SOA-C02 Reliability and Business Continuity Practice Test 5 — 15 Questions

Question 1

A company has a production AWS account with multiple VPCs connected via a transit gateway. The security team requires that all cross-VPC traffic be inspected by a centralized network firewall appliance. The firewall is deployed in a dedicated inspection VPC. The SysOps administrator must ensure that traffic from VPC A to VPC B is routed through the inspection VPC. Which configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the transit gateway route tables to propagate a blackhole route for VPC A and VPC B CIDRs to the inspection VPC attachment, then have the firewall forward traffic.. Transit gateway route tables can be configured to force all inter-VPC traffic through a centralized inspection VPC. By propagating a blackhole route for the CIDRs of VPC A and VPC B to the inspection VPC attachment, the transit gateway drops traffic that is not explicitly routed through the inspection VPC. The firewall in the inspection VPC then forwards the inspected traffic back to the transit gateway, which uses separate route tables to direct the traffic to the destination VPC. This ensures that all cross-VPC traffic is inspected without requiring VPC peering or NAT gateways.

Answer

Create a VPC peering connection between VPC A and VPC B, and use route tables to send traffic through the inspection VPC.

Answer

Use security groups in the inspection VPC to filter traffic between VPC A and VPC B.

Answer

Attach a NAT gateway in the inspection VPC and configure route tables in VPC A and B to point to the NAT gateway.

Question 2

A SysOps administrator is troubleshooting an issue where an Auto Scaling group is not launching EC2 instances despite having a scaling policy that should trigger when CPU utilization exceeds 80%. The CloudWatch alarm shows that the metric is breaching the threshold, but no instances are launched. What is the most likely cause?

Accepted Answer

The Auto Scaling group has reached its maximum size.. When an Auto Scaling group reaches its maximum size, it cannot launch new instances even if a scaling policy is triggered. The CloudWatch alarm breaching the threshold indicates the scaling condition is met, but the group's capacity limit prevents any new instance launches. This is a common misconfiguration where the max size is set too low relative to the desired or current capacity.

Answer

The scaling policy is incorrectly configured to use a simple scaling policy instead of a step scaling policy.

Answer

The health check grace period is too long.

Answer

The CloudWatch alarm is in insufficient data state.

Question 3

A company is using Amazon S3 to store critical data with versioning enabled. The SysOps administrator needs to implement a solution that automatically transitions objects to S3 Glacier Deep Archive after 90 days and permanently deletes them after 7 years. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies are the correct choice because they allow you to define rules that automatically transition objects to S3 Glacier Deep Archive after a specified number of days (90) and then permanently expire (delete) them after a longer period (7 years). This directly meets the requirements for automated, time-based storage class transitions and deletion without manual intervention.

Answer

S3 Intelligent-Tiering

Answer

S3 Object Lock

Answer

S3 Cross-Region Replication

Question 4

A company runs a stateful web application on EC2 instances behind a Network Load Balancer. The application requires that client requests from a particular session are always sent to the same target instance. Which feature should the SysOps administrator configure on the NLB to meet this requirement?

Accepted Answer

Configure sticky sessions using flow-based routing (client IP affinity). Network Load Balancers (NLBs) support session stickiness through flow-based routing based on the client's IP address and port (Layer 4). This ensures that requests from the same client session are consistently routed to the same target instance, meeting the requirement without using application-layer cookies.

Answer

Configure path-based routing rules

Answer

Enable health checks on the target group

Answer

Enable cross-zone load balancing

Question 5

A SysOps administrator is tasked with designing a disaster recovery strategy for an Amazon RDS for PostgreSQL database. The database is currently in us-east-1. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 1 minute. Which solution meets these requirements?

Accepted Answer

Enable Multi-AZ deployment with automatic failover.. Multi-AZ deployment for Amazon RDS provides synchronous replication to a standby instance in a different Availability Zone, with automatic failover typically completing within 1-2 minutes. This meets the RTO of 1 minute and, because replication is synchronous, the RPO is effectively zero seconds (no data loss), which satisfies the 5-second RPO requirement.

Answer

Create a cross-region read replica in us-west-2 and promote it during a disaster.

Answer

Take daily automated snapshots and copy them to another region.

Answer

Deploy the database in a single AZ and use point-in-time recovery.

Question 6

A company has an Auto Scaling group that launches EC2 instances in private subnets. The instances need to download software patches from the internet. Which component must be added to the VPC to allow outbound internet traffic while keeping the instances private?

Accepted Answer

A NAT gateway in a public subnet. A NAT gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections. The NAT gateway translates the private IPs to its own Elastic IP and routes traffic through an internet gateway attached to the VPC, keeping instances private.

Answer

An internet gateway attached to the VPC

Answer

A VPC peering connection to a VPC with internet access

Answer

An egress-only internet gateway

Question 7

A team of developers is deploying a new microservice that uses Amazon DynamoDB as its data store. The SysOps administrator must ensure that the application can handle a sudden spike in read traffic without throttling. Which DynamoDB feature can be used to automatically handle increases in read capacity?

Accepted Answer

DynamoDB Auto Scaling. DynamoDB Auto Scaling is the correct feature because it automatically adjusts the provisioned read and write capacity based on actual traffic patterns, preventing throttling during sudden spikes. The SysOps administrator can define a target utilization percentage (e.g., 70%), and DynamoDB Auto Scaling uses the Application Auto Scaling service to increase capacity before requests are throttled, ensuring consistent performance without manual intervention.

Answer

DynamoDB Global Tables

Answer

DynamoDB Time to Live (TTL)

Answer

DynamoDB Accelerator (DAX)

Question 8

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume. The SysOps administrator needs to implement a backup strategy that ensures data can be recovered in the event of an AZ failure. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure automated snapshots using Amazon Data Lifecycle Manager.. Amazon Data Lifecycle Manager (DLM) automates the creation, retention, and deletion of EBS snapshots, providing a scheduled backup mechanism that protects against data loss. Option C is correct because copying snapshots to another region ensures data is recoverable even if an entire AWS Availability Zone (AZ) fails, as the snapshots are stored independently in a different geographic region.

Answer

Increase the EBS volume size to maximize I/O performance.

Answer

Enable EBS encryption using AWS KMS.

Answer

Enable EBS Multi-Attach to allow the volume to be attached to instances in another AZ.

Question 9

A SysOps administrator is designing a highly available architecture for a web application using an Application Load Balancer and an Auto Scaling group across three Availability Zones. The application must be able to withstand the loss of an entire AZ. Which THREE components are necessary to meet this requirement? (Choose THREE.)

Accepted Answer

Launch EC2 instances in at least two Availability Zones.. Launching EC2 instances in at least two Availability Zones (AZs) ensures that if one AZ fails, the Auto Scaling group can still serve traffic from instances in the remaining AZs. This is a fundamental requirement for high availability, as an Auto Scaling group spanning multiple AZs can automatically replace failed instances in other zones. Without multi-AZ deployment, a single AZ failure would cause complete application downtime.

Answer

Use a single NAT gateway to provide internet access.

Answer

Use a cluster placement group for EC2 instances.

Question 10

A company uses Amazon S3 to store backup data. The SysOps administrator needs to ensure that the data is encrypted at rest and that access is limited to only authorized users. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or AWS KMS.. Enabling default encryption on the S3 bucket using SSE-S3 or AWS KMS ensures that all objects stored in the bucket are encrypted at rest automatically, meeting the encryption-at-rest requirement. This can be configured via the bucket properties, and it applies to any object uploaded without explicit encryption headers.

Answer

Block all public access to the S3 bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable S3 Transfer Acceleration.

Question 11

A company is designing a highly available web application using an Application Load Balancer (ALB) with EC2 instances in an Auto Scaling group across two Availability Zones. Which configuration ensures that the application remains available if one Availability Zone fails?

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones. Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ continues to serve traffic. The ALB distributes incoming requests across healthy targets in all enabled AZs, and Auto Scaling replaces failed instances in the remaining AZs automatically, maintaining application availability.

Answer

Use a single large EC2 instance instead of multiple instances

Answer

Disable health checks on the ALB to avoid false positives

Answer

Launch all EC2 instances in a single Availability Zone

Question 12

A SysOps administrator is designing a disaster recovery plan for a critical RDS MySQL database. The database must be available with a Recovery Point Objective (RPO) of less than 1 hour and a Recovery Time Objective (RTO) of less than 2 hours. The primary region is us-east-1. Which solution meets these requirements?

Accepted Answer

Create a cross-Region read replica in us-west-2 and promote it during a disaster. A cross-Region read replica in us-west-2 can be promoted to a standalone primary database in under 2 hours, and the replication lag is typically less than 1 hour, meeting both RPO and RTO requirements. This solution provides continuous asynchronous replication from the primary region, ensuring minimal data loss and fast failover without needing to restore from backups.

Answer

Enable Multi-AZ deployment in the primary region

Answer

Enable automated backups and restore to a new region when needed

Answer

Take daily manual snapshots and copy them to another region

Question 13

A company runs a stateful application on EC2 instances behind a Network Load Balancer (NLB). The application uses sticky sessions (session affinity) to maintain client state. During a deployment, the SysOps administrator needs to replace instances without disrupting active sessions. Which approach should be used?

Accepted Answer

Deregister the old instances from the target group with connection draining enabled, then register new instances. Deregistering instances from the target group with connection draining enabled allows existing connections to complete gracefully before the instances are removed. The Network Load Balancer (NLB) continues to route new connections to the remaining healthy instances, and once draining finishes, new instances can be registered without disrupting active sessions. This approach maintains session affinity (sticky sessions) by ensuring that in-flight requests are completed before the instance is taken out of service.

Answer

Stop the NLB, replace instances, and restart the NLB

Answer

Update the target group health check to remove old instances faster

Answer

Terminate the old instances immediately and launch new ones

Question 14

An organization needs to back up an Amazon EFS file system daily and retain backups for 30 days. Which AWS service provides a managed backup solution for EFS?

Accepted Answer

AWS Backup. AWS Backup is the correct answer because it is a fully managed, policy-based backup service that supports Amazon EFS natively. It allows you to define backup plans with daily schedules and retention rules (e.g., 30 days) without needing to manage any backup infrastructure or scripts. AWS Backup handles the lifecycle of backups, including incremental backups and automatic deletion of expired recovery points.

Answer

Amazon Data Lifecycle Manager (DLM)

Answer

EFS replication to another region

Answer

S3 Lifecycle policies

Question 15

A company is running a critical application on EC2 instances in an Auto Scaling group. The application experiences occasional CPU spikes. The SysOps administrator needs to configure a scaling policy that reacts quickly to increased load but avoids unnecessary scaling actions due to short bursts. Which scaling policy type should be used?

Accepted Answer

Target tracking scaling policy with a CPU utilization target of 70%. Target tracking scaling policy with a CPU utilization target of 70% is correct because it dynamically adjusts the Auto Scaling group's desired capacity to maintain a specified metric (CPU utilization) at the target value. It uses a built-in algorithm that reacts quickly to sustained load increases while smoothing out short bursts by applying a cooldown and proportional control logic, preventing unnecessary scaling actions from transient spikes.

Answer

Manual scaling

Answer

Scheduled scaling policy

Answer

Simple scaling policy