AWS Certified SysOps Administrator – Associate (SOA-C02) Mock Test

AWS Shield Advanced provides expanded DDoS attack protection for your applications running on AWS. It offers more sophisticated automatic mitigation, visibility into attacks, and integration with AWS WAF, as well as 24x7 access to the AWS DDoS Response Team (DRT).

CMKs are the primary resources in AWS KMS. They are logical representations of a master key. CMKs are used to encrypt and decrypt data up to 4 KB in size (envelope encryption pattern for larger data) and generate data keys.

Elastic IP addresses are static IPv4 addresses designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface for any VPC in your account.

CloudTrail log file integrity validation allows you to verify that your log files have not been changed or deleted since CloudTrail delivered them to your S3 bucket. It uses industry-standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing.

AWS Budgets allows you to set custom budgets to track your cost and usage from the simplest to the most complex use cases. You can also set alerts to notify you when your costs or usage exceed (or are forecasted to exceed) your budgeted amount.

The 'Cost Optimization' category in AWS Trusted Advisor provides recommendations for reducing costs, including identifying idle or underutilized resources like EC2 instances and suggesting rightsizing.

S3 Versioning allows you to keep multiple versions of an object in the same bucket. This can help you recover from accidental deletions or overwrites.

Create an IAM policy that explicitly allows EC2 actions (e.g., `ec2:*` or specific actions like `ec2:StartInstances`, `ec2:StopInstances`) and either does not mention S3 actions or explicitly denies S3 actions. Attach this policy to the IAM user.

AWS Cost Explorer has an easy-to-use interface that lets you visualize, understand, and manage your AWS costs and usage over time. You can create custom reports to analyze cost and usage data.

A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by AWS PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service.

User data is used to perform common automated configuration tasks and even run scripts after the instance starts. You can pass user data to Amazon EC2 instances at launch.

Amazon Kinesis Data Streams is a massively scalable and durable real-time data streaming service. KDS can continuously capture gigabytes of data per second from hundreds of thousands of sources.

AWS CodeDeploy is a service that automates code deployments to various compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers. CodeDeploy makes it easier for you to rapidly release new features, helps you avoid downtime during application deployment, and handles the complexity of updating your applications.

A public subnet is a subnet that's associated with a route table that has a route to an internet gateway. A private subnet does not have a route to an internet gateway, meaning instances in it cannot directly access the internet (though they might via a NAT Gateway).

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment.

AWS Systems Manager provides a unified user interface so you can view operational data from multiple AWS services and allows you to automate operational tasks across your AWS resources. You can group resources, view operational data for monitoring and troubleshooting, and take action on your groups of resources.

Creating Read Replicas offloads read traffic from the primary instance. Using Amazon ElastiCache (e.g., Redis or Memcached) can cache frequently accessed query results, reducing database load and improving response times.

S3 bucket policies are resource-based policies that can be used to grant permissions to the bucket and its objects. They can include conditions based on IP addresses (aws:SourceIp).

The Performance Efficiency pillar includes the ability to use computing resources efficiently to meet system requirements, and to maintain that efficiency as demand changes and technologies evolve. Scalability is a key aspect of performance efficiency.

A Warm Standby strategy involves having a scaled-down but fully functional copy of your production environment in another region or AZ. This allows for a quicker failover (low RTO) and more frequent data replication (low RPO) compared to Pilot Light or Backup and Restore.

CloudWatch alarms can trigger various actions, including sending notifications to an SNS topic (which can then fan out to email, SMS, Lambda, etc.) and initiating Auto Scaling actions to add or remove EC2 instances.

CloudWatch retains metric data as follows: Data points with a period of less than 60 seconds are available for 3 hours. Data points with a period of 60 seconds (1 minute) are available for 15 days. Data points with a period of 300 seconds (5 minutes) are available for 63 days. Data points with a period of 3600 seconds (1 hour) are available for 455 days (15 months). Basic monitoring is 5 minutes.

Amazon CloudWatch Alarms can detect the failed status check and trigger an Amazon EventBridge (formerly CloudWatch Events) rule. This rule can then invoke an AWS Systems Manager Automation document or an AWS Lambda function to perform the remediation, such as rebooting or replacing the instance.

AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data and secrets management. You can store data such as passwords, database strings, Amazon Machine Image (AMI) IDs, and license codes as parameter values.

Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior to help you protect your AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence.

AWS CloudFormation allows you to model your entire infrastructure in a text file. It supports drift detection, which enables you to detect whether a stack's actual configuration has drifted from its expected template configuration.

AWS Auto Scaling helps maintain application availability and allows you to automatically scale your Amazon EC2 capacity up or down according to conditions you define. This ensures that you have the right number of instances to handle the application load, thus optimizing performance.

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It automatically assesses applications for exposure, vulnerabilities, and deviations from best practices.

Failover routing policy lets you route traffic to a resource when the resource is healthy or to a different resource when the first resource is unhealthy. This is commonly used for active-passive failover.

An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet. It serves two purposes: to provide a target in your VPC route tables for internet-routable traffic, and to perform network address translation (NAT) for instances that have been assigned public IPv4 addresses.

AWS CloudFormation gives developers and systems administrators an easy way to create and manage a collection of related AWS resources, provisioning and updating them in an orderly and predictable fashion using templates.

Analyzing historical CPUUtilization metrics in CloudWatch will help understand the pattern of high usage (e.g., constant, spikes at certain times). This informs further troubleshooting or scaling decisions.

Application Load Balancer (ALB) functions at the application layer (Layer 7) and allows you to define routing rules based on content like path, host, HTTP headers, and query string parameters.

Amazon Virtual Private Cloud (Amazon VPC) lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment.

`VolumeReadOps` and `VolumeWriteOps` are standard CloudWatch metrics for EBS volumes that track the number of read and write I/O operations, respectively. Summing them gives the total I/O operations.

Amazon RDS Multi-AZ deployments provide enhanced availability and durability for DB instances by synchronously replicating data to a standby instance in a different Availability Zone (AZ).

AWS Systems Manager State Manager is a secure and scalable configuration management service that automates the process of keeping your Amazon EC2 and hybrid infrastructure in a state that you define.

An AMI provides the information required to launch an instance. You must specify an AMI when you launch an instance. You can launch multiple instances from a single AMI when you need multiple instances with the same configuration.

Amazon RDS Read Replicas make it easy to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads. You can create one or more replicas of a given source DB Instance and serve high-volume application read traffic from multiple copies of your data.

CloudWatch Logs Insights enables you to interactively search and analyze your log data in Amazon CloudWatch Logs. You can perform queries to help you more efficiently and effectively respond to operational issues.

Change sets allow you to preview how proposed changes to a stack might impact your running resources before you implement them. CloudFormation makes the changes to your stack only when you decide to execute the change set.

S3 Intelligent-Tiering is designed to optimize storage costs automatically when data access patterns change, without performance impact or operational overhead. It moves objects between a frequent access tier and an infrequent access tier.

Spot Instances let you take advantage of unused EC2 capacity in the AWS cloud. Spot Instances are available at up to a 90% discount compared to On-Demand prices. However, AWS can reclaim Spot Instances with a two-minute notification.

An ALB can distribute traffic across instances in multiple AZs. If one AZ becomes unavailable, the ALB will route traffic to healthy instances in the remaining AZs, thus maintaining application availability.

AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. It helps with compliance auditing, security analysis, resource change tracking, and troubleshooting.

A security group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. Security groups operate at the instance level, not the subnet level. Security groups are stateful.

The CloudWatch agent can collect both system-level metrics and log files from Amazon EC2 instances and on-premises servers. It sends this data to CloudWatch Logs and CloudWatch Metrics.

An Elastic IP address is a static IPv4 address designed for dynamic cloud computing. An Elastic IP address is associated with your AWS account. With an Elastic IP address, you can mask the failure of an instance or software by rapidly remapping the address to another instance in your account.

AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services in the cloud as well as on premises.

A NAT (Network Address Translation) Gateway or NAT Instance allows instances in a private subnet to initiate outbound IPv4 traffic to the internet or other AWS services, but prevents the internet from initiating a connection with those instances.

Amazon CloudWatch allows you to create alarms that watch a single CloudWatch metric or the result of a math expression based on CloudWatch metrics. You can configure an alarm to send an Amazon SNS notification when the CPU utilization metric for an EC2 instance crosses a defined threshold for a specified period.

AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with various platforms. You can simply upload your code, and Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, and auto-scaling to application health monitoring.

VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC. This data can be published to Amazon CloudWatch Logs or Amazon S3.

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services.

AWS Transit Gateway acts as a network transit hub, allowing you to connect your Amazon Virtual Private Clouds (VPCs) and your on-premises networks through a central gateway. This simplifies your network and puts an end to complex peering relationships.

S3 server access logging provides detailed records for the requests that are made to a bucket. For object-level API activity (e.g., GetObject, PutObject, DeleteObject), AWS CloudTrail data events for S3 should be enabled.

The AppSpec file is a YAML-formatted or JSON-formatted file used by CodeDeploy to manage a deployment. It specifies the files to be copied and lifecycle event hooks to be run at different stages of the deployment.

A launch template specifies instance configuration information. It allows you to store launch parameters so that you do not have to specify them every time you launch an instance. It's used with Auto Scaling, Spot Fleets, and when launching instances manually.

Amazon EBS encryption offers a straightforward encryption solution for your EBS volumes. When you create an encrypted EBS volume and attach it to an instance, data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. This can be done using AWS-managed keys or customer-managed keys via KMS.

Amazon Route 53 is a scalable and highly available Domain Name System (DNS) web service. You can use Route 53 to route users to your infrastructure running in AWS – such as Amazon EC2 instances, Elastic Load Balancing load balancers, or Amazon S3 buckets – and can also be used to route users to infrastructure outside of AWS.

Elastic Beanstalk stores your application versions in Amazon S3. When you deploy a new version, Elastic Beanstalk packages your application files and stores them in an S3 bucket associated with your Elastic Beanstalk environment.

For infrequent or unpredictable workloads, Amazon Aurora Serverless v1 or v2 can be cost-effective as it automatically starts up, shuts down, and scales capacity up or down based on your application's needs, and you pay on a per-second basis for the database capacity you use when the database is active. Alternatively, stopping RDS instances during idle periods (if applicable) or rightsizing are also options.

AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. This can reduce network costs, increase bandwidth throughput, and provide a more consistent network experience.

Access keys should be rotated regularly to minimize the risk if they are compromised. They should not be shared, and for applications running on EC2, IAM roles are preferred over embedding access keys.

AWS Systems Manager Patch Manager automates the process of patching managed instances with both security related and other types of updates. You can use Patch Manager to apply patches for both operating systems and applications.