SOA-C02 Practice Questions

Question 1

A company needs to retain API call logs for 7 years for compliance. Which AWS service should be used to store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across your AWS infrastructure and can be configured to store logs in an S3 bucket with lifecycle policies that retain data for 7 years. CloudTrail is specifically designed for auditing and compliance, capturing management and data plane API calls, and supports long-term retention via S3 object locking or lifecycle rules.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 2

A company stores critical data in an S3 bucket. The SysOps administrator needs to ensure that the data is durable and can be recovered if an entire AWS Region becomes unavailable. What is the MOST cost-effective solution?

Accepted Answer

Configure S3 Cross-Region Replication to a bucket in another Region.. D is correct because S3 Cross-Region Replication (CRR) automatically replicates objects to a bucket in another AWS Region, ensuring data durability and recoverability even if an entire Region becomes unavailable. This is the most cost-effective solution for cross-region disaster recovery as it only incurs replication costs and storage fees in the destination Region, without requiring manual intervention or additional infrastructure.

Answer

Use AWS Backup to manually copy the bucket to another Region.

Answer

Enable S3 Versioning on the bucket.

Answer

Use S3 Standard storage class.

Question 3

A company runs a critical stateful web application on Amazon EC2 instances in a single AWS region. The application stores user session data in an Amazon ElastiCache for Redis cluster. The SysOps administrator must design a disaster recovery (DR) strategy that can survive a complete regional outage with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The application must be able to redirect users to the DR region with minimal manual effort. Which combination of actions meets these requirements?

Accepted Answer

Create a read replica of the ElastiCache Redis cluster in the DR region using the native cross-region replication feature. Use Route 53 with failover routing to point to the DR region ALB when the primary health check fails. Pre-configure EC2 instances in an Auto Scaling group in the DR region.. ElastiCache for Redis supports cross-region replication via a read replica in the DR region, which can keep session data synchronized with minimal lag, meeting the 15-minute RPO. Route 53 failover routing with health checks on the primary region's ALB automatically redirects traffic to the pre-configured DR region EC2 instances and ALB, achieving the 1-hour RTO with minimal manual effort. Pre-configuring the DR region with an Auto Scaling group ensures compute capacity is ready, while the read replica provides the required data availability.

Answer

Use Amazon Route 53 with weighted routing to distribute traffic between the two regions. Use a global DynamoDB table for session data, and launch EC2 instances in the DR region only when a failure is detected using AWS CloudFormation StackSets.

Answer

Use an Amazon CloudFront distribution with multiple origins (primary and DR). Enable session stickiness at the CloudFront level. Use EC2 instances in both regions behind separate ALBs. No special data replication is needed because sessions are stored in Redis.

Answer

Use EC2 instances with an Auto Scaling group in both regions. Schedule a Lambda function to take snapshots of the Redis cluster every 15 minutes and copy them to the DR region. Use Route 53 latency routing to direct users to the nearest region.

Question 4

A company has a legacy application that runs on a single Amazon EC2 instance. The SysOps administrator is tasked with migrating the application to an Auto Scaling group behind an Application Load Balancer to improve availability. The application stores session state locally on the instance. What should the administrator do to ensure a seamless migration with minimal changes to the application code?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Using Amazon ElastiCache for Redis to store session data externally allows the application to be stateless, enabling seamless scaling across multiple EC2 instances in an Auto Scaling group. This approach requires minimal code changes (typically just configuring the application to use a Redis endpoint instead of local storage) and ensures session data is not lost if an instance fails. Option A (sticky sessions) is a workaround but does not eliminate the dependency on local storage; sessions are still lost if an instance fails. Option B (disabling local session storage) does not solve the problem because the application still needs persistent session storage. Option D (using RDS) is possible but is not the best choice for session data because relational databases are typically slower for session caching and require more significant code and schema changes compared to Redis, which is an in-memory data store optimized for session management.

Answer

Configure the Application Load Balancer with sticky sessions (session affinity).

Answer

Disable the feature that stores session state locally.

Answer

Modify the application to store session data in an Amazon RDS database.

Question 5

A company runs a critical database workload on an Amazon RDS for MySQL DB instance with Multi-AZ deployment in the us-east-1 region. The SysOps administrator must design a disaster recovery strategy that can recover from a complete regional outage. The Recovery Time Objective (RTO) is 2 hours and the Recovery Point Objective (RPO) is 1 hour. Which solution meets these requirements at the lowest cost?

Accepted Answer

Create a cross-Region read replica in another Region and promote it to a standalone DB instance during a disaster.. A cross-Region read replica continuously replicates data from the primary RDS MySQL instance to another Region with minimal lag, typically achieving an RPO of seconds to minutes, well within the 1-hour requirement. Promoting the replica to a standalone instance during a disaster can be done in minutes, meeting the 2-hour RTO. This approach is the lowest cost among the viable options as it uses existing replication infrastructure without additional data transfer fees for snapshots or DMS replication instances.

Answer

Create manual snapshots of the DB instance every hour and copy them to another AWS Region.

Answer

Enable automated backups with a retention period of 35 days and restore to a different Region when needed.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to a DB instance in another Region.

Question 6

An organization wants to ensure that no Amazon S3 bucket in the entire AWS Organization can be made public. The security team requires a preventive control that cannot be overridden by individual account administrators. Which AWS service or feature should be used?

Accepted Answer

Create a Service Control Policy (SCP) in AWS Organizations that denies permissions to modify S3 bucket public access settings.. A Service Control Policy (SCP) in AWS Organizations is a preventive guard that applies to all accounts within the organization. It can explicitly deny actions like s3:PutBucketPublicAccessBlock, s3:PutBucketPolicy, and s3:PutObjectAcl, preventing any principal (including root users) from making S3 buckets public. Unlike detective or account-level controls, SCPs cannot be overridden by individual account administrators, meeting the requirement for a non-overridable preventive control.

Answer

Enable AWS Config rules in each account to detect public S3 buckets and automatically remediate them using AWS Lambda.

Answer

Use an IAM policy attached to all IAM users in each account that denies s3:PutBucketPolicy.

Answer

Apply Amazon S3 Block Public Access at the account level in each individual AWS account.

Question 7

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?

Accepted Answer

Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.. Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.

Answer

Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.

Answer

Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.

Answer

Create a resource-based policy on each EC2 instance that denies access from non-production accounts.

Question 8

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The SysOps administrator receives reports that some users are experiencing intermittent HTTP 503 errors. What is the most likely cause?

Accepted Answer

The health checks are failing for the target group, causing the ALB to stop sending traffic to all instances.. HTTP 503 errors from an Application Load Balancer typically indicate that the target group has no healthy registered targets. When health checks fail for all instances in the target group, the ALB cannot route traffic to any backend, resulting in a 503 response. This is the most common cause of intermittent 503 errors in ALB architectures.

Answer

The security group attached to the ALB does not allow inbound traffic on port 443.

Answer

The EC2 instances do not have the correct IAM role to register with the ALB.

Answer

The ALB idle timeout is set too low.

Question 9

A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?

Accepted Answer

Deploy a NAT Gateway in each public subnet. Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.

Answer

Deploy a NAT instance in each private subnet

Answer

Deploy a single NAT Gateway in one public subnet

Answer

Attach an Internet Gateway directly to the private subnets

Question 10

A production RDS MySQL database stores financial records. The team needs the ability to restore the database to any point within the last 7 days in case of accidental data deletion. Automated backups are currently disabled. What must be configured?

Accepted Answer

Enable automated backups and set the backup retention period to 7 days. To restore an RDS MySQL database to any point within the last 7 days, you must enable automated backups and set the backup retention period to 7 days. Automated backups enable point-in-time recovery (PITR), which allows restoration to any second within the retention window using binary logs. Without automated backups, RDS cannot perform PITR, even if manual snapshots exist.

Answer

Create a manual DB snapshot every night using the AWS CLI on a schedule

Answer

Enable Multi-AZ to maintain a synchronous standby replica in a second Availability Zone

Answer

Enable RDS read replicas and promote one if data deletion occurs

Question 11

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Accepted Answer

Misconfigured firewall or iptables. An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Answer

Network connectivity issues

Answer

Detached EBS root volume

Answer

Insufficient memory for applications

Question 12

A SysOps administrator is designing a monitoring solution for a critical application running on EC2 instances. The application requires that all API calls to the environment are logged for security analysis. Which TWO services should the administrator use to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS CLI, SDKs, and other services. CloudTrail logs provide the identity of the caller, the time of the call, the source IP address, and the request parameters, which are essential for security analysis. Option B (Amazon CloudWatch Logs) is also correct because CloudTrail logs can be delivered to CloudWatch Logs for centralized monitoring, alerting, and retention, enabling real-time analysis and integration with other AWS services.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 13

A company stores large volumes of log data in Amazon S3. The logs are accessed frequently for the first 30 days, then occasionally for the next 60 days, and after 90 days they are rarely accessed but must be retained for 7 years for compliance. The SysOps administrator wants to minimize storage costs while ensuring data is available when needed. Which S3 lifecycle policy configuration should be applied?

Accepted Answer

Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.. It aligns the lifecycle transitions with the access patterns: frequent access for the first 30 days (S3 Standard), occasional access for the next 60 days (S3 Standard-IA), and rare access after 90 days (S3 Glacier Deep Archive, the lowest-cost storage class for long-term retention). The deletion after 7 years meets compliance requirements while minimizing costs by using progressively cheaper storage classes.

Answer

Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier after 60 days. Delete after 7 years.

Answer

Transition objects to S3 Glacier Deep Archive after 30 days, and delete after 7 years.

Answer

Transition objects to S3 One Zone-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.

Question 14

A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?

Accepted Answer

Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional. A CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.

Answer

Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it

Answer

Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement

Answer

Add a DeletionPolicy: Retain attribute to the RDS resource in the template

Question 15

A company has two Amazon VPCs (VPC-A and VPC-B) in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private IP connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

Accepted Answer

VPC Peering. VPC Peering is the correct solution because it allows direct private IP connectivity between two VPCs in the same AWS Region using the AWS global network backbone, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer charges. Since the VPCs have non-overlapping CIDR blocks, they can be peered without route conflicts, and traffic flows entirely within AWS without traversing the public internet or requiring a transit hub.

Answer

AWS Transit Gateway

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect

AWS Certified SysOps Administrator Associate SOA-C02 practice test

Three ways to study

Study SOA-C02 by domain

Study SOA-C02 by topic

Monitoring, Logging, and Remediation practice questions

Reliability and Business Continuity practice questions

Deployment, Provisioning, and Automation practice questions

Security and Compliance practice questions

Networking and Content Delivery practice questions

Cost and Performance Optimization practice questions

SOA-C02 fundamentals practice questions

SOA-C02 scenario practice questions

SOA-C02 troubleshooting practice questions

Top SOA-C02 questions

AWS Certified SysOps Administrator Associate SOA-C02 practice questions

How to use these SOA-C02 questions

Quick answer