SOA-C02 Timed Practice Test 3 — 10 Questions

Question 1

A company uses Amazon S3 to store sensitive customer data. A SysOps administrator needs to ensure that any S3 bucket that is incorrectly configured to allow public read access is automatically remediated within five minutes. The administrator wants to use native AWS services with minimal custom code. Which solution should be used?

Accepted Answer

Use AWS Config with the 's3-bucket-public-read-prohibited' managed rule and configure automatic remediation to block public access.. AWS Config with the 's3-bucket-public-read-prohibited' managed rule can automatically evaluate S3 bucket configurations against the desired state. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action (e.g., applying an S3 bucket policy or blocking public access) using AWS Systems Manager Automation documents, all within the required five-minute window and with minimal custom code.

Answer

Create an Amazon EventBridge (CloudWatch Events) rule that triggers an AWS Lambda function to check and fix public read access.

Answer

Apply an S3 bucket policy to each bucket that denies public read access.

Answer

Use AWS Trusted Advisor to check for public read access and manually remediate when notified.

Question 2

A SysOps administrator deploys a web application using AWS Elastic Beanstalk. The administrator wants to deploy a new application version with zero downtime and minimize the risk of failure by launching a completely new set of instances before swapping traffic. Which deployment policy should the administrator choose?

Accepted Answer

Immutable. The Immutable deployment policy (Option D) is correct because it launches a completely new set of instances in a separate Auto Scaling group, deploys the new application version to them, and then swaps the Elastic Load Balancer (ELB) traffic from the old instances to the new ones in a single, atomic swap. This ensures zero downtime and minimizes risk by keeping the original environment fully intact until the new instances pass health checks, allowing an immediate rollback by simply swapping traffic back.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 3

A company wants to ensure that only specific IAM roles within the same AWS account can encrypt and decrypt data using an AWS KMS customer managed key. Which type of policy must be configured to achieve this restriction?

Accepted Answer

KMS key policy. A KMS key policy is the primary mechanism to control access to a customer managed key. By default, a KMS key policy must explicitly grant the necessary permissions (kms:Encrypt, kms:Decrypt) to IAM roles, and it can restrict those permissions to specific roles within the same account using the `aws:PrincipalArn` condition key. This ensures that only the designated IAM roles can encrypt and decrypt data with that key.

Answer

IAM policy attached to the roles

Answer

Service control policy (SCP)

Answer

Resource policy attached to the KMS key

Question 4

A SysOps administrator is testing the failover of an Amazon RDS for PostgreSQL Multi-AZ DB instance. The application currently writes to the primary instance in us-east-1a. Which action will manually trigger a failover to the standby instance in us-east-1b?

Accepted Answer

Reboot the DB instance and select 'Reboot with failover'.. Option A is correct because the 'Reboot with failover' option in the Amazon RDS console explicitly triggers a failover by rebooting the primary DB instance and forcing the Multi-AZ configuration to promote the standby instance in us-east-1b to become the new primary. This is the designed method for manually testing or initiating a failover in a Multi-AZ deployment.

Answer

Modify the DB instance to Single-AZ and then back to Multi-AZ.

Answer

Reboot the DB instance without selecting any failover option.

Answer

Promote the standby instance using the Amazon RDS console.

Question 5

A SysOps administrator needs to receive an email notification when an IAM user's console login fails. Which AWS service should be used to set up this notification?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch can monitor AWS CloudTrail log events for IAM console login failures by creating a metric filter on the CloudTrail log group for the `ConsoleLogin` event with a `failure` status. When the filter matches, CloudWatch can trigger an alarm that sends an email notification via Amazon SNS. This is the correct service because CloudWatch is designed for monitoring and alerting on operational metrics and log patterns.

Answer

AWS CloudTrail

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Question 6

A company wants to host a static website using Amazon S3. The website files are stored in an S3 bucket. The SysOps administrator needs to make the website accessible via HTTP. Which action must be performed on the S3 bucket?

Accepted Answer

Enable static website hosting. To host a static website on Amazon S3, you must enable the 'Static website hosting' property on the bucket. This configures the bucket to serve HTTP responses for index and error documents, and provides a regional website endpoint (e.g., http://bucket-name.s3-website-region.amazonaws.com). Without this setting, the bucket only supports REST API access (via the S3 API endpoint), not standard HTTP browser requests.

Answer

Enable versioning

Answer

Configure a bucket policy to allow public read access

Answer

Attach a CloudFront distribution

Question 7

A SysOps administrator needs to monitor application logs in Amazon CloudWatch Logs for the occurrence of the string 'ERROR'. The administrator wants to create a custom metric that counts the number of 'ERROR' occurrences per 5-minute window and trigger an Amazon CloudWatch alarm when the count exceeds 10. Which action should the administrator take to create the custom metric?

Accepted Answer

Create a metric filter on the CloudWatch Logs log group that matches the term 'ERROR'.. Option B is correct because metric filters in CloudWatch Logs allow you to define a pattern (e.g., 'ERROR') that is evaluated against incoming log events. The filter counts occurrences and publishes a custom metric to CloudWatch, which can then be used to set an alarm with a period of 5 minutes and a threshold of 10.

Answer

Create a CloudWatch Events rule that triggers on 'ERROR' and publishes a metric.

Answer

Create a CloudWatch dashboard that displays the log group and set an alarm on the dashboard.

Answer

Enable AWS CloudTrail on the log group and select the 'ERROR' pattern.

Question 8

A company wants to ensure that all Amazon S3 buckets have versioning enabled to protect against accidental deletion of objects. A SysOps administrator needs to automatically detect any buckets that do not have versioning enabled and receive notifications. Which AWS service should the administrator use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules, such as 's3-bucket-versioning-enabled', that continuously evaluate your S3 buckets against desired configuration states. When a bucket is non-compliant (versioning disabled), AWS Config can trigger an Amazon SNS notification to alert the administrator, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 9

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

Accepted Answer

AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.. AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Answer

AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications.

Answer

Amazon Macie to discover sensitive data and then manually encrypt buckets.

Question 10

A SysOps administrator needs to monitor the application logs of a web server and receive an email notification when the number of 'ERROR' log entries exceeds 100 in a 5-minute window. The logs are already being sent to Amazon CloudWatch Logs. Which combination of AWS services should be used to meet this requirement with the least operational overhead?

Accepted Answer

CloudWatch Logs metric filter, CloudWatch alarm, and Amazon SNS. Option A is correct because CloudWatch Logs metric filters can parse log events for the string 'ERROR' and count them in real time. A CloudWatch alarm can then trigger when the metric exceeds 100 in a 5-minute period, and Amazon SNS sends the email notification. This combination requires no custom code or additional infrastructure, minimizing operational overhead.

Answer

Amazon Kinesis Data Firehose and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Answer

AWS Config managed rule and Amazon SNS