Amazon SOA-C02 Practice Exams
Last updated on Oct 21,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 21,2026
Question #1
A SysOps administrator needs to monitor a process that runs on Linux Amazon EC2 instances. If the process stops, the process must restart automatically. The Amazon CloudWatch agent is already installed on all the EC2 Instances.
Which solution will meet these requirements?
- A . Add a procstat monitoring configuration to the CloudWatch agent for the process. Create an Amazon EventBridge event rule that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.
- B . Add a StatsD monitoring configuration to the CloudWatch agent for the process. Create a CloudWatch alarm that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.
- C . Add a StatsD monitoring configuration to the CloudWatch agent for the process. Create an Amazon EventBridge event rule that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.
- D . Add a procstat monitoring configuration to the CloudWatch agent for the process. Create a CloudWatch alarm that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.
Correct Answer: A
A
Explanation:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-procstat-process-metrics.html
A
Explanation:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-procstat-process-metrics.html
Question #2
A company wants to collect data from an application to use for analytics. For the first 90 days, the data will be infrequently accessed but must remain highly available. During this time, the company’s analytics team requires access to the data in milliseconds. However, after 90 days, the company must retain the data for the long term at a lower cost. The retrieval time after 90 days must be less than 5 hours.
Which solution will meet these requirements MOST cost-effectively?
- A . Store the data in S3 Standard-Infrequent Access (S3 Standard-IA) for the first 90 days. Set up an S3 Lifecycle rule to move the data to S3 Glacier Flexible Retrieval after 90 days.
- B . Store the data in S3 One Zone-Infrequent Access (S3 One Zone-IA) for the first 90 days. Set up an
S3 Lifecycle rule to move the data to S3 Glacier Deep Archive after 90 days. - C . Store the data in S3 Standard for the first 90 days. Set up an S3 Lifecycle rule to move the data to
S3 Glacier Flexible Retrieval after 90 days. - D . Store the data in S3 Standard for the first 90 days. Set up an S3 Lifecycle rule to move the data to
S3 Glacier Deep Archive after 90 days.
Correct Answer: C
C
Explanation:
To meet the requirements for data storage and retrieval, the most cost-effective solution is to store the data in S3 Standard for the first 90 days and set up an S3 Lifecycle rule to move the data to S3 Glacier Flexible Retrieval after 90 days.
S3 Standard:
Provides high availability and low latency access.
Suitable for frequently accessed data.
S3 Lifecycle Rule:
Set up a lifecycle rule to transition the data from S3 Standard to S3 Glacier Flexible Retrieval after 90 days.
S3 Glacier Flexible Retrieval offers low-cost archival storage with retrieval times ranging from minutes to hours, which meets the requirement of less than 5 hours.
Implementation Steps:
Open the S3 console.
Select the bucket and navigate to "Management" -> "Lifecycle rules."
Create a new lifecycle rule to transition objects from S3 Standard to S3 Glacier Flexible Retrieval after 90 days.
Reference: Amazon S3 Storage Classes
S3 Lifecycle Configuration
C
Explanation:
To meet the requirements for data storage and retrieval, the most cost-effective solution is to store the data in S3 Standard for the first 90 days and set up an S3 Lifecycle rule to move the data to S3 Glacier Flexible Retrieval after 90 days.
S3 Standard:
Provides high availability and low latency access.
Suitable for frequently accessed data.
S3 Lifecycle Rule:
Set up a lifecycle rule to transition the data from S3 Standard to S3 Glacier Flexible Retrieval after 90 days.
S3 Glacier Flexible Retrieval offers low-cost archival storage with retrieval times ranging from minutes to hours, which meets the requirement of less than 5 hours.
Implementation Steps:
Open the S3 console.
Select the bucket and navigate to "Management" -> "Lifecycle rules."
Create a new lifecycle rule to transition objects from S3 Standard to S3 Glacier Flexible Retrieval after 90 days.
Reference: Amazon S3 Storage Classes
S3 Lifecycle Configuration
Question #3
A new application runs on Amazon EC2 instances and accesses data in an Amazon RDS database instance. When fully deployed in production, the application fails. The database can be queried from a console on a bastion host.
When looking at the web server logs, the following error is repeated multiple times:
"** Error Establishing a Database Connection
Which of the following may be causes of the connectivity problems? {Select TWO.)
- A . The security group for the database does not have the appropriate egress rule from the database to the web server.
- B . The certificate used by the web server is not trusted by the RDS instance.
- C . The security group for the database does not have the appropriate ingress rule from the web server to the database.
- D . The port used by the application developer does not match the port specified in the RDS configuration.
- E . The database is still being created and is not available for connectivity.
Correct Answer: CD
CD
Explanation:
The connectivity issues could be due to:
Security Group Ingress Rules:
Ensure that the security group for the RDS database has the correct ingress rules allowing traffic from the web server’s security group or IP address.
Go to the RDS console, select your database instance, and check the security groups.
In the security group settings, verify that the correct port (usually 3306 for MySQL) is open for the web server’s IP or security group.
Port Configuration:
Verify that the application is configured to use the correct port that matches the RDS database configuration.
Check the application configuration files to ensure the port number matches the port specified in the RDS instance.
Reference: Amazon RDS Security Groups
Troubleshooting RDS Connectivity
CD
Explanation:
The connectivity issues could be due to:
Security Group Ingress Rules:
Ensure that the security group for the RDS database has the correct ingress rules allowing traffic from the web server’s security group or IP address.
Go to the RDS console, select your database instance, and check the security groups.
In the security group settings, verify that the correct port (usually 3306 for MySQL) is open for the web server’s IP or security group.
Port Configuration:
Verify that the application is configured to use the correct port that matches the RDS database configuration.
Check the application configuration files to ensure the port number matches the port specified in the RDS instance.
Reference: Amazon RDS Security Groups
Troubleshooting RDS Connectivity
Question #4
A company needs to view a list of security groups that are open to the internet on port 3389.
What should a SysOps administrator do to meet this requirement?
- A . Configure Amazon GuardDuly to scan security groups and report unrestricted access on port 3389.
- B . Configure a service control policy (SCP) to identify security groups that allow unrestricted access on port 3389
- C . Use AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.
- D . Use AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389.
Correct Answer: D
D
Explanation:
To find security groups that are open to the internet on port 3389, using AWS Trusted Advisor is the most straightforward solution.
AWS Trusted Advisor:
AWS Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices.
It includes a security check that identifies security groups with unrestricted access.
Steps to Use Trusted Advisor:
Open the AWS Trusted Advisor console.
In the "Security" category, look for the check that identifies security groups with unrestricted access. Review the report to find security groups that allow unrestricted access on port 3389 (RDP).
Reference: AWS Trusted Advisor
AWS Trusted Advisor Best Practices
D
Explanation:
To find security groups that are open to the internet on port 3389, using AWS Trusted Advisor is the most straightforward solution.
AWS Trusted Advisor:
AWS Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices.
It includes a security check that identifies security groups with unrestricted access.
Steps to Use Trusted Advisor:
Open the AWS Trusted Advisor console.
In the "Security" category, look for the check that identifies security groups with unrestricted access. Review the report to find security groups that allow unrestricted access on port 3389 (RDP).
Reference: AWS Trusted Advisor
AWS Trusted Advisor Best Practices
Question #5
A company has a critical serverless application that uses multiple AWS Lambda functions. Each Lambda function generates 1 GB of log data daily in tts own Amazon CloudWatch Logs log group. The company’s security team asks for a count of application errors, grouped by type, across all of the log groups.
What should a SysOps administrator do to meet this requirement?
- A . Perform a CloudWatch Logs Insights query that uses the stats command and count function.
- B . Perform a CloudWatch Logs search that uses the groupby keyword and count function.
- C . Perform an Amazon Athena query that uses the SELECT and GROUP BY keywords.
- D . Perform an Amazon RDS query that uses the SELECT and GROUP BY keywords.
Correct Answer: A
A
Explanation:
To count application errors grouped by type across all CloudWatch Logs log groups, use CloudWatch Logs Insights.
Steps:
Access CloudWatch Logs Insights:
Open the CloudWatch console and navigate to Logs Insights.
Reference: Analyzing Log Data with CloudWatch Logs Insights Perform the Query:
Use the following query to count errors grouped by type:
sql
Copy code
fields @timestamp, @message
| filter @message like /error/
| stats count(*) by @message
This query filters for log messages containing the word "error" and counts occurrences grouped by the message content.
Run the Query Across Log Groups:
Select the log groups for all Lambda functions and run the query.
Reference: CloudWatch Logs Insights Query Syntax
Analyze Results:
Analyze the query results to get a count of application errors grouped by type.
Reference: Using CloudWatch Logs Insights
This method provides an efficient way to analyze and count application errors across multiple log
groups.
A
Explanation:
To count application errors grouped by type across all CloudWatch Logs log groups, use CloudWatch Logs Insights.
Steps:
Access CloudWatch Logs Insights:
Open the CloudWatch console and navigate to Logs Insights.
Reference: Analyzing Log Data with CloudWatch Logs Insights Perform the Query:
Use the following query to count errors grouped by type:
sql
Copy code
fields @timestamp, @message
| filter @message like /error/
| stats count(*) by @message
This query filters for log messages containing the word "error" and counts occurrences grouped by the message content.
Run the Query Across Log Groups:
Select the log groups for all Lambda functions and run the query.
Reference: CloudWatch Logs Insights Query Syntax
Analyze Results:
Analyze the query results to get a count of application errors grouped by type.
Reference: Using CloudWatch Logs Insights
This method provides an efficient way to analyze and count application errors across multiple log
groups.
Question #6
A SysOps administrator is responsible for more than 50 Amazon EC2 instances mat are deployed in a single production AWS account The EC2 instances are running several different operating systems The company’s standards require patching to be completed at least once a month.
The SysOps administrator wants to use AWS Systems Manager to reduce the number of hours the company spends on operating system patching each month.
Which combination of steps should the SysOps administrator take to meet these requirements? (Select THREE.)
- A . Group similar EC2 instances together into resource groups by using AWS Resource Groups
- B . Create a schedule in Systems Manager Patch Manager. Specify the appropriate resource group as the target
- C . Specify Systems Manager Automation runbooks to patch the operating systems. Register the runbooks as tasks in the maintenance window. Specify the appropriate resource group as the target
- D . Create a Systems Manager Automation runbook to monitor and control the state of the patches required. Apply the runbook to Systems Manager Patch Manager
- E . Create a single Systems Manager maintenance window for each resource group.
- F . Configure Systems Manager Fleet Manager to apply a Systems Manager Automation runbook to the appropriate resource group.
Correct Answer: A, B, E
A, B, E
Explanation:
Group EC2 Instances Using Resource Groups:
Resource groups help organize and manage AWS resources based on tags and other criteria.
Steps:
Go to the AWS Management Console.
Navigate to AWS Resource Groups.
Create resource groups for similar EC2 instances based on tags or other criteria.
Reference: AWS Resource Groups
Create a Schedule in Patch Manager:
AWS Systems Manager Patch Manager automates the process of patching managed instances.
Steps:
Go to the AWS Management Console.
Navigate to Systems Manager and select Patch Manager.
Create a patch baseline if not already created.
Create a schedule for patching and specify the resource group as the target.
Reference: AWS Systems Manager Patch Manager
Create Maintenance Windows for Resource Groups:
Maintenance windows define a period of time for performing administrative tasks on instances.
Steps:
Go to the AWS Management Console.
Navigate to Systems Manager and select Maintenance Windows.
Create a maintenance window for each resource group.
Specify tasks and targets (resource groups) for each maintenance window.
Reference: AWS Systems Manager Maintenance Windows
A, B, E
Explanation:
Group EC2 Instances Using Resource Groups:
Resource groups help organize and manage AWS resources based on tags and other criteria.
Steps:
Go to the AWS Management Console.
Navigate to AWS Resource Groups.
Create resource groups for similar EC2 instances based on tags or other criteria.
Reference: AWS Resource Groups
Create a Schedule in Patch Manager:
AWS Systems Manager Patch Manager automates the process of patching managed instances.
Steps:
Go to the AWS Management Console.
Navigate to Systems Manager and select Patch Manager.
Create a patch baseline if not already created.
Create a schedule for patching and specify the resource group as the target.
Reference: AWS Systems Manager Patch Manager
Create Maintenance Windows for Resource Groups:
Maintenance windows define a period of time for performing administrative tasks on instances.
Steps:
Go to the AWS Management Console.
Navigate to Systems Manager and select Maintenance Windows.
Create a maintenance window for each resource group.
Specify tasks and targets (resource groups) for each maintenance window.
Reference: AWS Systems Manager Maintenance Windows
Question #7
A company’s customers are reporting increased latency while accessing static web content from Amazon S3 A SysOps administrator observed a very high rate of read operations on a particular S3 bucket
What will minimize latency by reducing load on the S3 bucket?
- A . Migrate the S3 bucket to a region that is closer to end users’ geographic locations
- B . Use cross-region replication to replicate all of the data to another region
- C . Create an Amazon CloudFront distribution with the S3 bucket as the origin.
- D . Use Amazon ElastiCache to cache data being served from Amazon S3
Correct Answer: C
C
Explanation:
To minimize latency and reduce the load on an Amazon S3 bucket serving static web content, creating an Amazon CloudFront distribution with the S3 bucket as the origin is the most effective solution.
Amazon CloudFront:
CloudFront is a content delivery network (CDN) that caches copies of your content at edge locations around the world, reducing latency by serving content closer to end users.
By using CloudFront, you can offload the read operations from your S3 bucket to the edge locations, reducing the load on the bucket.
Creating a CloudFront Distribution:
Go to the CloudFront console and click "Create Distribution."
Select "Web" as the delivery method and specify the S3 bucket as the origin.
Configure the distribution settings, including cache behaviors and restrictions if needed.
Once the distribution is deployed, update your application to use the CloudFront URL for accessing static content.
Reference: Amazon CloudFront
Creating a CloudFront Distribution
C
Explanation:
To minimize latency and reduce the load on an Amazon S3 bucket serving static web content, creating an Amazon CloudFront distribution with the S3 bucket as the origin is the most effective solution.
Amazon CloudFront:
CloudFront is a content delivery network (CDN) that caches copies of your content at edge locations around the world, reducing latency by serving content closer to end users.
By using CloudFront, you can offload the read operations from your S3 bucket to the edge locations, reducing the load on the bucket.
Creating a CloudFront Distribution:
Go to the CloudFront console and click "Create Distribution."
Select "Web" as the delivery method and specify the S3 bucket as the origin.
Configure the distribution settings, including cache behaviors and restrictions if needed.
Once the distribution is deployed, update your application to use the CloudFront URL for accessing static content.
Reference: Amazon CloudFront
Creating a CloudFront Distribution
Question #8
A SysOps administrator is managing a Memcached cluster in Amazon ElastiCache. The cluster has been heavily used recently, and the administrator wants to use a larger instance type with more memory.
What should the administrator use to make this change?
- A . Use the ModifycacheCluster API and specify a new cacheNodeType.
- B . Use the createcacheciuster API and specify a new cacheNodeType.
- C . Use the Modi fyCacheParameterGcoup API and specify a new CacheNodeType.
- D . Use the Rebootcacheclustcr API and specify a new CacheNodeType.
Correct Answer: A
A
Explanation:
To upgrade the instance type of a Memcached cluster in Amazon ElastiCache due to increased usage and the need for more memory:
ModifyCacheCluster API: Utilize the ModifyCacheCluster API call. This API allows you to change various settings of an existing cache cluster, including the instance type, which is referred to as cacheNodeType.
Instance Upgrade: Specify a new, larger cacheNodeType that provides more memory. This upgrade will involve a brief interruption as nodes are replaced with the larger type, but it is necessary to accommodate the increased load and memory requirements.
Cluster Availability: Ensure that the Memcached cluster is configured for minimal downtime during this change. The upgrade process is handled by ElastiCache, and the new nodes will join the cluster with more memory capacity.
This approach enables you to effectively scale up the resources available to your Memcached cluster, enhancing its performance and capacity to handle larger workloads.
A
Explanation:
To upgrade the instance type of a Memcached cluster in Amazon ElastiCache due to increased usage and the need for more memory:
ModifyCacheCluster API: Utilize the ModifyCacheCluster API call. This API allows you to change various settings of an existing cache cluster, including the instance type, which is referred to as cacheNodeType.
Instance Upgrade: Specify a new, larger cacheNodeType that provides more memory. This upgrade will involve a brief interruption as nodes are replaced with the larger type, but it is necessary to accommodate the increased load and memory requirements.
Cluster Availability: Ensure that the Memcached cluster is configured for minimal downtime during this change. The upgrade process is handled by ElastiCache, and the new nodes will join the cluster with more memory capacity.
This approach enables you to effectively scale up the resources available to your Memcached cluster, enhancing its performance and capacity to handle larger workloads.
Question #9
A SysOps administrator must ensure that a company’s Amazon EC2 instances auto scale as expected The SysOps administrator configures an Amazon EC2 Auto Scaling Lifecycle hook to send an event to Amazon EventBridge (Amazon CloudWatch Events), which then invokes an AWS Lambda function to configure the EC2 distances When the configuration is complete, the Lambda function calls the complete Lifecycle-action event to put the EC2 instances into service. In testing, the SysOps
administrator discovers that the Lambda function is not invoked when the EC2 instances auto scale.
What should the SysOps administrator do to reserve this issue?
- A . Add a permission to the Lambda function so that it can be invoked by the EventBridge (CloudWatch Events) rule.
- B . Change the lifecycle hook action to CONTINUE if the lifecycle hook experiences a fa* we or timeout.
- C . Configure a retry policy in the EventBridge (CloudWatch Events) rule to retry the Lambda function invocation upon failure.
- D . Update the Lambda function execution role so that it has permission to call the complete lifecycle-action event
Correct Answer: A
A
Explanation:
If a Lambda function is not being invoked by an Amazon EventBridge (formerly CloudWatch Events) rule, the likely issue is a missing permission. The Lambda function needs permission to be invoked by the EventBridge rule.
Steps:
Add Permission to Lambda Function:
Open the AWS Lambda console.
Select your Lambda function.
Choose "Configuration" and then "Permissions".
Under the "Resource-based policy" section, add a policy that grants EventBridge permission to invoke your function.
Example policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME",
"Condition": {
"ArnLike": {
"AWS:SourceArn": "arn:aws:events:REGION:ACCOUNT_ID:rule/RULE_NAME"
}
}
}
]
}
Verify the EventBridge Rule:
Open the Amazon EventBridge console.
Select the rule that targets your Lambda function.
Ensure that the rule is correctly configured to match events and the target is your Lambda function.
Reference: AWS Lambda Permissions Model
Amazon EventBridge Rules
A
Explanation:
If a Lambda function is not being invoked by an Amazon EventBridge (formerly CloudWatch Events) rule, the likely issue is a missing permission. The Lambda function needs permission to be invoked by the EventBridge rule.
Steps:
Add Permission to Lambda Function:
Open the AWS Lambda console.
Select your Lambda function.
Choose "Configuration" and then "Permissions".
Under the "Resource-based policy" section, add a policy that grants EventBridge permission to invoke your function.
Example policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME",
"Condition": {
"ArnLike": {
"AWS:SourceArn": "arn:aws:events:REGION:ACCOUNT_ID:rule/RULE_NAME"
}
}
}
]
}
Verify the EventBridge Rule:
Open the Amazon EventBridge console.
Select the rule that targets your Lambda function.
Ensure that the rule is correctly configured to match events and the target is your Lambda function.
Reference: AWS Lambda Permissions Model
Amazon EventBridge Rules
Question #10
A company has an AWS Cloud Formation template that creates an Amazon S3 bucket. A user authenticates to the corporate AWS account with their Active Directory credentials and attempts to deploy the Cloud Formation template. However, the stack creation fails.
Which factors could cause this failure? (Select TWO.)
- A . The user’s IAM policy does not allow the cloudformation:CreateStack action.
- B . The user’s IAM policy does not allow the cloudformation:CreateStackSet action.
- C . The user’s IAM policy does not allow the s3:CreateBucket action.
- D . The user’s IAM policy explicitly denies the s3:ListBucket action.
- E . The user’s IAM policy explicitly denies the s3:PutObject action
Correct Answer: AC
AC
Explanation:
Understand the Problem:
A user attempts to deploy a CloudFormation template to create an S3 bucket but the stack creation fails.
The user authenticates using Active Directory credentials.
Analyze the Requirements:
Identify permissions required for successful CloudFormation stack creation.
Evaluate the Options:
Option A: The user’s IAM policy does not allow the cloudformation:CreateStack action.
Without this permission, the user cannot create CloudFormation stacks.
Option B: The user’s IAM policy does not allow the cloudformation:CreateStackSet action.
StackSet is used for managing stacks across multiple accounts and regions, not relevant for a single stack creation.
Option C: The user’s IAM policy does not allow the s3:CreateBucket action.
This permission is required to create an S3 bucket as part of the stack.
Option D: The user’s IAM policy explicitly denies the s3:ListBucket action.
This permission is not required for bucket creation but for listing existing buckets.
Option E: The user’s IAM policy explicitly denies the s3:PutObject action.
This permission is required to put objects in a bucket, not to create the bucket.
Select the Best Solution:
Option A and C: The user must have permissions for cloudformation:CreateStack and s3:CreateBucket to successfully create the stack and the S3 bucket.
Reference: AWS CloudFormation Permissions
IAM Policies and Permissions
Ensuring the user has the required permissions for cloudformation:CreateStack and s3:CreateBucket is crucial for successful stack creation.
AC
Explanation:
Understand the Problem:
A user attempts to deploy a CloudFormation template to create an S3 bucket but the stack creation fails.
The user authenticates using Active Directory credentials.
Analyze the Requirements:
Identify permissions required for successful CloudFormation stack creation.
Evaluate the Options:
Option A: The user’s IAM policy does not allow the cloudformation:CreateStack action.
Without this permission, the user cannot create CloudFormation stacks.
Option B: The user’s IAM policy does not allow the cloudformation:CreateStackSet action.
StackSet is used for managing stacks across multiple accounts and regions, not relevant for a single stack creation.
Option C: The user’s IAM policy does not allow the s3:CreateBucket action.
This permission is required to create an S3 bucket as part of the stack.
Option D: The user’s IAM policy explicitly denies the s3:ListBucket action.
This permission is not required for bucket creation but for listing existing buckets.
Option E: The user’s IAM policy explicitly denies the s3:PutObject action.
This permission is required to put objects in a bucket, not to create the bucket.
Select the Best Solution:
Option A and C: The user must have permissions for cloudformation:CreateStack and s3:CreateBucket to successfully create the stack and the S3 bucket.
Reference: AWS CloudFormation Permissions
IAM Policies and Permissions
Ensuring the user has the required permissions for cloudformation:CreateStack and s3:CreateBucket is crucial for successful stack creation.