Courseiva

AWS Certified SysOps Administrator Associate SOA-C02 (SOA-C02) — Questions 226–247

247 questions total · 4pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 4

226
MCQhard

A SysOps administrator manages a fleet of EC2 instances that run a batch processing job. The job runs every hour and takes about 45 minutes to complete. The administrator wants to be notified if any job takes longer than 1 hour. Currently, the administrator uses CloudWatch Logs to capture job start and end times from application logs. The job writes a log message at start with 'JOB_START' and at end with 'JOB_END'. The administrator wants to create a metric filter that counts jobs that exceed 1 hour. However, the administrator is unsure how to achieve this with CloudWatch Logs. What should the administrator do?

A.Use CloudWatch Logs Insights to run a query every hour and check the duration.
B.Use CloudWatch Events to capture the log events and trigger a Lambda function to compute duration.
C.Create a metric filter that extracts the timestamp of JOB_START and JOB_END and computes the duration in a custom metric.
D.Create a Lambda function that is triggered by S3 to process the logs and publish a custom metric.
AnswerB

CloudWatch Events (EventBridge) can deliver CloudWatch Log events to a Lambda function in near real-time via a subscription filter, enabling event-driven processing. The Lambda function can parse the JOB_START and JOB_END entries, correlate them by job ID, calculate the duration, and publish a custom metric or trigger an alarm. This serverless architecture avoids polling and reacts immediately to each logged job, making it the recommended pattern.

Why this answer

CloudWatch Events (now part of Amazon EventBridge) can capture log events in real-time and trigger a Lambda function. The Lambda function can then compute job duration by correlating JOB_START and JOB_END events (e.g., using a DynamoDB table to store start times) and publish a custom metric or trigger an alarm if duration exceeds 1 hour. This approach handles the per-job correlation that metric filters cannot achieve.

Exam trap

Candidates often think metric filters can compute duration by extracting timestamps from JOB_START and JOB_END, but metric filters operate on individual log events and cannot correlate two events for the same job. The correct solution uses CloudWatch Events with Lambda for stateful computation.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs Insights is a query-based analysis tool for ad-hoc or scheduled queries, but it cannot directly trigger alarms or continuously monitor for durations exceeding 1 hour without custom scripting and additional services. Option B is wrong because CloudWatch Events (now Amazon EventBridge) can capture log events and trigger a Lambda function, but this approach adds unnecessary complexity and cost compared to a native metric filter, and it requires custom code to compute duration and publish metrics. Option D is wrong because S3 is not involved in the described workflow; the logs are in CloudWatch Logs, not S3, and using S3 triggers would require exporting logs to S3 first, adding latency and complexity.

Full explanation →
227
MCQhard

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?

A.Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.
B.Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.
C.Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.
D.Create a resource-based policy on each EC2 instance that denies access from non-production accounts.
AnswerB

SCPs are a centralized way to set permission boundaries for all accounts in the organization. By denying EC2 actions via SCP on non-production OUs, the restriction is enforced even for the root user of those accounts, and it applies to all IAM principals.

Why this answer

Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.

Exam trap

The trap here is that candidates often confuse IAM policies (which are identity-based and account-specific) with SCPs (which are account-wide and centrally managed), leading them to choose Option A because they think attaching a deny policy to users is sufficient, but they overlook that SCPs provide the only centralized, preventive control across multiple accounts in AWS Organizations.

How to eliminate wrong answers

Option A is wrong because IAM policies attached to users and roles are not centrally managed across multiple accounts; they must be applied individually in each account, which is not a centralized solution and can be bypassed by local administrators. Option C is wrong because AWS Config is a detective service that can detect and react to EC2 usage (e.g., via auto-remediation), but it does not prevent the initial creation or use of EC2 resources; it only responds after the fact, which is not a preventive restriction. Option D is wrong because resource-based policies on EC2 instances control access to the instance itself (e.g., who can start/stop it), not the ability to launch or manage EC2 services in an account; they are also not centrally managed across accounts.

Full explanation →
228
MCQhard

A CloudFormation stack manages an RDS database, an S3 bucket, and several Lambda functions. During a recent stack update, a property change caused CloudFormation to replace the RDS instance, deleting the database and re-creating it — resulting in data loss. The team wants to prevent any future stack update from replacing or deleting the RDS instance without an explicit override. What CloudFormation feature accomplishes this?

A.Set a stack policy that denies Replace and Delete actions on the RDS resource; require an override policy to be explicitly provided when a replacement is intentional
B.Enable deletion protection on the RDS instance to prevent CloudFormation from deleting it
C.Use CloudFormation change sets to preview the update and manually reject any change set that includes a replacement
D.Add a DeletionPolicy: Retain attribute to the RDS resource in the template
AnswerA

The stack policy evaluates each update action per resource. A Deny on Replace for the RDS logical resource ID prevents CloudFormation from completing any update that would recreate the database — the update fails with a clear policy error. A temporary override policy passed via --stack-policy-during-update can explicitly allow the replacement for a deliberate migration.

Why this answer

A CloudFormation stack policy can explicitly deny Update (which includes replacement) and Delete actions on specific resources, such as the RDS instance. To intentionally perform a replacement, the user must provide an override stack policy during the update that allows the action, ensuring that no accidental replacement occurs without explicit consent.

Exam trap

The trap here is that candidates confuse RDS deletion protection or DeletionPolicy: Retain with stack policies, mistakenly believing those features can block CloudFormation from replacing a resource during an update, when in fact they only protect against deletion in specific scenarios (e.g., stack deletion or direct API calls).

How to eliminate wrong answers

Option B is wrong because RDS deletion protection prevents the database from being deleted via the RDS API or console, but CloudFormation can still replace the instance (which involves creating a new one and deleting the old one) if the template triggers a replacement; deletion protection does not block CloudFormation from performing a replacement. Option C is wrong because change sets only provide a preview of changes and require manual approval, but they do not prevent a user from accidentally executing a change set that includes a replacement; the team wants a guardrail that blocks replacement without an explicit override, not just a manual review step. Option D is wrong because DeletionPolicy: Retain only preserves the resource when the stack is deleted, but it does not prevent CloudFormation from replacing the resource during a stack update; a replacement still deletes the original resource and creates a new one, and the Retain policy does not block that deletion.

Full explanation →
229
MCQeasy

A SysOps administrator wants to receive a notification when an EC2 instance's status check fails. Which AWS service should be used to achieve this?

A.Amazon CloudWatch Alarms
B.AWS Config
C.AWS CloudTrail
D.AWS Trusted Advisor
AnswerA

Amazon CloudWatch Alarms is the correct service because it directly consumes the EC2 StatusCheckFailed metric, which is emitted every minute by the instance hypervisor. You can configure an alarm on this metric with a threshold (e.g., >=1 for one or more consecutive evaluation periods) to transition to ALARM state, and then invoke an SNS topic to send notifications via email, SMS, or Lambda. CloudWatch also supports separate alarms for StatusCheckFailed_System (host-level issues) and StatusCheckFailed_Instance (guest-OS level issues), giving you granular, near-real-time health monitoring.

Why this answer

Amazon CloudWatch Alarms can monitor EC2 instance status checks (both system and instance checks) and trigger an action, such as sending a notification via Amazon SNS, when a status check fails. This is the native AWS service designed for real-time monitoring and alerting on metric thresholds, making it the correct choice for this use case.

Exam trap

The trap here is that candidates often confuse AWS Config (which evaluates configuration compliance) with CloudWatch Alarms (which monitor metric thresholds), leading them to select AWS Config for real-time health alerts instead of the correct monitoring service.

How to eliminate wrong answers

Option B (AWS Config) is wrong because it is used for evaluating and recording resource configurations against desired policies, not for monitoring real-time status check failures. Option C (AWS CloudTrail) is wrong because it captures API activity and management events, not instance-level health metrics like status checks. Option D (AWS Trusted Advisor) is wrong because it provides best-practice recommendations and cost optimization checks, not real-time monitoring or alerting on EC2 status checks.

Full explanation →
230
MCQhard

An application writes logs to a file on an EC2 instance. The SysOps team needs to send these logs to Amazon CloudWatch Logs in real time. The logs must be encrypted at rest in CloudWatch Logs using a customer-managed KMS key. Which steps are required?

A.Use AWS CloudTrail to deliver logs to CloudWatch Logs with KMS encryption.
B.Store logs in S3 with KMS encryption and use S3 event notifications to trigger Lambda to put logs in CloudWatch Logs.
C.Install the CloudWatch Logs agent and enable encryption on the EC2 instance volume using KMS.
D.Install the CloudWatch Logs agent and associate a KMS key with the log group using the 'associate-kms-key' API.
AnswerD

This enables encryption at rest with a customer-managed key.

Why this answer

The CloudWatch Logs agent can send log data from an EC2 instance to CloudWatch Logs in real time, and the 'associate-kms-key' API (or the equivalent AWS CLI command 'put-log-group-encryption') allows you to associate a customer-managed KMS key with a log group, encrypting the logs at rest. This meets both the real-time delivery and customer-managed KMS encryption requirements without additional services or workarounds.

Exam trap

The trap here is that candidates often confuse encrypting the log file on the EC2 instance volume (Option C) with encrypting the logs at rest in CloudWatch Logs, or they overcomplicate the solution by introducing unnecessary services like S3 and Lambda (Option B) instead of using the native KMS integration with CloudWatch Logs.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail delivers API activity logs, not application log files from an EC2 instance, and it cannot be used to send arbitrary application logs to CloudWatch Logs in real time. Option B is wrong because storing logs in S3 and using S3 event notifications to trigger a Lambda function introduces latency and complexity, and does not provide real-time streaming to CloudWatch Logs; it also requires additional services and is not the standard method for real-time log ingestion. Option C is wrong because enabling encryption on the EC2 instance volume using KMS encrypts the log file at rest on the instance, but does not encrypt the logs at rest in CloudWatch Logs; the CloudWatch Logs agent sends data over the network, and the log group itself must be encrypted with a KMS key to meet the requirement.

Full explanation →
231
Multi-Selectmedium

A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?

Select 2 answers
A.VPC Peering connection
B.Private subnet route table with a route to the Internet Gateway
C.Internet Gateway attached to the VPC
D.Private subnet route table with a route to the NAT Gateway
E.NAT Gateway in a public subnet
AnswersD, E

This route directs traffic from private subnets to the NAT Gateway.

Why this answer

The correct answers are D and E. A NAT Gateway placed in a public subnet (E) provides outbound internet access for instances in private subnets. The private subnet's route table must have a route pointing to the NAT Gateway (D) for internet-bound traffic.

VPC Peering (A) connects VPCs but does not provide internet access. An Internet Gateway (C) attached to the VPC enables internet access for public subnets, but private subnets should not have a direct route to it. Option B (private route to IGW) would make the subnet public, violating the requirement.

Therefore, D and E together provide the desired outbound-only internet access.

Full explanation →
232
MCQeasy

An organization uses AWS Service Catalog to manage approved IT services. A SysOps administrator needs to update a CloudFormation template used by a product. The administrator wants to ensure that existing provisioned products are updated with the new template version. What step must the administrator take after updating the product?

A.Update the portfolio that contains the product.
B.Create a new product version and update the provisioned products to use the new version.
C.Update the product's CloudFormation template directly in the Service Catalog console.
D.Terminate the existing provisioned products and reprovision them.
AnswerB

To update an existing provisioned product, you must create a new product version in AWS Service Catalog, typically by uploading a new CloudFormation template. Once the version is available, you then use the console or AWS CLI to update each provisioned product to the new version, which triggers CloudFormation change sets to apply only the necessary modifications. This preserves the resource lifecycle and minimizes disruption while ensuring your approved infrastructure is updated consistently.

Why this answer

To update existing provisioned products, you must create a new product version and update the provisioned product to that version. Simply updating the template directly or modifying the portfolio does not automatically propagate changes to provisioned products.

Full explanation →
233
MCQeasy

A company uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The SysOps administrator wants to deploy a new version of the application by first shifting 10% of traffic to the new version, monitoring for errors, and then after manual approval, shifting the remaining 90%. Which deployment configuration should be used?

A.In-place deployment
B.Blue/green deployment with Canary10Percent configuration
C.Blue/green deployment with Linear10PercentEvery10Minutes configuration
D.Blue/green deployment with AllAtOnce configuration
AnswerB

Blue/green with Canary10Percent shifts 10% of traffic to the new version, waits, then automatically shifts the remaining 90%. It matches the pattern but does not natively support manual approval.

Why this answer

A Blue/green deployment with Canary10Percent configuration shifts 10% of traffic to the new version, waits for a specified period (default 10 minutes), and then automatically shifts the remaining 90%. Note that manual approval is not natively supported by this configuration; it would need to be implemented separately (e.g., via a lifecycle hook). The question's requirement for manual approval is not directly met by the deployment configuration itself, but among the options, Canary10Percent is the only one that shifts traffic in the described pattern of 10% first then 90%.

Exam trap

The trap is confusing Canary10Percent (which automatically shifts the remaining traffic after a wait) with Linear10PercentEvery10Minutes (which automatically shifts 10% every 10 minutes). Both are automated; neither natively includes manual approval. Candidates may incorrectly believe that one supports manual approval natively.

How to eliminate wrong answers

Option A is wrong because in-place deployment updates existing instances without traffic shifting, so it cannot shift 10% of traffic to a new version. Option C is wrong because Linear10PercentEvery10Minutes automatically shifts 10% every 10 minutes without requiring manual approval, which does not meet the manual approval requirement. Option D is wrong because AllAtOnce shifts 100% of traffic immediately, which does not allow for a 10% initial shift and monitoring.

Full explanation →
234
MCQhard

An application stores its RDS PostgreSQL credentials in AWS Secrets Manager. The security policy requires credentials to be rotated every 30 days automatically. During rotation, the application must continue to serve traffic with zero downtime. The application retrieves credentials by calling GetSecretValue at the start of each database connection. What must be configured to satisfy all requirements?

A.Enable automatic rotation in Secrets Manager with a 30-day schedule; use the AWS-provided Lambda rotation function for RDS PostgreSQL; ensure the application calls GetSecretValue per connection rather than caching credentials
B.Rotate credentials manually every 30 days by updating the secret value in the console and restarting the application
C.Create an EventBridge scheduled rule every 30 days that triggers a Lambda to generate a new RDS password and update both the database and the secret
D.Store credentials in an environment variable on the application's EC2 instance and rotate by updating the environment variable and reloading the application
AnswerA

The AWS-provided rotation Lambda handles the full four-step lifecycle. The 30-day rotation schedule triggers the Lambda automatically. Because the application fetches credentials fresh per connection, it starts using the new credentials immediately after AWSCURRENT switches, with no restart needed. Secrets Manager's rotation is designed for zero downtime — the new password is validated on the database before the old version is retired.

Why this answer

AWS Secrets Manager's automatic rotation, combined with the AWS-provided Lambda rotation function for RDS PostgreSQL, ensures credentials are rotated every 30 days without manual intervention. The application's practice of calling GetSecretValue at the start of each database connection guarantees it always retrieves the current secret, avoiding stale credentials and achieving zero downtime during rotation.

Exam trap

The trap here is that candidates may think any automated rotation (like EventBridge + Lambda) suffices, but the question specifically tests the integration of Secrets Manager's native rotation with its versioning and staging labels to achieve zero downtime.

How to eliminate wrong answers

Option B is wrong because manual rotation every 30 days with a console update and application restart violates the zero-downtime requirement; restarting the application causes service interruption. Option C is wrong because while it implements rotation via EventBridge and Lambda, it does not use Secrets Manager's built-in rotation mechanism, missing the automatic version management and staging labels (AWSCURRENT, AWSPREVIOUS) that ensure seamless credential transition. Option D is wrong because storing credentials in an environment variable on EC2 and rotating by updating the variable and reloading the application introduces downtime and bypasses Secrets Manager's secure storage, auditing, and rotation capabilities.

Full explanation →
235
MCQmedium

A company runs a production Amazon RDS for PostgreSQL DB instance in a single Availability Zone (AZ). The SysOps administrator needs to improve database availability so that in the event of a database failure or AZ outage, a standby instance is automatically promoted with minimal downtime. Which configuration should the administrator enable?

A.Enable automated backups with a retention period of 35 days.
B.Create a read replica in another Availability Zone.
C.Enable Multi-AZ deployment on the DB instance.
D.Schedule manual snapshots to be taken every hour and restore from the latest snapshot when needed.
AnswerC

Enabling Multi-AZ on an Amazon RDS for PostgreSQL DB instance provisions a synchronous standby replica in a different Availability Zone and automatically maintains a synchronous physical replication stream. In the event of an infrastructure failure, an availability zone outage, or a database patching event, Amazon RDS automatically performs a failover to the standby, typically completing within 60–120 seconds and preserving your data because all commits are synchronous. The DNS endpoint remains unchanged, so application connections are transparently redirected without manual intervention. This configuration meets the requirement for automatic failover and high availability.

Why this answer

Multi-AZ deployment automatically creates and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure or AZ outage, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, with no manual intervention required. This meets the requirement for automatic promotion with minimal downtime.

Exam trap

The trap here is that candidates confuse read replicas (which are for read scaling and require manual promotion) with Multi-AZ (which provides automatic failover), or they overestimate the speed and automation of backups and snapshots for disaster recovery.

How to eliminate wrong answers

Option A is wrong because automated backups only provide point-in-time recovery (PITR) to restore the database to a specific time, not automatic failover with minimal downtime; restoration is a manual process that can take hours. Option B is wrong because a read replica is designed for read scaling and asynchronous replication, not automatic failover; promoting a read replica requires manual intervention and can result in data loss due to replication lag. Option D is wrong because manual snapshots require scheduling and manual restoration, which involves significant downtime and does not provide automatic failover or minimal disruption.

Full explanation →
236
Drag & Dropmedium

Drag and drop the steps to set up an AWS Site-to-Site VPN connection into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create and attach the virtual private gateway, then define the customer gateway, then create the VPN connection, configure the on-premises router, and verify the tunnel.

Full explanation →
237
MCQhard

A company runs a critical application on Amazon EC2 instances across multiple Availability Zones. The application stores state data on a shared Amazon EFS file system. The SysOps administrator needs to ensure that the file system remains available if an entire Availability Zone fails. The file system must also provide low-latency access from all instances. Which configuration meets these requirements?

A.Create an EFS file system with the One Zone storage class and mount it from all instances.
B.Create an EFS file system with the Standard storage class, enable replication to another Region, and use DNS failover.
C.Create an EFS file system with the Standard storage class in the same Region, and mount it from all instances using the regional mount target.
D.Create an EFS file system with the Standard storage class, and enable Multi-AZ deployment.
AnswerC

The Standard storage class automatically replicates file system data redundantly across multiple Availability Zones within the Region, providing built-in resilience against an AZ failure. The regional mount target is a single DNS name that resolves to mount targets in each AZ, so instances in any AZ can mount the same file system with low-latency access. If one AZ becomes unavailable, the DNS/ELF service continues to route instances to healthy mount targets, satisfying the high availability requirement.

Why this answer

The EFS Standard storage class stores data redundantly across multiple Availability Zones (AZs) within a Region, ensuring high availability and durability even if an entire AZ fails. By mounting the file system using the regional mount target (which resolves to the EFS file system's regional DNS name), instances in any AZ can access the file system with low latency, as EFS automatically routes traffic to the most appropriate mount target in the same AZ. This configuration meets both the availability and low-latency requirements without additional replication or failover complexity.

Exam trap

The trap here is that candidates confuse EFS's Standard storage class with RDS's Multi-AZ deployment feature, or incorrectly assume that cross-Region replication is necessary for AZ-level fault tolerance, when in fact EFS's regional storage class already provides Multi-AZ redundancy within a single Region.

How to eliminate wrong answers

Option A is wrong because the One Zone storage class stores data only within a single Availability Zone, so if that AZ fails, the file system becomes unavailable, violating the requirement for continued availability during an AZ failure. Option B is wrong because enabling cross-Region replication does not provide low-latency access from all instances within the same Region; it introduces additional latency for cross-Region data access and requires DNS failover, which is not designed for intra-Region AZ failures and adds unnecessary complexity. Option D is wrong because EFS does not support a 'Multi-AZ deployment' configuration; the term 'Multi-AZ' applies to Amazon RDS, not EFS, and EFS inherently provides Multi-AZ redundancy through the Standard storage class, not through a separate deployment option.

Full explanation →
238
MCQmedium

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?

A.Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation
B.Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda
C.Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions
D.AWS CloudTrail + Amazon EventBridge + AWS CodePipeline
AnswerB

A CloudWatch alarm monitors the CPU metric and publishes to an SNS topic when the threshold is breached. The SNS topic triggers a Lambda function that calls the EC2 StopInstances API to stop the instance. This is a clean, low-overhead solution.

Why this answer

It uses Amazon CloudWatch alarms to monitor CPU utilization metrics and trigger an SNS topic, which then invokes an AWS Lambda function. The Lambda function can execute the logic to stop the EC2 instance when the alarm state indicates CPU utilization above 90% for 30 minutes, providing automated cost control without manual intervention.

Exam trap

The trap here is that candidates may assume Systems Manager Automation (Option A) is required for instance stop actions, but Lambda is simpler and directly triggered by SNS, while Automation is better suited for complex multi-step workflows like patching or AMI creation.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Automation is designed for predefined runbook-style remediation (e.g., patching, configuration changes) and is not directly triggered by CloudWatch alarms to stop an instance based on a metric threshold; it requires additional orchestration and does not natively support the stop action from an alarm. Option C is wrong because Amazon CloudWatch Logs is for log data, not metric monitoring, and Amazon EventBridge with Step Functions is overkill for a simple stop action; CloudWatch Logs cannot directly trigger alarms on CPU utilization metrics. Option D is wrong because AWS CloudTrail records API activity, not CPU metrics, and Amazon EventBridge with CodePipeline is for CI/CD pipelines, not for monitoring or stopping instances based on utilization thresholds.

Full explanation →
239
MCQmedium

An administrator is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS Elastic Beanstalk. The build succeeds, but the deployment fails with 'Access Denied' when Elastic Beanstalk tries to read the artifact from S3. What should the administrator check?

A.The IAM role assumed by the Elastic Beanstalk environment
B.The IAM role used by CodeBuild
C.Whether the artifact bucket is in the same region as the pipeline
D.The S3 bucket policy for the artifact bucket
AnswerA

The Elastic Beanstalk environment uses an IAM service role to interact with other AWS services. To read the artifact from S3, that role must have s3:GetObject permission on the artifact bucket. Denial often indicates the role lacks these permissions.

Why this answer

The Elastic Beanstalk environment's IAM service role must have permissions to read the artifact from the S3 bucket. If this role lacks the necessary s3:GetObject permission, the deployment fails with 'Access Denied'. Option B is incorrect because the CodeBuild role handles build tasks, not deployment actions.

Option C is incorrect because CodePipeline can manage cross-region artifacts; the region mismatch is unlikely to cause an access-denied error. Option D is incorrect because the artifact bucket is managed by CodePipeline and its bucket policy is typically configured correctly; the issue is more likely with the Elastic Beanstalk service role's permissions.

Full explanation →
240
MCQhard

A company runs a production web application on AWS using Auto Scaling groups (ASGs) behind an Application Load Balancer (ALB). The application state is stored in an Amazon RDS for MySQL Multi-AZ DB instance. The application experiences periodic traffic spikes, and the current ASG uses a simple scaling policy based on average CPU utilization. Recently, during a spike, the application became unresponsive for several minutes. The CloudWatch metrics show that the CPU utilization on the RDS instance peaked at 80%, and the DB Connections metric reached the maximum allowed. The read replica lag increased to over 10 seconds during the spike. The web servers are stateless and scale out quickly. The operations team needs to improve the reliability and performance of the application to handle future spikes. Which solution should the team implement?

A.Increase the desired capacity of the ASG and add more read replicas to distribute the database load.
B.Increase the DB instance size to a larger instance class and implement an Amazon ElastiCache cluster to cache frequent database queries.
C.Migrate the database to Amazon DynamoDB with auto scaling and rewrite the application to use a serverless architecture with AWS Lambda.
D.Reduce the maximum connections parameter on the RDS instance to prevent connection exhaustion and modify the application code to reduce the number of database queries.
AnswerB

Scaling the DB instance to a larger class directly increases available vCPU, memory, and the maximum connection limit, giving the primary database the headroom needed to absorb the current CPU spike. Implementing an ElastiCache cluster (for example, Redis or Memcached) in front of the database caches the results of frequent, repetitive queries, so those reads never reach the RDS instance, which lowers CPU usage and frees connections for writes and less frequent queries. Together these actions provide both immediate compute capacity and durable read-path relief, exactly matching the incident's requirements.

Why this answer

Increasing the DB instance size provides more CPU and memory capacity to handle the load, and caching with ElastiCache reduces read load on the database by serving frequent queries from cache. This directly addresses high CPU and connection limits on RDS, and reduces read replica lag. Option A is wrong because increasing ASG size and adding more read replicas may increase database load further due to more connections and replication overhead.

Option C is wrong because switching to DynamoDB and Lambda would require significant application changes and DynamoDB may not be suitable for complex queries. Option D is wrong because reducing MaxConnections on RDS would make the problem worse, and modifying application code to reduce queries is not a quick fix.

Full explanation →
241
MCQmedium

A SysOps administrator creates the above IAM policy for a user. The user reports that they cannot delete an object in the bucket 'my-bucket' even though they are using MFA. What is the likely cause?

A.The resource ARN is missing the bucket-level permission.
B.The condition key aws:MultiFactorAuthPresent is incorrectly spelled.
C.The user is not using MFA when making the API call.
D.The policy does not include s3:DeleteObjectVersion.
AnswerC

The condition likely sets `aws:MultiFactorAuthPresent` to `false` or uses the `Bool` operator to deny access when MFA is absent. Because the user made the API call without an MFA token, the condition evaluates to `false`, triggering the `Deny` statement. This is the explicit reason why the delete request fails, as the policy mandates MFA for all actions by this user.

Why this answer

The policy requires MFA for all s3:DeleteObject actions, as indicated by the condition key aws:MultiFactorAuthPresent set to 'true'. If the user reports they cannot delete an object despite using MFA, the most likely cause is that they are not actually using MFA when making the API call — for example, they may have authenticated with long-term credentials (access key/secret key) without a multi-factor authentication session. The condition key checks the presence of an MFA-authenticated session token, not just whether the user has MFA enabled on their account.

Exam trap

The trap here is that candidates confuse 'having MFA enabled on the user account' with 'using MFA in the API call session' — the condition key aws:MultiFactorAuthPresent checks the latter, not the former.

How to eliminate wrong answers

Option A is wrong because the resource ARN 'arn:aws:s3:::my-bucket/*' correctly specifies object-level permissions for all objects in the bucket, and bucket-level permissions (e.g., s3:ListBucket) are not required for the s3:DeleteObject action. Option B is wrong because the condition key 'aws:MultiFactorAuthPresent' is correctly spelled — it is case-sensitive and matches the official AWS documentation. Option D is wrong because s3:DeleteObjectVersion is a separate action for deleting a specific version of an object, and the policy already includes s3:DeleteObject, which covers deleting the current version of an object (the most common operation).

Full explanation →
242
MCQhard

A company stores application log files in an Amazon S3 bucket. The logs are accessed frequently for the first 30 days, then rarely accessed but must be retrievable within 12 hours. After 1 year, the logs must be archived for compliance with a retention period of 5 years, during which retrievals are expected to be extremely rare (one or two per year) and retrieval time of 12 hours is acceptable. The SysOps administrator wants to minimize storage costs. Which S3 lifecycle policy configuration should be used?

A.After 30 days, transition to S3 Standard-IA; after 365 days, transition to S3 Glacier Deep Archive; delete after 5 years.
B.After 30 days, transition to S3 Glacier Flexible Retrieval; after 365 days, transition to S3 Glacier Deep Archive; delete after 5 years.
C.After 30 days, transition to S3 Glacier Flexible Retrieval; delete after 5 years.
D.After 30 days, transition to S3 Glacier Deep Archive; delete after 5 years.
AnswerB

This lifecycle provides cost-optimized storage: S3 Standard for the first 30 days (frequent access), S3 Glacier Flexible Retrieval for the next 335 days (rare access, 12-hour retrieval acceptable), and S3 Glacier Deep Archive for the final 4+ years (extremely rare access, lowest cost). This minimizes overall costs while meeting retrieval requirements.

Why this answer

It uses S3 Glacier Flexible Retrieval for the first year after the initial 30 days, which meets the 12-hour retrieval requirement at lower cost than S3 Standard-IA, then transitions to S3 Glacier Deep Archive for the remaining 4 years to minimize storage costs for extremely rare retrievals. The lifecycle policy transitions objects after 30 days to S3 Glacier Flexible Retrieval (retrieval time minutes to 12 hours), then after 365 days to S3 Glacier Deep Archive (retrieval time 12 hours), and deletes after 5 years, aligning with the access patterns and compliance retention.

Exam trap

The trap here is that candidates often choose S3 Standard-IA (Option A) because it seems logical for infrequent access, failing to recognize that S3 Glacier Flexible Retrieval provides lower storage costs for data that is rarely accessed but still needs retrieval within 12 hours, and that a multi-tier lifecycle (Option B) is more cost-effective than a single transition.

How to eliminate wrong answers

Option A is wrong because transitioning to S3 Standard-IA after 30 days is not cost-optimal for data that is rarely accessed after the first 30 days; S3 Glacier Flexible Retrieval offers lower storage costs for infrequent access with a 12-hour retrieval window. Option C is wrong because it does not transition to S3 Glacier Deep Archive after 1 year, missing the opportunity to further reduce storage costs for the 4-year archival period where retrievals are extremely rare. Option D is wrong because transitioning directly to S3 Glacier Deep Archive after 30 days is premature and more expensive than using S3 Glacier Flexible Retrieval for the first year, as Deep Archive has higher retrieval costs and is designed for long-term archival, not for data that may still be accessed occasionally within 12 hours.

Full explanation →
243
MCQmedium

A company uses AWS Systems Manager Patch Manager to automate patching of Amazon EC2 instances. The SysOps administrator needs to configure a maintenance window that will patch instances on the second Tuesday of every month at 2:00 AM. The administrator wants to ensure that patches are automatically applied but reboots are only performed if required. Which combination of configurations should the administrator use?

A.Create a maintenance window with a cron schedule of cron(0 2 ? * TUE#2 *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.
B.Create a maintenance window with a rate schedule of 30 days and use an AWS-ApplyPatchBaseline document with operation 'Scan' and reboot option 'RebootIfNeeded'.
C.Create a maintenance window with a cron schedule of cron(0 2 14 * ? *) and use an AWS-RunPatchBaseline document with operation 'Install' and reboot option 'RebootIfNeeded'.
D.Create a maintenance window with a cron schedule of cron(0 2 2 * 2 *) and use an AWS-InstallPatchBaseline document with operation 'Install' and reboot option 'NoReboot'.
AnswerA

This schedule correctly specifies the second Tuesday of each month at 2 AM. The document and operation apply patches, and RebootIfNeeded only reboots if necessary.

Why this answer

It uses the cron expression `cron(0 2 ? * TUE#2 *)` to schedule the maintenance window for the second Tuesday of every month at 2:00 AM, and the `AWS-RunPatchBaseline` document with operation `Install` and reboot option `RebootIfNeeded` ensures patches are applied automatically and reboots only occur when required by the patch installation.

Exam trap

The trap here is that candidates often confuse the cron syntax for 'second Tuesday' with simpler day-of-month or day-of-week expressions, or mistakenly use invalid SSM document names like `AWS-ApplyPatchBaseline` or `AWS-InstallPatchBaseline`, which do not exist in AWS Systems Manager.

How to eliminate wrong answers

Option B is wrong because it uses a rate schedule of 30 days, which does not guarantee execution on the second Tuesday of every month and can drift over time; also, `AWS-ApplyPatchBaseline` is not a valid SSM document name (the correct document is `AWS-RunPatchBaseline`), and operation `Scan` only reports missing patches without applying them. Option C is wrong because the cron expression `cron(0 2 14 * ? *)` runs on the 14th day of every month regardless of the day of the week, which does not target the second Tuesday specifically. Option D is wrong because the cron expression `cron(0 2 2 * 2 *)` runs on the 2nd day of the month only when it is also a Tuesday, which is not the second Tuesday; additionally, `AWS-InstallPatchBaseline` is not a valid SSM document name, and reboot option `NoReboot` prevents reboots even when required, contradicting the requirement.

Full explanation →
244
MCQhard

An application running on EC2 instances occasionally throws 'Connection refused' errors when connecting to an RDS database. The SysOps administrator needs to determine if the issue is due to database connection limits or network security groups. Which metrics and logs should the administrator examine?

A.Check CloudWatch RDS CPUUtilization and CloudTrail logs for RDS API calls.
B.Review RDS error logs in CloudWatch Logs and check the EC2 instance's system log.
C.Look at the EC2 instance's CloudWatch NetworkIn and NetworkOut metrics and RDS FreeableMemory metric.
D.Examine the RDS CloudWatch metric DatabaseConnections and analyze VPC Flow Logs for the EC2 instance's network interface.
AnswerD

DatabaseConnections shows active connections; VPC Flow Logs can show if traffic is allowed or denied.

Why this answer

'Connection refused' errors typically stem from either the database exhausting its maximum connections or network-level security groups blocking traffic. The RDS CloudWatch metric `DatabaseConnections` directly shows the current number of active connections against the instance's `max_connections` limit, while VPC Flow Logs capture whether packets are being accepted or rejected by security groups or network ACLs, pinpointing network blockages.

Exam trap

The trap here is that candidates confuse aggregate network metrics (like NetworkIn/NetworkOut) or CPU metrics with the specific indicators needed to differentiate between connection limits and security group denials, leading them to choose options that measure volume rather than connection state or packet acceptance.

How to eliminate wrong answers

Option A is wrong because `CPUUtilization` does not indicate connection limits or security group blocks, and CloudTrail logs record API calls (e.g., creating DB instances) not real-time connection or network failures. Option B is wrong because RDS error logs in CloudWatch Logs may show authentication or query errors but not connection limit exhaustion or network-level rejections, and the EC2 instance's system log (console output) does not capture network flow data. Option C is wrong because `NetworkIn`/`NetworkOut` show aggregate traffic volume, not whether connections are accepted or rejected, and `FreeableMemory` indicates memory pressure but not connection count or security group rules.

Full explanation →
245
MCQhard

A company's security team notices that an IAM user has been making unauthorized API calls from an IP address outside the company's VPN. The team wants to immediately block all API calls from that specific IP address for all users. Which action should be taken?

A.Create a new IAM policy that denies access from the IP address and attach it to all users.
B.Create an IAM policy that denies access from the IP address and attach it to the organization root.
C.Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.
D.Create a service control policy (SCP) that denies access from the IP address and attach it to the IAM user.
AnswerC

This is correct. A service control policy (SCP) attached to the root organizational unit applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and role sessions across all accounts.

Why this answer

A service control policy (SCP) attached to the root organizational unit (OU) applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and roles across those accounts. Option A is incorrect because attaching an IAM policy to all users only affects the current account and is not scalable for organization-wide enforcement. Option B is incorrect because IAM policies cannot be attached to an organization root; only SCPs can be applied at that level.

Option D is incorrect because SCPs cannot be attached directly to IAM users; they apply to OUs or accounts.

Full explanation →
246
MCQeasy

An organization wants to ensure that no Amazon S3 bucket in the entire AWS Organization can be made public. The security team requires a preventive control that cannot be overridden by individual account administrators. Which AWS service or feature should be used?

A.Create a Service Control Policy (SCP) in AWS Organizations that denies permissions to modify S3 bucket public access settings.
B.Enable AWS Config rules in each account to detect public S3 buckets and automatically remediate them using AWS Lambda.
C.Use an IAM policy attached to all IAM users in each account that denies s3:PutBucketPolicy.
D.Apply Amazon S3 Block Public Access at the account level in each individual AWS account.
AnswerA

A Service Control Policy (SCP) attached at the organization root or an organizational unit (OU) is inherited by every AWS account underneath, and it operates as an allow-list or denial of AWS API actions at the account level. Because SCPs are evaluated by AWS Organizations before IAM policies, even an account root user with full administrative rights cannot override an explicit deny of s3:PutBucketPolicy, s3:PutBucketAcl, or s3:PutBucketPublicAccessBlock, making it a true preventative guardrail across the entire organization. This is why the correct answer is to use SCPs rather than account-local controls.

Why this answer

A Service Control Policy (SCP) in AWS Organizations is a preventive guard that applies to all accounts within the organization. It can explicitly deny actions like s3:PutBucketPublicAccessBlock, s3:PutBucketPolicy, and s3:PutObjectAcl, preventing any principal (including root users) from making S3 buckets public. Unlike detective or account-level controls, SCPs cannot be overridden by individual account administrators, meeting the requirement for a non-overridable preventive control.

Exam trap

The trap here is that candidates often choose account-level S3 Block Public Access (Option D) because it seems like a direct preventive control, but they overlook that it can be overridden by account administrators, whereas an SCP is a centralized, non-overridable guardrail that applies across the entire AWS Organization.

How to eliminate wrong answers

Option B is wrong because AWS Config rules are detective and reactive, not preventive; they detect public buckets after the fact and can auto-remediate, but they do not block the initial action and can be overridden by account administrators. Option C is wrong because IAM policies attached to users do not apply to the root user or to services running with assumed roles, and they can be modified by account administrators, so they are not a non-overridable preventive control across the entire organization. Option D is wrong because S3 Block Public Access at the account level can be disabled or modified by any user with the necessary permissions (including account administrators), so it does not provide a centrally enforced, non-overridable control.

Full explanation →
247
MCQmedium

A company runs a production web application on a single Amazon EC2 instance. The application experiences a predictable and steady workload 24/7. The SysOps administrator wants to minimize compute costs for this instance while ensuring it remains available during the expected workload. Which EC2 purchasing option should the administrator use?

A.On-Demand Instances
B.Reserved Instances
C.Spot Instances
D.Dedicated Hosts
AnswerB

Reserved Instances offer a significant hourly discount in exchange for a one- or three-year commitment, and a Standard RI is best suited for steady-state, predictable production workloads like this always-on web app. By paying all or part of the cost upfront, you can reduce the effective hourly price by up to 72% compared to On-Demand. Because the workload is constant, the utilization will easily justify the commitment, making this the optimal cost-optimization strategy.

Why this answer

Reserved Instances (RIs) are the most cost-effective option for a predictable, steady-state workload running 24/7. By committing to a 1- or 3-year term, you receive a significant discount (up to 72%) compared to On-Demand pricing, while still ensuring the instance remains available for the expected workload. This matches the requirement to minimize compute costs without sacrificing availability.

Exam trap

The trap here is that candidates often choose Spot Instances for cost savings, overlooking the critical requirement of 'remaining available during the expected workload' — Spot Instances can be interrupted at any time, making them unsuitable for production workloads that need consistent availability.

How to eliminate wrong answers

Option A (On-Demand Instances) is wrong because, while they provide full availability, they are the most expensive option for a steady 24/7 workload and do not minimize costs. Option C (Spot Instances) is wrong because they can be terminated by AWS with a 2-minute notification when capacity is reclaimed, making them unsuitable for a production web application that must remain available during the expected workload. Option D (Dedicated Hosts) is wrong because they are designed for regulatory or licensing requirements (e.g., per-socket or per-core licensing) and are significantly more expensive than Reserved Instances, offering no cost benefit for a standard single-instance workload.

Full explanation →
Page 3

Page 4 of 4

All pages

1234

Practice SOA-C02 by domain

Target a specific domain to shore up weak areas.

Monitoring, Logging, and RemediationReliability and Business ContinuityDeployment, Provisioning, and AutomationSecurity and ComplianceNetworking and Content DeliveryCost and Performance Optimization
See all domains with question counts →