SOA-C02 Reliability and Business Continuity Practice Test 13 — 15 Questions

Question 1

An application running on EC2 instances in an Auto Scaling group uses an SQS queue for decoupling. The application experiences increased latency when the queue has a high number of messages. The SysOps Administrator needs to maintain responsiveness. Which solution is the most cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a CloudWatch alarm on the queue depth to trigger Auto Scaling policies.. Using a CloudWatch alarm on the SQS queue depth (ApproximateNumberOfMessagesVisible) to trigger Auto Scaling policies allows the Auto Scaling group to dynamically add EC2 instances only when the queue grows, directly addressing increased latency by scaling out compute capacity. This is the most cost-effective approach as it scales resources based on actual demand, avoiding over-provisioning.

Answer

Increase the desired capacity of the Auto Scaling group.

Answer

Use a larger instance type for the EC2 instances.

Answer

Increase the visibility timeout of the SQS queue.

Question 2

A company runs a stateful web application on a single EC2 instance. The SysOps Administrator wants to improve fault tolerance. Which design should they implement?

Accepted Answer

Place instances in an Auto Scaling group across two Availability Zones, use an Application Load Balancer, and store session state in ElastiCache.. It distributes the web application across multiple Availability Zones for high availability, uses an Application Load Balancer to route traffic to healthy instances, and stores session state externally in ElastiCache. This decouples the stateful session data from the EC2 instances, allowing any instance to handle any request without losing session context, which is essential for fault tolerance in a stateful application.

Answer

Create a Multi-AZ RDS instance and attach it to the existing EC2 instance.

Answer

Add a second EC2 instance in the same Availability Zone and use a Network Load Balancer.

Answer

Use an Auto Scaling group with a launch configuration that stores session data on instance store.

Question 3

A company wants to ensure that its S3 bucket is accessible only from a VPC. Which configuration should the SysOps Administrator implement?

Accepted Answer

Create an S3 VPC endpoint and attach a bucket policy that restricts access to that endpoint.. An S3 VPC endpoint (either gateway or interface type) allows private connectivity between a VPC and S3 without traversing the public internet. By attaching a bucket policy that includes a condition like `aws:SourceVpce` or `aws:SourceVpc`, access is explicitly restricted to traffic originating from that specific VPC endpoint, ensuring the bucket is not accessible from any other network.

Answer

Configure a bucket policy that allows access from the public internet.

Answer

Make the bucket public and rely on IAM roles.

Answer

Attach a security group to the S3 bucket.

Question 4

A company is using AWS CloudFormation to manage its infrastructure. The SysOps Administrator needs to ensure that updates to a critical stack do not accidentally replace the database. Which feature should be used?

Accepted Answer

Define a stack policy that denies updates to the database resource.. A stack policy in AWS CloudFormation explicitly denies updates to specified resources, such as the database, preventing accidental replacement or deletion during stack updates. Unlike termination protection, which only prevents stack deletion, a stack policy controls update actions on individual resources within the stack.

Answer

Use drift detection to identify changes.

Answer

Enable termination protection on the stack.

Answer

Use a change set to review the updates before executing them.

Question 5

A company runs a web application on EC2 instances in a private subnet. The application needs to connect to an RDS database in a different VPC. The VPCs are peered. The SysOps Administrator is troubleshooting connectivity issues. The RDS security group allows inbound traffic from the EC2 security group, but connections still fail. What could be the issue?

Accepted Answer

The route tables in each VPC do not have routes to the peered VPC CIDR.. For traffic to flow between peered VPCs, each VPC's route table must have a route pointing to the CIDR block of the other VPC. Without these routes, packets from the EC2 instance in VPC A destined for the RDS database in VPC B will be dropped, even if security groups and network ACLs are permissive. The SysOps Administrator must add a route in the private subnet's route table for the RDS VPC's CIDR, and a corresponding route in the RDS VPC's route table for the EC2 VPC's CIDR, both pointing to the VPC peering connection.

Answer

The RDS instance does not have public DNS resolution enabled.

Answer

The network ACL for the private subnet is blocking inbound traffic.

Answer

The security group outbound rules on the EC2 instance are blocking traffic.

Question 6

A company is designing a disaster recovery strategy for its primary AWS region. The application runs on EC2 instances with an RDS database. The RPO is 15 minutes and RTO is 2 hours. Which TWO actions should the SysOps Administrator take to meet these requirements? (Choose TWO.)

Accepted Answer

Configure RDS cross-region replication to a second region.. RDS cross-region replication can achieve an RPO of seconds to minutes, easily meeting the 15-minute RPO requirement. Option E is correct because storing CloudFormation templates in S3 with cross-region replication allows quick provisioning of resources in the DR region, helping to meet the 2-hour RTO. Option A is incorrect because AMIs are region-specific and must be copied to the DR region, which cannot achieve the 15-minute RPO. Option C is incorrect because taking manual snapshots every 15 minutes and copying them cannot guarantee the RPO due to transfer delays. Option D is incorrect because daily backups do not meet the 15-minute RPO.

Answer

Create AMIs of the EC2 instances and share them with the DR region.

Answer

Take manual RDS snapshots every 15 minutes and copy them to the DR region.

Answer

Use AWS Backup to copy backups to a second region daily.

Question 7

A company runs a stateless web application on EC2 instances behind an Application Load Balancer. The SysOps Administrator needs to ensure the application can withstand the loss of an entire Availability Zone. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones.. Configuring the Auto Scaling group to launch instances in at least two Availability Zones (AZs) ensures that if one entire AZ fails, the remaining AZ(s) still have running instances to serve traffic. This is a fundamental pattern for high availability and fault tolerance in AWS, as it distributes the application across physically separate data centers within a region.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Use an Elastic IP address for each EC2 instance.

Question 8

A company wants to ensure its SysOps Administrator can recover an EBS volume from a snapshot. Which TWO steps are required? (Choose TWO.)

Accepted Answer

Specify the Availability Zone when creating the volume.. When creating an EBS volume from a snapshot, you must specify the same Availability Zone as the target EC2 instance to ensure the volume is accessible for attachment. Option D is correct because you must first create a snapshot of the existing volume to have a point-in-time backup from which the new volume can be restored.

Answer

Configure a KMS key for the snapshot.

Answer

Attach the volume to an EC2 instance.

Answer

Enable encryption on the snapshot.

Question 9

Refer to the exhibit. An IAM policy is attached to a group. A SysOps Administrator in that group tries to terminate an EC2 instance with the tag 'Environment=production'. The action fails. What is the most likely reason?

Accepted Answer

The instance does not have the tag 'Environment=production'.. The IAM policy explicitly uses a condition key `ec2:ResourceTag/Environment` with `StringEquals` to restrict the `ec2:TerminateInstances` action to only instances tagged with `Environment=production`. If the instance does not have that exact tag, the condition fails, and the action is denied. The SysOps Administrator is in the group that has this policy attached, so the failure is most likely due to the instance lacking the required tag.

Answer

The condition key 'ec2:ResourceTag/Environment' is invalid.

Answer

The policy does not allow the ec2:TerminateInstances action.

Answer

The condition uses 'StringEquals' instead of 'StringLike'.

Question 10

A company runs a critical microservices application on Amazon ECS with Fargate launch type. The application consists of several services that communicate via internal HTTP calls. The SysOps Administrator notices that during periods of increased load, some services become unresponsive and the health checks fail. The ECS service auto scaling is configured based on CPU utilization, but it does not scale quickly enough. The administrator needs to improve the reliability and responsiveness of the application. The services are stateless and can be scaled horizontally. The current architecture uses a single Application Load Balancer for each service. The ALB health checks are set to a 30-second interval with a 5-second timeout and 2 unhealthy thresholds. The administrator has observed that when a service instance becomes unhealthy, it takes too long for the ALB to stop sending traffic to it, causing errors. What should the SysOps Administrator do to improve the reliability and responsiveness of the application?

Accepted Answer

Configure the ALB health check to have a 5-second interval, 2-second timeout, and 2 unhealthy threshold.. Reducing the health check interval to 5 seconds and timeout to 2 seconds with an unhealthy threshold of 2 allows the ALB to detect service failures much faster. With the original settings (30s interval, 5s timeout, 2 threshold), detection could take up to 65 seconds. With the new settings, detection time is reduced to about 12 seconds, so traffic is stopped sooner and errors are minimized. Option A is wrong because increasing the interval and threshold would make detection even slower. Option C is wrong because increasing the CPU target delays scaling, which does not address health check responsiveness. Option D is wrong because a Network Load Balancer uses TCP health checks which are less application-aware and may not detect HTTP-level failures, and it does not inherently speed up health check detection.

Answer

Increase the ALB health check interval to 60 seconds and unhealthy threshold to 5.

Answer

Increase the ECS service auto scaling target CPU utilization to 90%.

Answer

Replace the ALB with a Network Load Balancer and use TCP health checks.

Question 11

A company runs a file-sharing application on AWS. Users upload files to an S3 bucket, which triggers a Lambda function to process the files and store metadata in a DynamoDB table. Recently, users have reported that some uploaded files are never processed. The SysOps Administrator checks the CloudWatch logs and finds no errors from the Lambda function. The S3 bucket is configured to send events to the Lambda function. The DynamoDB table has sufficient write capacity. The administrator suspects that the event notifications are being lost. Which action should the SysOps Administrator take to ensure that every file upload triggers a Lambda function and that the function processes the file successfully?

Accepted Answer

Configure an SQS queue as the event destination for the S3 bucket, and have the Lambda function process messages from the queue.. Using an SQS queue as the event destination for S3 bucket events provides a durable, reliable mechanism to capture every event. S3 sends event notifications to the SQS queue, and if the Lambda function fails or is throttled, the message remains in the queue for later processing. This decouples the event source from the function and ensures no events are lost. Option B is incorrect because DynamoDB Streams capture changes to DynamoDB items, not S3 events. Option C is wrong because increasing reserved concurrency only helps with Lambda scaling but does not address potential event loss due to failures or delivery issues. Option D is wrong because DynamoDB write capacity is already sufficient; the issue is with S3 event delivery, not database writes.

Answer

Use DynamoDB Streams to capture file metadata changes instead of Lambda invocation.

Answer

Increase the Lambda function's reserved concurrency to handle more invocations.

Answer

Increase the write capacity of the DynamoDB table to avoid throttling.

Question 12

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB) in a single Availability Zone. The application stores session data in an RDS MySQL DB instance. To improve reliability, the company wants to deploy the application across multiple Availability Zones. Which combination of actions should the company take to achieve this? (Choose the correct course of action.)

Accepted Answer

Deploy EC2 instances in two Availability Zones and place them behind an Application Load Balancer. Enable Multi-AZ for the RDS MySQL DB instance.. Deploying EC2 instances across two Availability Zones behind an Application Load Balancer (ALB) provides high availability for the web tier, while enabling Multi-AZ for RDS MySQL ensures synchronous replication to a standby instance in a different AZ, providing automatic failover and data durability. This combination addresses the requirement to improve reliability by eliminating single points of failure at both the compute and database layers.

Answer

Deploy EC2 instances in a single Availability Zone behind an Application Load Balancer. Enable Multi-AZ for the RDS MySQL DB instance.

Answer

Deploy EC2 instances in two Availability Zones and place them behind a Network Load Balancer. Keep RDS MySQL as a single-AZ deployment.

Answer

Deploy EC2 instances in two Availability Zones. Configure an RDS MySQL Read Replica in a second Availability Zone and route read traffic to it.

Question 13

A SysOps administrator is tasked with ensuring that an Amazon S3 bucket can withstand the loss of an entire AWS Region. The bucket stores critical data that must be accessible with minimal latency from multiple regions. Which solution meets these requirements?

Accepted Answer

Configure S3 Cross-Region Replication to a bucket in another AWS Region. Use Amazon CloudFront with multiple origins pointing to both buckets.. S3 Cross-Region Replication (CRR) automatically replicates objects to a bucket in another AWS Region, ensuring data survives a regional failure. Using Amazon CloudFront with multiple origins pointing to both buckets provides low-latency access from any region by routing requests to the nearest healthy origin, meeting both durability and performance requirements.

Answer

Enable S3 Versioning and configure a lifecycle policy to transition objects to S3 Glacier Deep Archive.

Answer

Enable S3 Versioning and MFA Delete on the bucket. Use S3 Object Lock to prevent object deletion.

Answer

Enable S3 Transfer Acceleration on the bucket and use a CloudFront distribution with the bucket as the origin.

Question 14

A company runs a stateful web application on EC2 instances in an Auto Scaling group across two Availability Zones. The application uses an Application Load Balancer for traffic distribution. Users report that their sessions are frequently lost during scale-in events. The SysOps administrator needs to minimize session loss without introducing significant latency. What should the administrator do?

Accepted Answer

Enable sticky sessions (session affinity) on the ALB. Configure a lifecycle hook on the Auto Scaling group with a wait time equal to the ALB's connection draining timeout.. Enabling sticky sessions (session affinity) on the ALB ensures that a client's requests are consistently routed to the same EC2 instance, preventing session loss during scale-in. Configuring a lifecycle hook on the Auto Scaling group with a wait time equal to the ALB's connection draining timeout (deregistration delay) allows in-flight requests to complete before the instance is terminated, minimizing session disruption without adding significant latency.

Answer

Replace the Application Load Balancer with a Network Load Balancer. Enable proxy protocol v2 to pass client IP addresses.

Answer

Increase the Auto Scaling group's cooldown period to 600 seconds. Configure the ALB to have a deregistration delay of 600 seconds.

Answer

Configure the Auto Scaling group to scale based on memory utilization instead of CPU. Set the cooldown period to 300 seconds.

Question 15

A SysOps administrator is designing a disaster recovery plan for a critical application that runs on EC2 instances in a single region. The RTO is 1 hour, and the RPO is 15 minutes. The application data is stored on an Amazon EBS volume. Which approach meets these requirements at the lowest cost?

Accepted Answer

Take automated EBS snapshots every 15 minutes and copy them to the DR region. Use a pre-configured Amazon Machine Image (AMI) to launch EC2 instances from the latest snapshot.. Automated EBS snapshots taken every 15 minutes meet the RPO of 15 minutes, and copying them to the DR region allows launching EC2 instances from the latest snapshot using a pre-configured AMI, which can achieve an RTO of 1 hour. This approach is the lowest cost as it only incurs snapshot storage and cross-region data transfer costs, without requiring continuous replication infrastructure or additional compute resources.

Answer

Deploy the application across multiple Availability Zones using an Auto Scaling group and an Application Load Balancer.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to an EC2 instance in the DR region.

Answer

Use S3 Cross-Region Replication to replicate the EBS volume data to an S3 bucket in the DR region.