Free Practice Questions for Amazon Web Services SOA-C02 Exam

Scenario Analysis:

The EC2 instance is inaccessible through RDP due to misconfigured Windows Firewall settings.

The boot volume is encrypted, which restricts direct modification without proper mounting and decryption tools.

The goal is to back up the instance and regain RDP connectivity.

Why Option D is Correct:

AWS provides EC2Rescue for Windows Server as a tool to resolve common connectivity and boot issues for Windows EC2 instances.

The process of detaching the boot volume and attaching it to another instance ensures that the misconfigured instance does not impede further configuration.

The working instance acts as a recovery environment where EC2Rescue can be run to modify the Windows Firewall settings and allow RDP access.

Steps to Resolve the Issue (Following Option D):

Step 1: Stop the instance.In the EC2 console, select the affected instance and stop it to ensure safe operations.

Step 2: Detach the boot volume.Navigate to the instance's storage section, identify the boot volume (usually /dev/sda1), and detach it.

Step 3: Attach the boot volume to a recovery instance.

Identify a working instance that has EC2Rescue installed.

Attach the detached boot volume to the recovery instance as a secondary volume.

Step 4: Run EC2Rescue to fix Windows Firewall settings.

Log in to the recovery instance and launch EC2Rescue.

Select the attached secondary volume and run diagnostics or select specific repairs (e.g., enabling RDP access in Windows Firewall settings).

Step 5: Detach the boot volume from the recovery instance.After applying the fix, safely detach the volume from the recovery instance.

Step 6: Reattach the boot volume to the original instance.Attach the volume back to the original instance as its boot volume.

Step 7: Start the instance and verify connectivity.Start the original instance and attempt to connect via RDP using the instance's public or private IP (depending on the network configuration).

AWS References and Best Practices:

EC2Rescue for Windows Server:Official documentation: EC2Rescue

Encrypted EBS Volumes:Ensure the proper use of the same AWS KMS key when attaching encrypted volumes to other instances. Reference: EBS Encryption

Backup Before Modifications:AWS recommends creating snapshots of EBS volumes before making changes. Reference: Creating EBS Snapshots

Why Other Options Are Incorrect:

Option A: AWS does not support disabling encryption for EBS volumes directly. Additionally, creating a new key pair does not address the firewall misconfiguration.

Option B: Amazon Inspector does not provide tools for modifying Windows Firewall settings. It is primarily used for vulnerability assessments.

Option C: Disabling encryption is not supported, and Amazon Inspector cannot fix firewall issues.

To handle the increased message load with minimal operational effort, implementing an Amazon Simple Queue Service (SQS) queue between the frontend and backend is an ideal solution. SQS decouples the frontend and backend by queuing messages, enabling the backend to process messages at its own pace without losing any.

SQS Queue: Acts as a buffer, ensuring messages are not lost if the backend application cannot immediately process them.

Decoupling: With SQS, the frontend can continue sending messages without concern for the backend's processing speed, providing a scalable solution with minimal management requirements.

Low Operational Overhead: SQS is fully managed, reducing the need for infrastructure management.

Monitoring EC2 Instances with CloudWatch:

Amazon CloudWatch provides monitoring and alarms for AWS resources.

Alarms can be created for metrics like CPUUtilization, and notifications can be sent to Amazon SNS topics.

Steps to Set Up the Solution:

Create an SNS Topic:

Open the Amazon SNS Console.

Create a topic (e.g., "CPU_Alerts").

Add subscriptions for the development team's email addresses.

Create a CloudWatch Alarm:

Open the CloudWatch Console.

Navigate to the Alarms section and select Create Alarm.

Choose the EC2 CPUUtilization metric and set the alarm conditions:

Metric: Average CPU Utilization

Threshold: 80%

Period: 5 minutes

Link the alarm to the SNS topic for notifications.

Test the Alarm:

Simulate high CPU utilization to verify that alerts are sent to the subscribed email addresses.

Why Other Options Are Incorrect:

A and B: Using Amazon SES directly for alerts is not a standard practice for operational efficiency or integration with CloudWatch.

C: Using "sum" instead of "average" for CPU utilization is not appropriate for real-time monitoring, as it aggregates data over a large interval.

To monitor the p90 (90th percentile) statistic of a specific field in log data over time, the appropriate approach is to create a metric filter on the log data. Metric filters in Amazon CloudWatch Logs allow you to extract metric data from log events and transform them into CloudWatch metrics. These metrics can then be visualized and analyzed over time.

Starting from May 23, 2019, CloudWatch Logs introduced support for percentiles in metric filters. This enhancement enables users to specify percentile statistics, such as p90, p95, p99, etc., when defining metric filters. By doing so, you can gain insights into the distribution of your metric data, which is particularly useful for understanding outliers or unusual behaviors in metrics like application latency.

Once the metric filter is set up to extract the desired field (e.g., application latency) and compute the p90 statistic, you can visualize this metric in CloudWatch Dashboards or set up alarms based on threshold values.

AWS Global Accelerator:

AWS Global Accelerator is a service that improves the availability and performance of your applications with a global user base. It provides static IP addresses that act as a fixed entry point to your application endpoints (such as ALBs).

Steps:

Go to the AWS Management Console.

Navigate to Global Accelerator.

Click on "Create accelerator."

Configure the accelerator by providing a name and adding listeners.

Add your Application Load Balancer as an endpoint.

Allocate two static IP addresses.

This setup ensures that your application is accessible via two static IP addresses, fulfilling the requirement.

AWS Global Accelerator

When an EC2 instance stops responding and the system status checks are failing, the recommended first step is to stop and then start the instance. This action will cause the instance to be moved to a new host, potentially resolving the underlying hardware issue.

Stop and Start the Instance:

In the AWS Management Console, navigate to the EC2 dashboard and stop the affected instance.

After the instance has stopped, start it again to launch it on a new host.

Implement an Amazon CloudFront distribution to offload the traffic from the Auto Scaling group does not breach the requirement of no changes in the network infrastructure. Reason is that cloudfront is a distribution that allows you to distribute content using a worldwide network of edge locations that provide low latency and high data transfer speeds. It plug in to existing setup, not changes to it.

To enforce compliance with tagging policies in real-time:

AWS Config Setup: Implement an AWS Config rule to continuously monitor and evaluate EC2 instances for compliance with the tagging requirements. The required-tags managed rule can be configured to specifically check for the presence of a 'department' tag.

Automatic Remediation: Configure AWS Config to automatically execute the AWS-TerminateEC2Instance Systems Manager Automation document as a remediation action. This runbook will terminate any EC2 instance identified as noncompliant due to missing required tags.

Operational Efficiency: This setup allows for the enforcement of company tagging policies automatically and in near real-time, reducing the manual overhead of monitoring and ensuring compliance.

This method provides an efficient and effective solution to ensure that all EC2 instances meet the company's tagging requirements and that any noncompliant instances are dealt with promptly.

The question outlines a requirement to:

Back up a DynamoDB table automatically every 24 hours

Move those backups to cold storage after 30 days

Encrypt the backups using a customizable KMS key

From the AWS Backup Documentation for DynamoDB:

AWS Backup supports automated backup scheduling, lifecycle policies, and backup encryption using customer-managed KMS keys.

Cold storage transition is supported after 30 days minimum, and it reduces backup storage costs.

To use customer-managed keys, specify the key when creating a backup vault, which then applies to all backups stored in that vault.

❌ Why the other options are incorrect:

A and B: There is no native "DynamoDB backup job" service outside of AWS Backup that supports lifecycle policies or cold storage.

D: Uses AWS-managed KMS key, which doesn't meet the customizable key policy requirement.

To optimize the cost of a workload running in multiple AWS Regions using AWS Lambda and EC2 On-Demand Instances, the SysOps administrator should purchase Compute Savings Plans based on the usage during the past 30 days.

Compute Savings Plans:

Compute Savings Plans provide the most flexibility and can be applied across various compute services such as EC2, AWS Lambda, and Fargate.

They offer significant savings compared to On-Demand pricing.

Analysis and Purchase:

Analyze the compute usage over the past 30 days to determine the baseline usage.

Purchase Compute Savings Plans based on this baseline to maximize savings while maintaining flexibility across different regions and compute services.