Free SOA-C02 sample questions

Correct answer: Create an AWS Lambda function that updates security groups that are associated with the elastic network interface to remove inbound rules with noncorporate CIDR ranges. Turn on VPC Flow Logs, and send the logs to Amazon CloudWatch Logs. Create an Amazon CloudWatch alarm that matches traffic from noncorporate CIDR ranges, and publish a message to an Amazon Simple Notification Service (Amazon SNS) topic with the Lambda function as a target.

Lambda functions can automatically remediate security group changes by removing non-corporate CIDR ranges when triggered by VPC Flow Logs anomalies through CloudWatch alarms. This provides automated response to unauthorized network access attempts. AWS Config provides compliance monitoring but not automated remediation, and Systems Manager scheduling lacks real-time detection capabilities.

Correct answer: Create an Amazon CloudWatch alarm for the EC2 instance, and specify the StatusCheckFailedJnstance metric. Add an EC2 action to the alarm to recover the instance. Add an alarm notification to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the SysOps team email address to the SNS topic.

CloudWatch alarms with StatusCheckFailed_Instance metric can automatically recover EC2 instances during hardware failures while preserving both private IP addresses and attached Elastic IP addresses. The EC2 recover action migrates the instance to new hardware maintaining network configuration, while Auto Scaling groups would launch new instances with different IP addresses. Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-createalarm.html

Correct answer: AWS/ApplicationELB HealthyHostCount <= 0

HealthyHostCount = 1 would trigger when at least one instance is unhealthy (not all), and EC2 StatusCheckFailed metrics monitor individual instances rather than ALB target groups.

Correct answer: Attach an S3 gateway endpoint to the VPC. Configure the route table for the private subnet.

S3 gateway endpoints allow private subnet instances to access S3 directly through the VPC without routing through internet gateways or NAT gateways, providing secure and cost-effective access. Routing private subnets through internet gateways violates network security principles, and NAT gateways in private subnets cannot provide internet access (they must be in public subnets).

Correct answers: Activate the created By tag in the account.; Analyze the usage with Cost Explorer.

Activating the createdBy tag enables cost allocation by individual developers, as AWS automatically tags resources with the IAM user who created them. Cost Explorer then allows filtering and analyzing costs by these tags to determine spending per developer. The createdBy tag is automatically populated by AWS with the IAM principal (user or role) that created the resource, making it ideal for tracking individual developer costs. Other options like aws:username require manual tagging, Owner is not an AWS-managed tag, and keyName is specific to EC2 key pairs, not general cost allocation. sequenceDiagram participant Dev as Developer participant IAM as IAM User participant AWS as AWS Service participant Tag as Cost Allocation Tag participant CE as Cost Explorer Dev->>IAM: Authenticates IAM->>AWS: Creates Resources AWS->>Tag: Auto-tags with createdBy Tag->>CE: Cost data with tags CE->>Finance: Per-developer cost reports

Activating the createdBy tag enables cost allocation by individual developers, as AWS automatically tags resources with the IAM user who created them. Cost Explorer then allows filtering and analyzing costs by these tags to determine spending per developer. The createdBy tag is automatically populated by AWS with the IAM principal (user or role) that created the resource, making it ideal for tracking individual developer costs. Other options like aws:username require manual tagging, Owner is not an AWS-managed tag, and keyName is specific to EC2 key pairs, not general cost allocation. sequenceDiagram participant Dev as Developer participant IAM as IAM User participant AWS as AWS Service participant Tag as Cost Allocation Tag participant CE as Cost Explorer Dev->>IAM: Authenticates IAM->>AWS: Creates Resources AWS->>Tag: Auto-tags with createdBy Tag->>CE: Cost data with tags CE->>Finance: Per-developer cost reports

Correct answers: Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the event source and 1AM CreateUser as the specific API call for the event pattern.; Use an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email subscription.

EventBridge rules with CloudTrail as the event source can detect IAM CreateUser API calls and trigger notifications. CloudTrail logs all API calls including IAM operations, making it the correct event source for monitoring CreateUser actions. IAM Access Analyzer is for resource sharing analysis, not API call monitoring, and CloudSearch is for search functionality, not event monitoring.

SNS topics provide email notification capabilities for EventBridge events, allowing administrators to receive alerts when IAM CreateUser API calls occur. SES is primarily for sending marketing emails or transactional emails from applications, not for event-driven notifications from AWS services.