SOA-C02 Timed Practice Test 5 — 10 Questions

Question 1

Which TWO AWS services can be used to monitor the performance of an Amazon RDS database and set alarms based on metrics?

Accepted Answer

Amazon RDS Performance Insights. Amazon CloudWatch (Option D) is the primary monitoring service for AWS resources, including Amazon RDS. It collects metrics like CPU utilization, database connections, and read/write latency, and allows you to set CloudWatch Alarms that trigger actions (e.g., SNS notifications) when thresholds are breached. Amazon RDS Performance Insights (Option B) provides deeper database performance analysis by visualizing database load and identifying bottlenecks, and it can also publish metrics to CloudWatch for alarm purposes.

Answer

AWS Lambda

Answer

Amazon S3

Answer

AWS CloudTrail

Question 2

A SysOps administrator suspects that an Amazon Linux 2 EC2 instance has been compromised. The instance is part of an Auto Scaling group and is currently running. The administrator needs to preserve the root volume for forensic analysis while minimizing the impact to the application. Which action should the administrator take FIRST?

Accepted Answer

Detach the root volume from the instance and create a snapshot of the volume for analysis.. Detaching the root volume and creating a snapshot preserves the evidence while the instance can be terminated and replaced by the Auto Scaling group. Option A (terminate) loses the volume. Option C (stop) leaves the volume attached to a stopped instance. Option D (AMI) creates a new image but does not preserve the exact state if the instance continues running.

Answer

Create an Amazon Machine Image (AMI) of the instance while it is running.

Answer

Stop the instance and create an Amazon EBS snapshot of the root volume.

Answer

Terminate the instance immediately to stop any malicious activity.

Question 3

A company stores application logs in Amazon S3. The logs are rarely accessed after the first 30 days, but must be retained for 7 years for compliance. The SysOps administrator wants to minimize storage costs while ensuring logs are available for retrieval within 12 hours if needed. Which S3 lifecycle configuration is the most cost-effective?

Accepted Answer

S3 Standard for 30 days, then transition to S3 Glacier Deep Archive. Option A is correct because it transitions logs from S3 Standard (for frequent access during the first 30 days) to S3 Glacier Deep Archive, which offers the lowest storage cost for long-term retention. Since logs must be retained for 7 years and only need retrieval within 12 hours, Glacier Deep Archive's 12-hour standard retrieval time meets the requirement while minimizing costs.

Answer

S3 Standard for 30 days, then transition to S3 Glacier (Flexible Retrieval)

Answer

Use S3 Intelligent-Tiering from the start

Answer

S3 Standard for 30 days, then transition to S3 One Zone-IA

Question 4

A SysOps administrator manages IAM roles for Amazon EC2 instances. The administrator needs to identify permissions that have never been used in the last 90 days to right-size the policies. Which AWS feature should be used to achieve this?

Accepted Answer

IAM Access Analyzer unused access analysis. IAM Access Analyzer unused access analysis is the correct AWS feature because it specifically analyzes IAM roles and policies to identify permissions that have not been used within a specified time frame (e.g., 90 days). It provides a report of unused actions, allowing the administrator to right-size policies by removing unnecessary permissions. This directly addresses the requirement to identify unused permissions for EC2 instance roles.

Answer

AWS CloudTrail Insights

Answer

IAM policy simulator

Answer

AWS Config managed rules

Question 5

Match each AWS security service to its purpose.

Question 6

Match each AWS service to its primary function.

Question 7

Match each AWS networking concept to its description.

Question 8

Match each AWS monitoring tool to its function.

Question 9

Match each AWS backup and disaster recovery service to its feature.

Question 10

Which TWO options are valid ways to send custom metrics to Amazon CloudWatch?

Accepted Answer

Use the CloudWatch agent to collect and publish custom metrics.. Option A is correct because the CloudWatch agent can be installed on EC2 instances or on-premises servers to collect system-level metrics (like memory and disk usage) and custom application metrics, then publish them to CloudWatch. Option B is correct because the PutMetricData API call allows direct programmatic ingestion of custom metrics into CloudWatch, supporting up to 1,000 metrics per call with a maximum payload of 1 MB.

Answer

Use Amazon SQS to send metric data to CloudWatch.

Answer

Use AWS CloudTrail to log custom metrics.

Answer

Use Amazon Kinesis Data Firehose to deliver metrics to CloudWatch.