SOA-C02 Multiple Select — 30 Questions

Question 1

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Misconfigured firewall or iptables. An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Answer

Network connectivity issues

Answer

Detached EBS root volume

Answer

Insufficient memory for applications

Question 2

A SysOps administrator is designing a monitoring solution for a critical application running on EC2 instances. The application requires that all API calls to the environment are logged for security analysis. Which TWO services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS CLI, SDKs, and other services. CloudTrail logs provide the identity of the caller, the time of the call, the source IP address, and the request parameters, which are essential for security analysis. Option B (Amazon CloudWatch Logs) is also correct because CloudTrail logs can be delivered to CloudWatch Logs for centralized monitoring, alerting, and retention, enabling real-time analysis and integration with other AWS services.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 3

A company uses CloudWatch Logs to collect application logs from EC2 instances. The logs are critical for troubleshooting. The operations team notices that some log entries are missing during peak hours. The CloudWatch Logs agent is configured with a batch size of 1 MB and a batch timeout of 10 seconds. Which TWO actions should the administrator take to reduce the chance of missing log events?

Accepted Answer

Increase the batch size to 5 MB.. Increasing the batch size from 1 MB to 5 MB allows the CloudWatch Logs agent to buffer more log data before sending a request. During peak hours, log volume spikes can cause the agent to drop events if the batch fills up faster than it can be transmitted. A larger batch size reduces the frequency of API calls and helps ensure that all log entries are successfully delivered.

Answer

Use PutLogEvents directly from the application.

Answer

Reduce the retry count for failed requests.

Answer

Increase the batch timeout to 30 seconds.

Question 4

A SysOps administrator is creating an AWS CloudFormation template to deploy a web application. The template will create an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The administrator wants to ensure that the Auto Scaling group is created only after the ALB and the RDS database are fully created and available. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources.. To ensure the Auto Scaling group is created only after both the ALB and RDS database are fully available, the administrator should add a DependsOn attribute to the Auto Scaling group that lists both the ALB and RDS resources (Option B). This ensures CloudFormation creates the group after those resources. Additionally, a CreationPolicy on the RDS database resource (Option D) can be used to wait for a signal (e.g., from a cfn-signal script) indicating that the database is fully operational and accepting connections, ensuring it is 'fully available' before the Auto Scaling group creation proceeds. Option A is incorrect because it only lists the ALB, ignoring RDS. Option C is irrelevant for creation order. Option E addresses instance signaling, not resource creation.

Answer

Add a DependsOn attribute to the Auto Scaling group resource that lists only the ALB resource.

Answer

Add an UpdatePolicy to the Auto Scaling group resource to wait for a signal.

Answer

Add a CreationPolicy to the Auto Scaling group resource to wait for a signal from the instances.

Question 5

A SysOps administrator needs to reduce data transfer costs for a web application hosted on EC2 instances in a VPC. The application serves content to users over the internet. Which TWO actions will help reduce data transfer costs? (Choose TWO.)

Accepted Answer

Use a VPC Gateway Endpoint for Amazon S3 to keep S3 traffic within AWS.. The correct answers are B and C. Using a VPC Gateway Endpoint for Amazon S3 allows instances to access S3 over the AWS network without traversing the internet, reducing data transfer costs. Amazon CloudFront caches content at edge locations worldwide, so users receive content from edge locations instead of the EC2 origin, reducing data transfer from EC2 to the internet. Option A is incorrect because migrating to private subnets and using AWS Direct Connect does not serve users over the internet; Direct Connect is a dedicated network connection that does not reduce data transfer costs for internet users. Option D is incorrect because an Application Load Balancer distributes traffic but does not inherently reduce data transfer costs; it may even add cost. Option E is incorrect because a larger NAT Gateway increases cost and does not reduce data transfer costs for outbound traffic.

Answer

Move all instances to private subnets and use AWS Direct Connect for user access.

Answer

Use an Application Load Balancer to distribute traffic.

Answer

Use a larger NAT Gateway to improve throughput.

Question 6

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 7

A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?

Accepted Answer

Private subnet route table with a route to the NAT Gateway. The correct answers are D and E. A NAT Gateway placed in a public subnet (E) provides outbound internet access for instances in private subnets. The private subnet's route table must have a route pointing to the NAT Gateway (D) for internet-bound traffic. VPC Peering (A) connects VPCs but does not provide internet access. An Internet Gateway (C) attached to the VPC enables internet access for public subnets, but private subnets should not have a direct route to it. Option B (private route to IGW) would make the subnet public, violating the requirement. Therefore, D and E together provide the desired outbound-only internet access.

Answer

VPC Peering connection

Answer

Private subnet route table with a route to the Internet Gateway

Answer

Internet Gateway attached to the VPC

Question 8

A company wants to implement a disaster recovery solution for its on-premises database using AWS. The solution must have an RPO of less than 1 hour and an RTO of less than 4 hours. Which THREE steps should the SysOps administrator take? (Choose THREE.)

Accepted Answer

Set up a cross-Region read replica for the RDS instance.. A cross-Region read replica for an RDS instance provides asynchronous replication to a secondary Region. After promoting the replica, the RTO can be under 4 hours, and the RPO is typically less than 1 hour. Option B is correct by launching an EC2 instance with the same database software and configuring continuous replication (e.g., log shipping or mirroring) from the on-premises database. This allows failover to the EC2 instance within the RPO and RTO targets. Option C is correct as AWS DMS can perform ongoing replication from the on-premises database to an RDS instance, meeting the RPO requirement with minimal data loss. Together, these steps form a multi-layered DR strategy: DMS for continuous replication, EC2 as a standby, and a cross-Region replica for regional resilience.

Answer

Use AWS DataSync to sync the database files to Amazon S3.

Answer

Configure the RDS instance with Multi-AZ.

Question 9

A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?

Accepted Answer

Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.. Options A, B, and D are correct. A bucket policy with a condition for vpc:SourceVpce, a VPC endpoint for S3, and route table updates are required. Option C is wrong because IAM users alone do not restrict access by VPC; a bucket policy with a VPC condition is needed. Option E is wrong because security groups cannot be attached to S3 buckets as they are not network interfaces.

Answer

Create IAM users and assign them permissions to access the bucket.

Answer

Attach a security group to the S3 bucket.

Question 10

A company is using AWS KMS to encrypt data. The security team wants to ensure that a specific IAM role can use a KMS key, but only when the request comes from a specific VPC. Which THREE conditions should be included in the KMS key policy? (Choose three.)

Accepted Answer

aws:SourceVpc equals the VPC ID.. The aws:SourceArn condition key is used to restrict access based on the ARN of the resource that is the source of the request, such as an S3 bucket or Lambda function; it is not appropriate for restricting access to a specific IAM role ARN. Therefore, option B is incorrect. Option C is correct: aws:SourceVpc restricts use to requests originating from a specific VPC. Option E is correct: aws:SourceVpce restricts use to requests coming through a specific VPC endpoint. Option A is incorrect because aws:SourceSubnet is not a valid condition key. Option D is incorrect because aws:SourceIp restricts based on IP address, which does not reliably correspond to a VPC (for example, traffic through a NAT gateway would appear from the NAT’s IP).

Answer

aws:SourceSubnet equals the subnet ID.

Answer

aws:SourceArn equals the IAM role ARN.

Answer

aws:SourceIp equals the VPC CIDR.

Question 11

A SysOps administrator is implementing an automated backup solution for Amazon RDS databases. The solution must support point-in-time recovery and cross-region disaster recovery. Which TWO AWS services or features should be used?

Accepted Answer

Automated backups with a retention period.. Automated backups (Option C) enable point-in-time recovery within a specified retention period, meeting the backup requirement. Automated cross-region snapshot copy (Option E) provides cross-region disaster recovery by automatically copying snapshots to another AWS region. Manual DB snapshots (Option A) are not automated, so they do not satisfy the automation requirement. Cross-region read replicas (Option B) are designed for read scaling and do not serve as a backup solution. Amazon S3 lifecycle policies (Option D) are used for managing object storage, not for RDS backup automation.

Answer

Manual DB snapshots.

Answer

Cross-region read replicas.

Answer

Amazon S3 lifecycle policies.

Question 12

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Accepted Answer

Use AWS WAF with rate-based rules. AWS Shield Advanced provides DDoS protection. Using a web application firewall (WAF) at the edge helps filter malicious traffic. Security groups and NACLs are not effective against DDoS at scale.

Answer

Apply network ACLs with deny rules

Answer

Use restrictive security groups

Answer

Enable VPC Flow Logs

Question 13

A company wants to ensure that their Amazon S3 bucket policy only allows access from a specific VPC endpoint. Which TWO condition keys can be used in the bucket policy? (Choose TWO.)

Accepted Answer

aws:SourceVpc. The correct condition keys are 'aws:SourceVpc' (option C) and 'aws:SourceVpce' (option E). 'aws:SourceVpc' restricts access to all VPC endpoints within a specified VPC, while 'aws:SourceVpce' restricts access to a specific VPC endpoint. Option A 's3:SourceVpce' is not a valid condition key. Option B 'aws:SourceIp' is used for IP address restrictions, not VPC endpoints. Option D 'ec2:Vpc' is not applicable in S3 bucket policies.

Answer

s3:SourceVpce

Answer

aws:SourceIp

Answer

ec2:Vpc

Question 14

A company wants to monitor AWS API calls for suspicious activity. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Logs. Options B and E are correct. AWS CloudTrail logs all API calls made to the AWS environment, providing an audit trail. Amazon CloudWatch Logs can ingest CloudTrail logs and use metric filters to detect patterns indicative of suspicious activity. Option A (VPC Flow Logs) captures IP traffic information, not API calls. Option C (Amazon Inspector) is a vulnerability assessment service. Option D (AWS Config) records resource configuration changes, not API calls.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS Config

Question 15

A SysOps administrator needs to ensure high availability for a web application running on EC2 instances across multiple Availability Zones. Which TWO actions should the administrator take?

Accepted Answer

Launch EC2 instances in at least two different Availability Zones.. Options A and D are correct. Launching EC2 instances across multiple Availability Zones (A) provides fault isolation, and registering them with an Application Load Balancer that has health checks enabled (D) ensures traffic is routed only to healthy instances. Option B is incorrect because CloudFront is a CDN, not a load balancer; it improves performance but does not directly provide high availability by health checking instances. Option C is incorrect because all instances in a single Availability Zone creates a single point of failure. Option E is incorrect because EBS volumes are tied to a specific Availability Zone and real-time replication does not address instance-level failures across zones.

Answer

Place a CloudFront distribution in front of the instances.

Answer

Launch all EC2 instances in a single Availability Zone for consistency.

Answer

Attach an EBS volume to each instance and replicate data in real-time.

Question 16

A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all IAM API calls, providing a detailed audit trail of changes. Option C is correct because AWS Config tracks changes to IAM resource configurations and can evaluate them against rules. Option E is correct because Amazon CloudWatch Logs can store and monitor CloudTrail logs, enabling alerting on specific IAM changes. Option B is wrong because Amazon GuardDuty is for threat detection, not auditing configuration changes. Option D is wrong because AWS Trusted Advisor provides best-practice checks but does not log or track changes to IAM resources.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 17

A company's security team requires that all API calls to AWS services are encrypted in transit using TLS 1.2 or higher. Which TWO actions should be taken to enforce this?

Accepted Answer

Use AWS CloudTrail to monitor for API calls using TLS 1.0 and generate alerts.. Options C and E are correct. Using AWS CloudTrail to monitor for API calls using TLS 1.0 allows the security team to detect non-compliant requests and generate alerts. Creating an SCP that denies AWS API calls using protocols lower than TLS 1.2 enforces encryption in transit at the organizational level. Option A is incorrect because CloudTrail logging alone does not enforce encryption; it only records events. Option B is incorrect because EC2 security groups control network traffic to instances, not API calls to AWS services. Option D is incorrect because IAM policies can require HTTPS via the aws:SecureTransport condition, but cannot enforce a specific TLS version like 1.2.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Configure EC2 security groups to only allow HTTPS traffic.

Answer

Create an IAM policy that denies access unless the request uses TLS 1.2.

Question 18

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Linux 2 AMI with specific security agents installed. The company wants to ensure that all environment instances use this custom AMI. Which combination of steps should be taken? (Choose two.)

Accepted Answer

Create a custom AMI using the Elastic Beanstalk platform as the base.. To ensure all environment instances use a custom AMI with specific security agents, you must create the custom AMI from the Elastic Beanstalk platform (C) to maintain compatibility. Then configure the .ebextensions folder to set the AMI ID in the Auto Scaling launch configuration using the aws:autoscaling:launchconfiguration namespace (D). Option A is incorrect because the AMI ID is set in the environment configuration, not a CloudFormation template. Option B is incorrect because CodeDeploy deploys application code, not the AMI itself. Option E is incorrect because while Packer can be used to create AMIs, it is not required; the custom AMI must be based on the Elastic Beanstalk platform, not any base image.

Answer

Set the AMI ID in a CloudFormation template and associate it with the environment.

Answer

Use AWS CodeDeploy to deploy the application to the custom AMI.

Answer

Use Packer to create the custom AMI from any base image.

Question 19

Which TWO actions can be taken to improve the availability of a web application hosted on EC2 instances behind an Application Load Balancer? (Select two.)

Accepted Answer

Configure an Auto Scaling group with health checks to replace unhealthy instances.. An Auto Scaling group with health checks can automatically replace unhealthy EC2 instances, improving availability. Option C is correct because deploying instances across multiple Availability Zones provides fault tolerance; if one AZ fails, your application continues to run in another. Option B is incorrect because using larger instance types improves performance, not availability. Option D is incorrect because using a single region makes the application vulnerable to region-wide failures, reducing availability. Option E is incorrect because placing all instances in a single subnet creates a single point of failure; distributing across AZs is necessary for high availability.

Answer

Use larger EC2 instance types.

Answer

Use a single AWS Region for all instances.

Answer

Place all EC2 instances in a single subnet.

Question 20

A SysOps Administrator needs to automate the deployment of a three-tier web application on AWS. The application consists of a web tier, application tier, and database tier. The administrator wants to use AWS CloudFormation to provision the infrastructure. Which TWO resources should be included in the CloudFormation template to ensure the application is highly available across multiple Availability Zones?

Accepted Answer

Auto Scaling group. Options A and E are correct. An Auto Scaling group maintains a desired number of instances across multiple Availability Zones, ensuring resilience and high availability. An Application Load Balancer (ALB) distributes incoming traffic across those instances, further supporting high availability and fault tolerance. Option B (NAT Gateway) is used for outbound internet access from private subnets, not for high availability of the application. Option C (S3 bucket) is a storage service and does not directly impact compute high availability. Option D (Route 53 hosted zone) provides DNS routing but is not a primary resource for ensuring high availability within the application tiers; Route 53 can be used for DNS-level failover, but the question asks for resources directly in the CloudFormation template to ensure high availability across AZs, and the ALB and Auto Scaling group are the core components.

Answer

NAT Gateway

Answer

Amazon S3 bucket

Answer

Amazon Route 53 hosted zone