SOA-C02 Multiple Select — 30 Questions

Question 1

Which THREE measures help protect an S3 bucket from accidental data loss? (Choose 3)

Accepted Answer

Enable MFA Delete on the bucket.. Enabling MFA Delete on an S3 bucket requires multi-factor authentication for any delete operations, adding an extra layer of protection against accidental or unauthorized deletion of objects. This helps prevent data loss by ensuring that even if credentials are compromised, a delete action cannot be performed without the MFA token.

Answer

Create a lifecycle policy to transition objects to S3 Glacier.

Answer

Enable server-side encryption on the bucket.

Question 2

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Accepted Answer

Misconfigured firewall or iptables. An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Answer

Network connectivity issues

Answer

Detached EBS root volume

Answer

Insufficient memory for applications

Question 3

A SysOps administrator needs to reduce data transfer costs for a web application hosted on EC2 instances in a VPC. The application serves content to users over the internet. Which TWO actions will help reduce data transfer costs? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for Amazon S3 to keep S3 traffic within AWS.. Option B is correct because a VPC Gateway Endpoint for Amazon S3 routes S3 traffic privately within the AWS network instead of through a NAT Gateway or internet gateway, eliminating NAT data processing charges and internet data transfer fees for that traffic. Option C is correct because Amazon CloudFront caches static content at edge locations closer to users, reducing the volume of data transferred out from the EC2 instances and lowering EC2 data transfer out charges. Option A is incorrect because Direct Connect is for private connectivity to AWS, not for serving public internet users, and private subnets do not reduce internet egress costs. Option D is incorrect because an Application Load Balancer distributes traffic but does not by itself reduce data transfer costs and adds LCU charges. Option E is incorrect because a larger NAT Gateway does not lower per-GB NAT data processing charges and may increase cost.

Answer

Move all instances to private subnets and use AWS Direct Connect for user access.

Answer

Use an Application Load Balancer to distribute traffic.

Answer

Use a larger NAT Gateway to improve throughput.

Question 4

A company has an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The company wants to enable path-based routing to send requests to different target groups. Which TWO resources must be created to achieve this?

Accepted Answer

Target group for each backend service. (Target group for each backend service) and Option D (Listener rule with a path pattern condition) are correct. Path-based routing requires creating target groups for each backend service and a listener rule with a path pattern condition to direct requests to the appropriate target group. Option A is incorrect because subnets are needed for the ALB, but they are not specifically required for path-based routing. Option C is incorrect because a Network Load Balancer is not used; the ALB itself handles path-based routing. Option E is incorrect because a security group controls traffic but does not enable path-based routing.

Answer

Subnet for the ALB

Answer

Network Load Balancer (NLB)

Answer

Security group for the ALB

Question 5

A company is using Amazon S3 to store media files. The files are accessed frequently for the first 90 days, then rarely after that. The company wants to optimize storage costs. Which TWO actions should the SysOps administrator take? (Choose two.)

Accepted Answer

Configure a lifecycle policy to delete incomplete multipart uploads after 7 days. Configuring a lifecycle policy to delete incomplete multipart uploads after 7 days prevents orphaned parts from incurring storage costs. Option C is correct because creating a lifecycle policy to transition objects to S3 Standard-IA after 90 days reduces storage costs for infrequently accessed data. Option B is incorrect because S3 Object Lock is used for compliance and retention, not cost optimization. Option D is incorrect because enabling S3 Versioning can increase storage costs by retaining multiple versions of objects. Option E is incorrect because enabling Requester Pays shifts the cost of requests and data transfer to the requester, but does not optimize storage costs for the company.

Answer

Enable S3 Object Lock to prevent deletion

Answer

Enable S3 Versioning to keep multiple versions

Answer

Enable Requester Pays on the bucket

Question 6

A CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED. Which two actions are appropriate next steps? (Choose 2.)

Accepted Answer

Review stack events to identify the resource that blocked rollback.. When a CloudFormation stack update fails and enters UPDATE_ROLLBACK_FAILED, the stack events provide detailed error messages for each resource that failed during rollback. Reviewing these events is essential to identify the specific resource that blocked the rollback, such as a resource that could not be deleted or updated due to permissions, dependencies, or configuration issues. This diagnosis is the first step before attempting a continue-update-rollback operation.

Answer

Delete the CloudFormation service role from IAM.

Answer

Rename the stack to force rollback completion.

Question 7

A company has a VPC with a public subnet and a private subnet. The private subnet contains an EC2 instance that must access the internet for software updates. Which TWO actions are required to enable this? (Choose TWO.)

Accepted Answer

Deploy a NAT Gateway in a public subnet.. A NAT Gateway in a public subnet provides outbound internet access for private instances while preventing inbound connections. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling traffic to be forwarded to the internet via the Internet Gateway attached to the VPC.

Answer

Add an Internet Gateway to the private subnet's route table.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach an Internet Gateway to the NAT Gateway.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to be notified when a stack enters a ROLLBACK_IN_PROGRESS state. Which TWO methods can achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the CloudFormation stack status change.. Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack status changes, including ROLLBACK_IN_PROGRESS, by matching the 'CloudFormation Stack Status Change' event pattern. This allows you to trigger a notification action (e.g., via SNS or Lambda) in real time when the stack enters that state.

Answer

Use AWS Config rules to evaluate the stack state.

Answer

Configure a CloudWatch Logs subscription filter to detect the stack state.

Answer

Create a CloudTrail trail and monitor the UpdateStack API call.

Question 9

Which THREE of the following are valid options for connecting a VPC to an on-premises network? (Select THREE.)

Accepted Answer

Transit gateway with VPN attachment. A Transit Gateway with a VPN attachment allows you to connect your VPC to an on-premises network by acting as a central hub that interconnects VPCs and on-premises networks via IPsec VPN tunnels. This is a valid option because the Transit Gateway can terminate multiple VPN connections, enabling hybrid connectivity with centralized routing and scalability.

Answer

VPC peering

Answer

VPC endpoint

Question 10

Which TWO configurations can improve the performance of an Amazon RDS for PostgreSQL database that is experiencing high read latency? (Choose TWO.)

Accepted Answer

Enable provisioned IOPS on the DB instance.. Enabling Provisioned IOPS on an Amazon RDS for PostgreSQL database provides consistent and predictable I/O performance, which directly reduces read latency by ensuring sufficient IOPS for read-intensive workloads. Option C is correct because creating a read replica offloads read traffic from the primary DB instance to the replica, reducing contention and improving read latency for the primary instance.

Answer

Upgrade to a larger instance size.

Answer

Enable Multi-AZ deployment.

Answer

Enable storage auto-scaling.

Question 11

A company is using Amazon CloudWatch Logs to collect logs from multiple AWS services. The SysOps administrator needs to query logs across multiple log groups in real-time. Which THREE of the following are capabilities of CloudWatch Logs Insights?

Accepted Answer

Run queries in real-time against incoming log data.. CloudWatch Logs Insights supports real-time queries against incoming log data, allowing you to analyze logs as they are ingested. This is enabled by its ability to query live streams without requiring data to be indexed first, making it suitable for real-time troubleshooting and monitoring.

Answer

Export query results directly to an S3 bucket.

Answer

Schedule queries to run at a specific time.

Question 12

Which TWO actions can be used to protect data in transit between an EC2 instance and an S3 bucket? (Choose two.)

Accepted Answer

Use HTTPS instead of HTTP when accessing S3 from the EC2 instance.. Option C is correct because using HTTPS (TLS) when accessing S3 from the EC2 instance encrypts the data in transit between the instance and S3, protecting it from interception or tampering on the network. Option E is correct because an S3 VPC endpoint (gateway endpoint for S3) keeps traffic between the VPC and S3 on the AWS private network, so it does not traverse the public internet, reducing exposure to interception. Option A is incorrect because security groups control which traffic is allowed to and from the instance but do not encrypt or otherwise protect the data in transit. Option B is incorrect because the x-amz-server-side-encryption header relates to server-side encryption of data at rest, not protection of data in transit. Option D is incorrect because S3 default encryption (SSE-S3) encrypts objects at rest in the bucket, not data moving between the EC2 instance and S3.

Answer

Configure security group rules on the EC2 instance to allow only S3 traffic.

Answer

Apply an S3 bucket policy that denies access unless the request includes the x-amz-server-side-encryption header.

Answer

Enable S3 default encryption (SSE-S3) on the bucket.

Question 13

A SysOps administrator is troubleshooting an issue where an EC2 instance has failed a status check. The instance is still running but is unresponsive. Which THREE actions should the administrator take to diagnose and resolve the issue? (Choose THREE.)

Accepted Answer

Check the system status checks in the EC2 console.. System status checks (Option B) monitor the underlying physical host for issues like network or power loss, while instance status checks (like system log in Option C) detect OS-level problems. Reviewing the system log helps identify kernel panics or boot failures. Stopping and starting the instance (Option E) forces a migration to a new physical host, which can resolve host-level impairments without losing the instance's configuration or data.

Answer

Reboot the instance.

Answer

Restore the instance from the latest AMI.

Question 14

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for EC2 instances to download updates. Which THREE components are required to achieve this? (Choose three.)

Accepted Answer

Route table in the private subnets with a default route pointing to the NAT Gateway. A route table associated with private subnets must have a default route (0.0.0.0/0) pointing to a NAT Gateway to direct outbound internet traffic from EC2 instances through the NAT device. This allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet.

Answer

Egress-only Internet Gateway

Answer

AWS Site-to-Site VPN connection

Question 15

A SysOps administrator is designing a VPC for a web application that must be secure. Which THREE security measures should the administrator implement? (Choose THREE.)

Accepted Answer

Configure network ACLs to filter traffic at the subnet level.. Network ACLs (NACLs) are stateless firewalls that operate at the subnet level, providing an additional layer of security by filtering traffic entering and exiting each subnet. By default, NACLs allow all traffic, but you can configure custom rules to explicitly allow or deny traffic based on IP addresses, protocols, and port ranges, which is essential for securing a web application VPC.

Answer

Place all resources in public subnets to simplify access.

Answer

Use the default VPC for simplicity.

Question 16

A SysOps administrator is automating the creation of an Amazon ECS cluster with Fargate launch type using AWS CloudFormation. The template must define the task definition, service, and cluster. Which THREE resources are required to be in the template? (Choose THREE.)

Accepted Answer

AWS::ECS::TaskDefinition. For an Amazon ECS cluster using the Fargate launch type, the AWS CloudFormation template must define the cluster itself (AWS::ECS::Cluster), the task definition (AWS::ECS::TaskDefinition) that specifies the container image, CPU, memory, and networking configuration, and the service (AWS::ECS::Service) that maintains the desired count of tasks and optionally integrates with a load balancer. These three resources are the minimum required to create and run a Fargate-based ECS workload.

Answer

AWS::EC2::VPC

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Question 17

A SysOps administrator is setting up monitoring for an RDS MySQL database. The administrator needs to be notified when the database connection count exceeds 100. Which steps should be taken to achieve this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch alarm to send a notification to an SNS topic.. Amazon CloudWatch alarms can send notifications to an Amazon SNS topic when the alarm state changes. This allows the SysOps administrator to receive alerts (e.g., via email, SMS, or HTTP) when the database connection count exceeds the threshold. Option B is correct because the 'DatabaseConnections' metric is a standard CloudWatch metric for RDS MySQL that tracks the number of current connections to the database instance. Creating an alarm on this metric with a threshold of 100 will trigger when the connection count exceeds that value.

Answer

Enable Enhanced Monitoring for RDS.

Answer

Enable CloudTrail to log RDS API calls.

Answer

Create an Amazon EventBridge rule that triggers on RDS events.

Question 18

A company wants to back up its on-premises file servers to AWS for disaster recovery. The data changes frequently, and the company needs to minimize data loss. Which THREE steps should the company take? (Select THREE.)

Accepted Answer

Use AWS Backup to create backup plans for the Storage Gateway.. AWS Backup can create backup plans for Storage Gateway volumes and file shares, providing automated, policy-based backups to Amazon S3. This ensures consistent, scheduled backups of the on-premises data cached in the file gateway, minimizing data loss by capturing frequent changes according to the backup plan's schedule.

Answer

Use S3 Transfer Acceleration for uploads.

Answer

Set up S3 Cross-Region Replication from the backup bucket.

Question 19

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a database. Which TWO components are required to allow an EC2 instance in the public subnet to connect to the database?

Accepted Answer

A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR.. A security group rule on the database allowing inbound traffic from the EC2 instance's security group (Option E) is required because security groups act as a virtual firewall at the instance level, and by default they deny all inbound traffic. A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR (Option B) is also required because network ACLs are stateless and control traffic at the subnet boundary; without an inbound allow rule, traffic from the public subnet would be dropped by the private subnet's ACL.

Answer

A NAT Gateway in the public subnet.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Endpoint for the database service.

Question 20

Which THREE configurations are required to enable an EC2 instance in a private subnet to access the internet for software updates while preventing inbound internet traffic?

Accepted Answer

Attach an Internet Gateway to the VPC.. An Internet Gateway (IGW) is required for any VPC to enable internet connectivity. Without an IGW, traffic cannot leave or enter the VPC from the internet. For a private subnet EC2 instance to reach the internet for software updates, the VPC must have an IGW attached, and the NAT Gateway (placed in a public subnet) uses the IGW to forward outbound traffic while blocking inbound connections.

Answer

Assign an Elastic IP address to the EC2 instance.

Answer

Deploy a bastion host in the private subnet.