Hard — SOA-C02 Practice Quiz

Question 1

A SysOps administrator manages a stateless web application behind an Application Load Balancer. Leadership wants to reduce compute costs by up to 70% while maintaining high availability across three Availability Zones. The application can tolerate individual instance interruptions but must always keep at least 40 instances running to serve baseline traffic. The current Auto Scaling group uses a single On-Demand instance type. Which configuration change BEST meets these requirements?

Accepted Answer

Configure an Auto Scaling group mixed instances policy with multiple instance types across all three AZs, using capacity-optimized allocation for Spot, and set On-Demand base capacity to 40 instances with additional capacity split as Spot.

Answer

Change the launch template to request 100% Spot Instances of a single instance type and set the minimum capacity to 40 to guarantee baseline availability.

Answer

Create a separate Auto Scaling group using only Spot Instances and manually add 40 Reserved Instances outside of Auto Scaling for the baseline.

Answer

Keep On-Demand instances but enable predictive scaling and target tracking to lower the average number of running instances during off-peak hours.

Question 2

A SysOps administrator manages an EC2 Auto Scaling group behind an Application Load Balancer for a web tier. The group uses a target tracking scaling policy set to keep average CPU utilization at 50%. During a marketing event, traffic spiked and the group scaled out correctly. After the event, traffic dropped sharply, but the administrator notices the group is removing instances very slowly, keeping many instances running for a long time at low CPU. The administrator wants faster scale-in while still avoiding thrashing during brief traffic dips. What is the MOST appropriate action?

Accepted Answer

Keep target tracking but tune the scale-in behavior by lowering the default instance warmup/cooldown period to a shorter value appropriate for the workload.

Answer

Reduce the target value of the CPU target tracking policy to 30% so instances are removed sooner.

Answer

Add a scheduled scaling action to set the desired capacity to the minimum after the event window ends.

Answer

Disable the scale-in cooldown entirely and lower the instance warmup so scale-in reacts immediately.

Question 3

A financial services company runs a production workload on an Amazon Aurora MySQL cluster in us-east-1. The disaster recovery plan requires an RPO of less than 1 second and an RTO of under 5 minutes in a second Region. Management also wants the DR Region to serve low-latency read traffic for reporting users located there during normal operations. Which approach BEST meets all of these requirements?

Accepted Answer

Configure an Aurora global database with a secondary cluster in us-west-2, serving reporting reads locally and promoting the secondary during a disaster.

Answer

Enable automated Aurora snapshots and copy them to us-west-2 on a scheduled basis, restoring a new cluster there if the primary Region fails.

Answer

Create a cross-Region Aurora read replica in us-west-2 using binlog replication and manually promote it when the primary Region becomes unavailable.

Answer

Deploy the Aurora cluster as Multi-AZ across us-east-1 Availability Zones and rely on automatic failover to another AZ.

Question 4

A SysOps administrator manages an Auto Scaling group defined in a CloudFormation template. The team needs to deploy a new AMI by updating the launch template referenced in the stack. Business requirements state that during the update, at least 75% of instances must remain in service to handle live traffic, and CloudFormation should wait for each batch of replacement instances to signal successful application startup before proceeding. Which CloudFormation configuration meets these requirements?

Accepted Answer

Add an UpdatePolicy with AutoScalingRollingUpdate specifying MinInstancesInService, MaxBatchSize, and PauseTime with WaitOnResourceSignals set to true, and have the instances send cfn-signal on successful startup

Answer

Add a DeletionPolicy of Retain to the Auto Scaling group so old instances are preserved while new ones launch

Answer

Add an UpdatePolicy with AutoScalingReplacingUpdate so CloudFormation creates an entirely new Auto Scaling group before deleting the old one

Answer

Add a CreationPolicy with ResourceSignal Count and Timeout so CloudFormation waits for signals during the stack update

Question 5

A SysOps administrator manages a production application defined in an AWS CloudFormation stack. The stack includes an EC2 instance with an attached EBS data volume defined as a separate AWS::EC2::Volume resource, plus an AWS::EC2::VolumeAttachment. The team wants to change the EC2 instance type from t3.medium to m5.large by updating the template. During a change set review, they notice the instance will be replaced. The administrator must ensure that the data on the EBS data volume is NOT lost during this stack update. Which approach meets this requirement with the least risk?

Accepted Answer

The separate EBS Volume resource is not replaced by the instance-type change, so the data volume persists; verify the change set shows only the instance being replaced and the VolumeAttachment being updated, then proceed with the update.

Answer

Add a DeletionPolicy of Retain to the EC2 instance resource so CloudFormation preserves the instance and its attached data during the update.

Answer

Change the instance type in the console outside of CloudFormation to avoid triggering a replacement, then update the template afterward to match.

Answer

Add an UpdateReplacePolicy of Snapshot to the EC2 instance resource so the data volume is snapshotted before the instance is replaced.

Question 6

A SysOps administrator configures a CloudFront distribution with a custom origin pointing to an Application Load Balancer that fronts a set of virtual-hosted websites on shared EC2 instances. The web servers use the incoming Host header to decide which site content to serve. After deployment, all requests through CloudFront return a generic default site instead of the intended site content, but requests made directly to the ALB DNS name return the correct pages. What is the MOST likely cause and fix?

Accepted Answer

CloudFront is forwarding its own distribution domain in the Host header; create a cache policy/origin request policy that includes the Host header so the origin receives the viewer's requested hostname.

Answer

The ALB listener rules are misconfigured; add a fixed-response rule that returns the correct site based on the path pattern.

Answer

The distribution's TTL is too high; lower the minimum TTL to 0 so CloudFront revalidates and picks up the correct virtual host.

Answer

The origin protocol policy is set to HTTP only; switch it to HTTPS only so the SNI hostname is passed to the web servers.

Question 7

A SysOps administrator publishes a high-resolution custom metric to CloudWatch with a storage resolution of 1 second to monitor a latency-sensitive trading application. After two weeks, a colleague reports that when querying the metric over a 90-day period, the 1-second data points are no longer available and only coarser aggregations appear. What is the reason for this behavior?

Accepted Answer

CloudWatch automatically aggregates high-resolution metrics into coarser resolutions over time and retains data for a total of 15 months, but sub-minute data is only kept for 3 hours.

Answer

High-resolution custom metrics are only retained for 3 hours before being deleted entirely from CloudWatch.

Answer

Custom metrics must be re-published with a metric filter to preserve high-resolution data beyond 7 days.

Answer

High-resolution metrics require Detailed Monitoring to be enabled, otherwise all data points are discarded after 24 hours.

Question 8

A SysOps administrator is investigating intermittent slowness on a production application running on a single EC2 instance backed by a General Purpose SSD (gp2) EBS volume. CloudWatch shows the instance's CPUUtilization is consistently below 40%, but users report the application stalls during peak hours. Which combination of EBS CloudWatch metrics should the administrator examine FIRST to confirm whether the volume is the bottleneck?

Accepted Answer

BurstBalance together with VolumeQueueLength to determine if I/O credits are exhausted and requests are queuing

Answer

VolumeReadOps and VolumeWriteOps only, comparing them against the instance's network throughput baseline

Answer

VolumeIdleTime and VolumeTotalReadTime to confirm the volume is under-provisioned for storage capacity

Answer

StatusCheckFailed_System and StatusCheckFailed_Instance to detect underlying hardware degradation

Question 9

A SysOps administrator configures a CloudWatch alarm on the RequestCount metric of an Application Load Balancer to detect when a downstream application stops receiving traffic (a value of 0). During periods of very low activity, the ALB publishes no data points for RequestCount at all, and the administrator notices the alarm sits in INSUFFICIENT_DATA instead of alerting on the traffic drop. The alarm must reliably enter the ALARM state and notify an SNS topic when request traffic falls to zero. Which configuration change should the administrator make?

Accepted Answer

Set the alarm's 'Treat missing data as' setting to 'breaching' and configure the threshold to trigger when the value is less than or equal to 0.

Answer

Enable detailed monitoring on the ALB so that RequestCount reports data points every minute even when there is no traffic.

Answer

Configure the alarm's 'Treat missing data as' setting to 'ignore' so the last known state is retained until traffic resumes.

Answer

Increase the alarm evaluation period to 15 minutes so that a data point is guaranteed to be present within each evaluation window.

Question 10

A SysOps administrator manages a fleet of EC2 instances running a custom application. Occasionally the application process hangs while the instance itself remains healthy (both EC2 status checks pass). The team publishes a custom CloudWatch metric named ApplicationHeartbeat every 60 seconds; a healthy process reports a value of 1, and no data point is published when the process hangs. The administrator needs an automated solution that restarts the application service on the affected instance without human intervention. Which approach meets this requirement?

Accepted Answer

Create a CloudWatch alarm on the ApplicationHeartbeat metric that treats missing data as breaching, and configure the alarm action to trigger a Systems Manager Automation runbook (or SSM Run Command) that restarts the application service on the instance.

Answer

Create a CloudWatch alarm on the EC2 StatusCheckFailed metric and configure the EC2 recovery action to recover the instance.

Answer

Create a CloudWatch alarm on the ApplicationHeartbeat metric and set the alarm action to an Auto Scaling policy that adds one instance to the group.

Answer

Enable detailed monitoring on the instances and rely on the default CloudWatch agent to detect and restart the hung process automatically.

Question 11

A development team runs a high-volume order-processing function on AWS Lambda. They want to publish custom business metrics (such as orders processed and payment failures) to CloudWatch without adding synchronous PutMetricData API calls that increase function duration and cost. The metrics must also remain queryable alongside the detailed structured log context that produced them. What is the MOST efficient way to meet these requirements?

Accepted Answer

Write log entries using the CloudWatch Embedded Metric Format (EMF) to stdout so CloudWatch automatically extracts the custom metrics from the structured logs.

Answer

Call the CloudWatch PutMetricData API asynchronously at the end of each invocation to publish the custom metrics.

Answer

Create a CloudWatch Logs metric filter on the Lambda log group to match plain-text log lines and increment custom metrics.

Answer

Install the CloudWatch agent as a Lambda extension and configure it to collect StatsD metrics from the function.

Question 12

A SysOps administrator manages an EC2 Auto Scaling group behind an Application Load Balancer for a Java application. Each instance takes about 12 minutes to fully bootstrap because it downloads dependencies, warms a large cache, and initializes the JVM before it can serve traffic. During sudden traffic spikes, target tracking scaling launches new instances, but customers experience elevated latency and errors for several minutes while the new instances complete initialization. The administrator must reduce the time it takes for scaled-out instances to begin serving requests while minimizing ongoing cost. What should the administrator do?

Accepted Answer

Configure a warm pool for the Auto Scaling group with instances kept in the Stopped state so pre-initialized instances can be resumed and added to service quickly during scale-out.

Answer

Reduce the target tracking target value so instances launch earlier, giving the 12-minute bootstrap process time to finish before capacity is needed.

Answer

Switch the scaling policy from target tracking to simple scaling with a shorter cooldown period to launch replacement instances faster.

Answer

Increase the ALB health check interval and unhealthy threshold so new instances are not marked unhealthy while still initializing.

Question 13

A SysOps administrator must allow a team of application developers to create new IAM roles for their Lambda functions. Security policy requires that any role the developers create must never be able to grant permissions beyond a defined set of services (Lambda, DynamoDB, and CloudWatch Logs), even if the developer attaches broader policies. The developers should still be able to create and manage roles independently. What is the MOST effective way to enforce this constraint?

Accepted Answer

Grant the developers iam:CreateRole permission with a condition requiring that a specific permissions boundary policy be attached to every role they create.

Answer

Attach a permissions boundary policy to the developers' IAM role that limits their own actions to the three services.

Answer

Create a Service Control Policy (SCP) on the account that denies all API calls outside Lambda, DynamoDB, and CloudWatch Logs.

Answer

Use IAM Access Analyzer to continuously scan created roles and automatically detach any policy granting excessive permissions.

Question 14

A SysOps administrator is configuring an IAM role that a third-party SaaS monitoring vendor will assume to read CloudWatch metrics in the company's AWS account. The vendor manages a single AWS account that they use to access many of their customers' accounts. The security team is concerned that another of the vendor's customers could trick the vendor into accessing this company's account. Which configuration best mitigates this confused deputy risk?

Accepted Answer

Add a condition to the role's trust policy requiring an sts:ExternalId value that the vendor supplies uniquely for this customer

Answer

Attach a permission boundary to the role that limits it to CloudWatch read-only actions

Answer

Require MFA in the trust policy by adding an aws:MultiFactorAuthPresent condition

Answer

Restrict the trust policy principal to the vendor's account ID only

Question 15

A SysOps administrator must prove to auditors that a specific Lambda function is the only workload decrypting sensitive records with a customer managed KMS key, and that each decryption request can be tied to a particular tenant. The team currently uses a shared symmetric CMK. Which approach best meets these requirements with the least custom code?

Accepted Answer

Have the Lambda function pass an encryption context (e.g., tenant ID) on every Encrypt and Decrypt call, restrict the key policy/IAM to the Lambda role, and review the encryption context recorded in AWS CloudTrail.

Answer

Enable automatic key rotation on the CMK and rely on the rotated key versions to distinguish each tenant's decryption requests in CloudTrail.

Answer

Store each tenant's data key in AWS Secrets Manager and grant the Lambda function read access, using Secrets Manager rotation to audit access per tenant.

Answer

Create a separate IAM user for each tenant with inline decrypt permissions and require the Lambda function to assume the matching user before decrypting.

Question 16

A media company must serve users in Germany from an EU-based origin to comply with data residency regulations, regardless of which endpoint offers the lowest network latency. Users everywhere else should be directed to the nearest of three regional endpoints for the best performance. Which Route 53 configuration meets both requirements?

Accepted Answer

Create a geolocation routing policy with a record for Germany pointing to the EU endpoint, and use latency-based records within a broader configuration for all other locations plus a default record.

Answer

Use latency-based routing for all endpoints and rely on AWS to keep German traffic within the EU region.

Answer

Use weighted routing, assigning 100% weight to the EU endpoint for German users and distributing remaining weight across other endpoints.

Answer

Use a geoproximity routing policy with a positive bias applied to the EU endpoint so all traffic prefers it.

Question 17

A SysOps administrator manages a multi-account AWS Organization. The security team requires that developers in a member account can create IAM roles for their applications, but those created roles must never be able to modify billing, leave the organization, or access CloudTrail settings. Additionally, the developers themselves must never be able to grant more permissions than a defined maximum, even when creating new roles. Which combination of controls correctly enforces these requirements?

Accepted Answer

Attach a Service Control Policy (SCP) to the member account's OU to deny the sensitive actions, and require developers to attach a permission boundary to every IAM role they create.

Answer

Attach an identity-based policy to each developer denying the sensitive actions, and rely on IAM Access Analyzer to block role creation that exceeds the maximum.

Answer

Create an SCP that allows only the specific developer actions and attach it directly to each developer IAM user in the member account.

Answer

Use a resource-based policy on the CloudTrail and billing services to deny developer access, and enable MFA for all role creation operations.

Question 18

A SysOps administrator deploys an EC2 web server in a public subnet. The security group allows inbound TCP 443 from 0.0.0.0/0 but has NO outbound rules configured (all outbound rules were removed). The associated network ACL uses the default allow-all rules. Users report they cannot receive responses when connecting to the web server over HTTPS. What is the MOST likely cause and the correct fix?

Accepted Answer

Security groups are stateful, so return traffic is automatically allowed regardless of outbound rules; the real problem must be the route table missing an internet gateway route.

Answer

Security groups are stateful, so removing all outbound rules blocks the return traffic; add an outbound rule allowing the response traffic (or restore the default allow-all outbound rule).

Answer

The network ACL is blocking ephemeral return ports; add an inbound NACL rule for ports 1024-65535.

Answer

The inbound rule must specify the client's ephemeral source ports instead of 0.0.0.0/0; change the inbound rule to allow TCP 1024-65535.

Question 19

A company runs 12 VPCs across a single AWS Region, all attached to a Transit Gateway. To reduce cost and management overhead, the networking team deployed a single 'egress' VPC containing a NAT gateway and an internet gateway, and they want all private subnets in the 12 spoke VPCs to reach the internet through this shared egress VPC. Instances in the spoke VPCs currently cannot reach the internet. The Transit Gateway attachments and association/propagation appear correct. Which additional configuration is required to make centralized internet egress work?

Accepted Answer

In each spoke VPC's private subnet route table, add a default route (0.0.0.0/0) pointing to the Transit Gateway; in the egress VPC, add a Transit Gateway route table static route for the spoke CIDRs and route 0.0.0.0/0 to the NAT gateway.

Answer

Enable VPC peering between each spoke VPC and the egress VPC in addition to the Transit Gateway attachments.

Answer

Attach an internet gateway to each of the 12 spoke VPCs and add a 0.0.0.0/0 route to it in the private subnets.

Answer

Enable appliance mode on the spoke VPC attachments and add the NAT gateway to each spoke VPC's route table.

Question 20

A company connects three VPCs (Production, Development, and Shared-Services) to a single AWS Transit Gateway. The requirement is that Production and Development must NOT be able to reach each other, but both must be able to communicate with Shared-Services. A SysOps administrator has attached all three VPCs to the Transit Gateway. Which configuration meets the requirement?

Accepted Answer

Use two Transit Gateway route tables: associate Production and Development with one route table that only has a route (via propagation) to Shared-Services, and associate Shared-Services with a second route table that has propagated routes to both Production and Development.

Answer

Enable route propagation for all three attachments into the default Transit Gateway route table and rely on VPC security groups to block Production-to-Development traffic.

Answer

Create a single Transit Gateway route table, associate all three attachments, and add a blackhole route between the Production and Development CIDRs.

Answer

Establish VPC peering between Production and Shared-Services and between Development and Shared-Services instead of using the Transit Gateway.

Question 21

A SysOps administrator is troubleshooting an application server in a private subnet that intermittently fails to complete requests to a third-party payment API over the internet. The instance's outbound path uses a NAT gateway. VPC Flow Logs for the instance's ENI show records with ACCEPT for the outbound TCP connections to the API's IP, but there are NO corresponding inbound ACCEPT or REJECT records for the return traffic. The security group is stateful and allows all outbound traffic. What is the MOST likely cause of the missing return traffic?

Accepted Answer

The NAT gateway has reached its port allocation limit for the destination, so the return packets never arrive at the instance's ENI and are not logged.

Answer

A network ACL on the private subnet is denying the inbound return traffic on ephemeral ports, causing the response packets to be dropped before reaching the ENI.

Answer

The security group is blocking the inbound response because security groups are stateless and require an explicit inbound rule for return traffic.

Answer

VPC Flow Logs only capture outbound traffic for instances behind a NAT gateway, so the absence of inbound records is expected behavior and not an issue.