SOA-C02 Reliability and Business Continuity Practice Test 6 — 15 Questions

Question 1

A SysOps administrator needs to ensure that an S3 bucket can recover from accidental deletions by users. The bucket stores versioned objects. What additional configuration should be enabled to prevent permanent deletion?

Accepted Answer

Enable MFA Delete on the bucket.. Option C is correct because MFA Delete requires multi-factor authentication to delete versions, preventing accidental permanent deletion. Option A is wrong because lifecycle policies do not protect against deletion. Option B is wrong because encryption does not prevent deletion. Option D is wrong because bucket policies can allow/deny but not require MFA for deletion of versions without additional configuration.

Answer

Enable S3 Server-Side Encryption.

Answer

Enable S3 Lifecycle rules to expire objects.

Answer

Configure a bucket policy to deny s3:DeleteObject.

Question 2

A company is running a stateful web application on a single EC2 instance in a public subnet. The instance stores user sessions locally. The company wants to improve availability without rewriting the application. Which design should they use?

Accepted Answer

Deploy an Application Load Balancer across multiple AZs, move session storage to ElastiCache, and use an Auto Scaling group.. Option B is correct because using Network Load Balancer with target groups across AZs and storing sessions in ElastiCache allows statelessness and high availability without code changes. Option A is wrong because Route 53 health checks alone do not handle session state. Option C is wrong because an Application Load Balancer with sticky sessions still ties sessions to instances. Option D is wrong because an Auto Scaling group without session externalization will lose sessions.

Answer

Create a second EC2 instance in a different AZ and use Route 53 with health checks.

Answer

Use an Auto Scaling group across multiple AZs but keep sessions on instance.

Answer

Use an Application Load Balancer with sticky sessions and an Auto Scaling group in a single AZ.

Question 3

A company has an RDS PostgreSQL database with a Multi-AZ deployment. The primary instance fails. What happens to the application connections?

Accepted Answer

The application must reconnect to the same endpoint; it will be redirected to the standby instance.. Option A is correct because RDS automatically fails over to the standby in the other AZ, and the DNS record updates to point to the standby. The application needs to reconnect. Option B is wrong because RDS does not automatically change the AWS Region. Option C is wrong because the CNAME is automatically updated. Option D is wrong because the endpoint does not change.

Answer

The application will be automatically redirected to a read replica.

Answer

The administrator must manually change the CNAME to point to the standby.

Answer

The application must use a new endpoint in a different AWS Region.

Question 4

A company is designing a highly available architecture for a web application. The application uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. Which TWO steps should the company take to ensure the architecture is resilient to an Availability Zone failure? (Select TWO.)

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones.. Options A and C are correct. Option A ensures the ALB can route traffic to targets in other AZs. Option C ensures EC2 instances are distributed across AZs. Option B is wrong because a single instance type does not improve availability. Option D is wrong because increasing min size in one AZ does not protect against AZ failure. Option E is wrong because CloudWatch alarms do not provide AZ redundancy.

Answer

Set the Auto Scaling group's desired capacity to a high number.

Answer

Create a CloudWatch alarm that triggers if the ALB has elevated 5xx errors.

Answer

Use a single EC2 instance type for all instances.

Question 5

A company wants to back up its on-premises file servers to AWS for disaster recovery. The data changes frequently, and the company needs to minimize data loss. Which THREE steps should the company take? (Select THREE.)

Accepted Answer

Use AWS Backup to create backup plans for the Storage Gateway.. Options A, C, and E are correct. AWS Storage Gateway with cached volumes stores data in AWS and caches frequently accessed data locally. Option B is wrong because S3 Transfer Acceleration is for upload speed, not backup. Option D is wrong because S3 Replication is for copying between buckets, not for initial backup.

Answer

Use S3 Transfer Acceleration for uploads.

Answer

Set up S3 Cross-Region Replication from the backup bucket.

Question 6

A SysOps administrator is planning for disaster recovery of an RDS MySQL database. The database is currently in a single AZ. Which TWO actions will improve recovery time and reduce data loss? (Select TWO.)

Accepted Answer

Enable automated backups with a retention period of 7 days.. Options B and D are correct. Multi-AZ provides a synchronous standby for failover, reducing RTO and RPO. Automated backups allow point-in-time recovery within seconds. Option A is wrong because read replicas are for read scaling, not failover. Option C is wrong because increasing storage does not improve recovery. Option E is wrong because Deletion Protection does not aid recovery.

Answer

Create a read replica in a different AWS Region.

Answer

Enable deletion protection on the RDS instance.

Answer

Increase the allocated storage to improve performance.

Question 7

A company runs a critical web application on EC2 instances behind an Application Load Balancer across three Availability Zones. The application stores session data in an RDS MySQL database. To improve reliability, the company wants to ensure that a single Availability Zone failure does not impact the application's availability. Which combination of actions should the SysOps administrator take?

Accepted Answer

Deploy RDS in Multi-AZ configuration with automatic failover, and enable cross-zone load balancing on the ALB.. Option C is correct because deploying RDS Multi-AZ with automatic failover ensures that database operations continue during an AZ outage. Enabling cross-zone load balancing ensures the ALB can route traffic to healthy instances in other AZs. Option A is wrong because ELB health checks alone do not handle AZ failures. Option B is wrong because increasing instance size does not provide AZ redundancy. Option D is wrong because increasing the Auto Scaling group's desired capacity does not distribute across AZs if not configured.

Answer

Configure the ALB to use only healthy instances and enable detailed CloudWatch metrics.

Answer

Increase the EC2 instance size to handle more traffic in a single AZ.

Answer

Increase the Auto Scaling group's desired capacity to a larger number.

Question 8

A SysOps administrator is designing a backup strategy for an Amazon EFS file system. The file system stores critical data that must be recoverable within 15 minutes of a failure. Which solution meets these requirements?

Accepted Answer

Use AWS Backup to create automated backups of the EFS file system and restore to a new file system if needed.. Option A is correct because EFS-to-EFS replication using AWS Backup allows point-in-time recovery and meets the 15-minute RTO. Option B is wrong because lifecycle policies do not create backups. Option C is wrong because Lambda functions must be custom-built. Option D is wrong because EBS snapshots cannot be used for EFS directly.

Answer

Configure EFS lifecycle management to move files to Infrequent Access storage class.

Answer

Take periodic EBS snapshots of the EC2 instance that mounts the EFS volume.

Answer

Create a Lambda function that copies files to an S3 bucket every hour.

Question 9

A company has a production AWS account with multiple VPCs connected via a transit gateway. The security team requires that all cross-VPC traffic be inspected by a centralized network firewall appliance. The firewall is deployed in a dedicated inspection VPC. The SysOps administrator must ensure that traffic from VPC A to VPC B is routed through the inspection VPC. Which configuration achieves this?

Accepted Answer

Configure the transit gateway route tables to propagate a blackhole route for VPC A and VPC B CIDRs to the inspection VPC attachment, then have the firewall forward traffic.. Option D is correct because a blackhole route to the inspection VPC forces traffic to go through it, and then the firewall forwards it. Option A is wrong because NAT gateways do not inspect traffic. Option B is wrong because VPC peering does not route through a central inspection point. Option C is wrong because Security Groups are stateful and not designed for centralized inspection.

Answer

Create a VPC peering connection between VPC A and VPC B, and use route tables to send traffic through the inspection VPC.

Answer

Use security groups in the inspection VPC to filter traffic between VPC A and VPC B.

Answer

Attach a NAT gateway in the inspection VPC and configure route tables in VPC A and B to point to the NAT gateway.

Question 10

A SysOps administrator is troubleshooting an issue where an Auto Scaling group is not launching EC2 instances despite having a scaling policy that should trigger when CPU utilization exceeds 80%. The CloudWatch alarm shows that the metric is breaching the threshold, but no instances are launched. What is the most likely cause?

Accepted Answer

The Auto Scaling group has reached its maximum size.. Option A is correct because if the Auto Scaling group has reached its maximum size, it cannot launch new instances. Option B is wrong because the alarm is breaching, so it's not in insufficient data. Option C is wrong because health check grace period affects instance health, not launching. Option D is wrong because if the policy is properly configured and alarm triggers, instances should launch unless max size is reached.

Answer

The scaling policy is incorrectly configured to use a simple scaling policy instead of a step scaling policy.

Answer

The health check grace period is too long.

Answer

The CloudWatch alarm is in insufficient data state.

Question 11

A company is using Amazon S3 to store critical data with versioning enabled. The SysOps administrator needs to implement a solution that automatically transitions objects to S3 Glacier Deep Archive after 90 days and permanently deletes them after 7 years. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policies. Option C is correct because S3 Lifecycle policies can transition objects to different storage classes and expire (delete) objects after a specified number of days. Option A is wrong because S3 Object Lock is for write-once-read-many (WORM) protection. Option B is wrong because S3 Intelligent-Tiering moves data between access tiers but does not delete. Option D is wrong because S3 Replication replicates objects, not lifecycle management.

Answer

S3 Intelligent-Tiering

Answer

S3 Object Lock

Answer

S3 Cross-Region Replication

Question 12

A company runs a stateful web application on EC2 instances behind a Network Load Balancer. The application requires that client requests from a particular session are always sent to the same target instance. Which feature should the SysOps administrator configure on the NLB to meet this requirement?

Accepted Answer

Configure sticky sessions using a cookie. Option B is correct because NLB supports sticky sessions (session affinity) using a cookie or source IP. Option A is wrong because cross-zone load balancing distributes traffic across AZs, not stickiness. Option C is wrong because NLB does not support path-based routing; that's ALB. Option D is wrong because health checks do not affect stickiness.

Answer

Configure path-based routing rules

Answer

Enable health checks on the target group

Answer

Enable cross-zone load balancing

Question 13

A SysOps administrator is tasked with designing a disaster recovery strategy for an Amazon RDS for PostgreSQL database. The database is currently in us-east-1. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 1 minute. Which solution meets these requirements?

Accepted Answer

Enable Multi-AZ deployment with automatic failover.. Option D is correct because Multi-AZ with automatic failover provides a standby in a different AZ within the same region, with RTO typically 1-2 minutes and RPO of seconds. Option A is wrong because cross-region read replicas have asynchronous replication with potential lag >5 seconds. Option B is wrong because snapshots have RPO of hours. Option C is wrong because single-AZ does not provide automatic failover.

Answer

Create a cross-region read replica in us-west-2 and promote it during a disaster.

Answer

Take daily automated snapshots and copy them to another region.

Answer

Deploy the database in a single AZ and use point-in-time recovery.

Question 14

A company has an Auto Scaling group that launches EC2 instances in private subnets. The instances need to download software patches from the internet. Which component must be added to the VPC to allow outbound internet traffic while keeping the instances private?

Accepted Answer

A NAT gateway in a public subnet. Option A is correct because a NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet. Option B is wrong because internet gateway alone does not allow private instances to reach the internet. Option C is wrong because VPC peering does not provide internet access. Option D is wrong because an egress-only internet gateway is for IPv6 traffic.

Answer

An internet gateway attached to the VPC

Answer

A VPC peering connection to a VPC with internet access

Answer

An egress-only internet gateway

Question 15

A team of developers is deploying a new microservice that uses Amazon DynamoDB as its data store. The SysOps administrator must ensure that the application can handle a sudden spike in read traffic without throttling. Which DynamoDB feature can be used to automatically handle increases in read capacity?

Accepted Answer

DynamoDB Auto Scaling. Option A is correct because DynamoDB auto scaling can adjust provisioned read capacity based on traffic. Option B is wrong because DynamoDB Accelerator (DAX) is a caching layer, not capacity scaling. Option C is wrong because global tables are for multi-region replication. Option D is wrong because TTL is for item expiration.

Answer

DynamoDB Global Tables

Answer

DynamoDB Time to Live (TTL)

Answer

DynamoDB Accelerator (DAX)