Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A Sysops administrator wants to share a copy of a production database with a migration account. The production database is hosted on an Amazon RDS DB instance and is encrypted at rest with an AWS
Key Management Service (AWS KMS) key that has an alias of
What must the Sysops administrator do to meet these requirements with the LEAST administrative overhead?
- A . Take a snapshot of the RDS DB instance in the production account. Amend the KMS key policy of the production-rds-key KMS key to give access to the migration account’s root user. Share the snapshot with the migration account.
- B . Create an RDS read replica in the migration account. Configure the KMS key policy to replicate the production-rds-key KMS key to the migration account.
- C . Take a snapshot of the RDS DB instance in the production account. Share the snapshot with the migration account. In the migration account, create a new KMS key that has an identical alias.
- D . Use native database toolsets to export the RDS DB instance to Amazon S3. Create an S3 bucket and an S3 bucket policy for cross-account access between the production account and the migration account. Use native database toolsets to import the database from Amazon S3 to a new RDS DB instance.
A
Explanation:
To share an encrypted Amazon RDS DB instance snapshot across accounts, the least administrative overhead involves directly managing permissions on the AWS KMS key and sharing the snapshot. Here’s how to do it:
Take a Snapshot: Initiate a snapshot of your Amazon RDS DB instance in the production account. This captures the current state of the database.
Modify KMS Key Policy: Adjust the policy of the KMS key used for encryption (identified by the alias ‘production-rds-key’) to grant the kms:Decrypt permission to the migration account’s root user. This
step is crucial as it allows the migration account to use the same encryption key to decrypt the snapshot.
Share the Snapshot: Share the newly created snapshot with the migration account using the RDS console or AWS CLI. The migration account will now be able to see and use this snapshot to create a new RDS instance.
AWS Documentation
Reference: You can refer to the AWS documentation on sharing encrypted snapshots: Sharing Encrypted Snapshots.
A SysOps administrator needs to create alerts that are based on the read and write metrics of Amazon Elastic Block Store (Amazon EBS) volumes that are attached to an Amazon EC2 instance. The SysOps administrator creates and enables Amazon CloudWatch alarms for the DiskReadBytes metric and the DiskWriteBytes metric.
A custom monitoring tool that is installed on the EC2 instance with the same alarm configuration indicates that the volume metrics have exceeded the threshold. However, the CloudWatch alarms were not in ALARM state.
Which action will ensure that the CloudWatch alarms function correctly?
- A . Install and configure the CloudWatch agent on the EC2 instance to capture the desired metrics.
- B . Install and configure AWS Systems Manager Agent on the EC2 instance to capture the desired metrics.
- C . Reconfigure the CloudWatch alarms to use the VolumeReadBytes metric and the VolumeWriteBytes metric for the EBS volumes.
- D . Reconfigure the CloudWatch alarms to use the VolumeReadBytes metric and the VolumeWriteBytes metric for the EC2 instance.
A company needs to upload gigabytes of files every day. The company need to achieve higher throughput and upload speeds to Amazon S3.
Which action should a SysOps administrator take to meet this requirement?
- A . Create an Amazon CloudFront distribution with the GET HTTP method allowed and the S3 bucket as an origin.
- B . Create an Amazon ElastiCache duster and enable caching for the S3 bucket
- C . Set up AWS Global Accelerator and configure it with the S3 bucket
- D . Enable S3 Transfer Acceleration and use the acceleration endpoint when uploading files
D
Explanation:
Enable Amazon S3 Transfer Acceleration Amazon S3 Transfer Acceleration can provide fast and secure
transfers over long distances between your client and Amazon S3. Transfer Acceleration uses Amazon
CloudFront’s globally distributed edge locations.
https://aws.amazon.com/premiumsupport/knowledge-center/s3-upload-large-files/
A SysOps administrator maintains the security and compliance of a company’s AWS account. To ensure the company’s Amazon EC2 instances are following company policy, a SysOps administrator wants to terminate any EC2 instance that do not contain a department tag. Noncompliant resources must be terminated in near real time.
Which solution will meet these requirements?
- A . Create an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS-TerminateEC2lnstance automation runbook to terminate noncompliant resources.
- B . Create a new Amazon EventBridge rule to monitor when new EC2 instances are created. Send the event to an Simple Notification Service (Amazon SNS) topic for automatic remediation.
- C . Ensure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance’s shutdown behavior to terminate.
- D . Ensure AWS Systems Manager Compliance is configured to manage the EC2 instances. Call the AWS-StopEC2lnstances automation runbook to stop noncompliant resources.
A
Explanation:
To enforce compliance with tagging policies in real-time:
AWS Config Setup: Implement an AWS Config rule to continuously monitor and evaluate EC2 instances for compliance with the tagging requirements. The required-tags managed rule can be configured to specifically check for the presence of a ‘department’ tag.
Automatic Remediation: Configure AWS Config to automatically execute the AWS-TerminateEC2Instance Systems Manager Automation document as a remediation action. This runbook will terminate any EC2 instance identified as noncompliant due to missing required tags.
Operational Efficiency: This setup allows for the enforcement of company tagging policies automatically and in near real-time, reducing the manual overhead of monitoring and ensuring
compliance.
This method provides an efficient and effective solution to ensure that all EC2 instances meet the company’s tagging requirements and that any noncompliant instances are dealt with promptly.
A company is undergoing an external audit of its systems, which run wholly on AWS. A SysOps administrator must supply documentation of Payment Card Industry Data Security Standard (PCI DSS) compliance for the infrastructure managed by AWS.
Which set of action should the SysOps administrator take to meet this requirement?
- A . Download the applicable reports from the AWS Artifact portal and supply these to the auditors.
- B . Download complete copies of the AWS CloudTrail log files and supply these to the auditors.
- C . Download complete copies of the AWS CloudWatch logs and supply these to the auditors.
- D . Provide the auditors with administrative access to the production AWS account so that the auditors can determine compliance.
A
Explanation:
To supply documentation of Payment Card Industry Data Security Standard (PCI DSS) compliance for the infrastructure managed by AWS, the SysOps administrator should download the applicable reports from the AWS Artifact portal.
AWS Artifact:
AWS Artifact is a service that provides on-demand access to AWS’ security and compliance reports and select online agreements.
It includes compliance reports for standards such as PCI DSS, SOC, ISO, and more.
Steps to Access Reports:
Open the AWS Management Console.
Navigate to the AWS Artifact console.
Browse and download the PCI DSS compliance report.
Providing Documentation:
Download the relevant PCI DSS reports and provide them to the auditors as required.
Reference: AWS Artifact
PCI DSS Compliance
The SysOps administrator must restart the web server if specific errors are detected in logs on EC2 instances behind a load balancer. (Select THREE):
- A . Install the Amazon CloudWatch agent on the EC2 instances.
- B . Create an AWS CloudTrail metric filter for the web logs. Configure an alarm for the specific errors.
- C . Create an Amazon CloudWatch metric filter for the web logs. Configure an alarm for the specific errors.
- D . Publish alarm findings to Amazon Simple Email Service (Amazon SES). Invoke an AWS Lambda function to restart the web server software.
- E . Create an Amazon EventBridge rule that responds to the alarm. Configure the rule to invoke an AWS Systems Manager Automation runbook to restart the web server software.
- F . Create an Amazon Simple Notification Service (Amazon SNS) notification that responds to the alarm. Configure the notification to invoke an AWS Systems Manager Automation runbook to restart the web server software.
A, C, E
Explanation:
Installing the CloudWatch agent enables log monitoring, and a CloudWatch metric filter allows
alerting on specific errors. Using EventBridge to trigger a Systems Manager Automation runbook automates the restart of the web server, creating an efficient and automated solution.
An Amazon EC2 instance needs to be reachable from the internet. The EC2 instance is in a subnet with the following route table:
Which entry must a SysOps administrator add to the route table to meet this requirement?
- A . A route for 0.0.0.0/0 that points to a NAT gateway
- B . A route for 0.0.0.0/0 that points to an egress-only internet gateway
- C . A route for 0.0.0.0/0 that points to an internet gateway
- D . A route for 0.0.0.0/0 that points to an elastic network interface
C
Explanation:
Step-by-Step
Understand the Problem:
An EC2 instance needs to be reachable from the internet.
Analyze the Requirements:
Ensure proper routing for internet connectivity.
Evaluate the Options:
Option A: A route for 0.0.0.0/0 that points to a NAT gateway.
NAT gateways allow instances in private subnets to access the internet, not the other way around.
Option B: A route for 0.0.0.0/0 that points to an egress-only internet gateway.
Egress-only gateways are for IPv6 traffic and do not provide inbound internet access.
Option C: A route for 0.0.0.0/0 that points to an internet gateway.
Internet gateways provide both inbound and outbound internet access. Option D: A route for 0.0.0.0/0 that points to an elastic network interface. Elastic network interfaces do not provide internet routing. Select the Best Solution:
Option C: Adding a route to the internet gateway ensures the EC2 instance is reachable from the internet.
Reference: Amazon VPC Internet Gateway
Configuring a route to the internet gateway ensures proper internet connectivity for the EC2 instance.
Users of a company’s internal web application recently experienced application performance issues for a brief period The application includes frontend web servers that run in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster The application also includes a bacKend Amazon Aurora PostgreSQL DB cluster that includes one DB instance.
A SysOps administrator determines that the source of the performance issues was high utilization of the DB cluster. The single writer instance experienced more than 90% utilization for 11 minutes The cause of the high utilization was an automated report that is scheduled to run one time each week
What should the SysOps administrator do to ensure that users do not experience performance Issues each week when the report runs?
- A . Increase the size of the DB instance. Monitor the performance during the next scheduled run of the report
- B . Add a reader instance. Change the database connection string of the report application to use the newly created reader instance.
- C . Add another writer instance Change the database connection string of the report application to use the newly created writer instance.
- D . Configure auto scaling for the DB cluster Set the minimum capacity units, maximum capacity units, and target utilization
A
Explanation:
Increasing DB Instance Size:
Increasing the instance size provides more CPU and memory resources, which can help handle higher loads.
Steps:
Go to the AWS Management Console.
Navigate to RDS and select the DB instance.
Modify the instance to increase its size.
Apply the changes during the next maintenance window or immediately if it is a critical issue.
Monitoring Performance:
After resizing, monitor the instance during the next report run to ensure that it handles the load effectively.
Reference: Modifying an Amazon RDS DB Instance
A company has an internal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone. A SysOps administrator must make the application highly available.
Which action should the SysOps administrator take to meet this requirement?
- A . Increase the maximum number of instances in the Auto Scaling group to meet the capacity that is
required at peak usage. - B . Increase the minimum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
- C . Update the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.
- D . Update the Auto Scaling group to launch new instances in an Availability Zone in a second AWS Region.
C
Explanation:
To make the application highly available, update the Auto Scaling group to launch new instances in a second Availability Zone within the same AWS Region.
Understand High Availability Requirements:
High availability involves distributing instances across multiple Availability Zones to ensure the application remains accessible even if one Availability Zone experiences issues.
Reference: Regions, Availability Zones, and Local Zones
Update Auto Scaling Group Configuration:
Navigate to the EC2 console.
Select "Auto Scaling Groups" and choose the Auto Scaling group for your application.
Update the "Network" section to include additional subnets from different Availability Zones within the same region.
Reference: Configuring your Auto Scaling group to launch instances in multiple Availability Zones Adjust Capacity Settings:
Ensure the desired and minimum capacity settings are configured to distribute instances across multiple Availability Zones.
Save the changes.
By launching instances in multiple Availability Zones, the application can handle failures in one zone, achieving high availability.
A company is storing media content in an Amazon S3 bucket and uses Amazon CloudFront to distribute the content to its users. Due to licensing terms, the company is not authorized to distribute the content in some countries. A SysOps administrator must restrict access to certain countries.
What is the MOST operationally efficient solution that meets these requirements?
- A . Configure the S3 bucket policy to deny the GetObject operation based on the S3:LocationConstraint condition.
- B . Create a secondary origin access identity (OAI). Configure the S3 bucket policy to prevent access from unauthorized countries.
- C . Enable the geo restriction feature in the CloudFront distribution to prevent access from unauthorized countries.
- D . Update the application to generate signed CloudFront URLs only for IP addresses in authorized countries.
C
Explanation:
To restrict access to content in specific countries using CloudFront, enabling the geo restriction feature in the CloudFront distribution is the most operationally efficient solution.
Geo Restriction in CloudFront:
CloudFront allows you to use geographic restrictions, also known as geo-blocking, to prevent users in specific geographic locations from accessing content that you’re distributing through a CloudFront distribution.
Enabling Geo Restriction:
Go to the CloudFront console.
Select your distribution and click on "Restrictions."
Choose "Edit" and then enable "Geo restriction."
Specify the countries you want to restrict by selecting "Whitelist" or "Blacklist" and entering the appropriate country codes.
Operational Efficiency:
This method leverages CloudFront’s built-in capabilities to restrict access at the edge locations, ensuring that unauthorized requests are blocked before reaching your origin.
It is a straightforward and scalable solution without requiring changes to your S3 bucket policy or application logic.
Reference: Using Geo Restriction to Restrict Access to Your Content