM role must grant the logs:PutLogEvents permission to allow the agent to write log events. Option B is wrong because CloudWatch Logs does not support S3 as a direct target for real-time log ingestion; S3 is a destination for log exports. Option D is wrong because there is no 'export' action needed; the agent pushes logs. Option E is wrong because CloudWatch Logs does not require VPC endpoints for internet-facing instances; it uses public endpoints.

Answer

Create an S3 bucket and configure the EC2 instances to write logs directly to the bucket.

Answer

Create a VPC endpoint for CloudWatch Logs to allow private connectivity.

Answer

Export the logs from CloudWatch Logs to an Amazon S3 bucket for long-term retention.

Question 10

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which THREE steps should the SysOps administrator take to meet this requirement?

Accepted Answer

Configure the Lambda function to publish a custom metric to CloudWatch.. Options A, B, and D are correct. CloudTrail logs events in JSON, so a CloudWatch Logs subscription filter can be used to match the event name 'CreateAccessKey' and send matching events to Lambda for processing. The Lambda function can then publish a custom metric to CloudWatch, and a CloudWatch alarm can be set on that metric. Option C is wrong because EventBridge can directly match events without needing a CloudWatch Logs subscription; but the scenario asks for three steps, and using EventBridge alone is simpler but does not include the metric/alarm path. Option E is wrong because SNS can send notifications but does not provide filtering logic; it would receive all events.

Answer

Configure the CloudTrail trail to deliver logs directly to an SNS topic.

Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an SNS notification.