Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #101
A SysOps administrator creates two VPCs, VPC1 and VPC2, in a company’s AWS account The SysOps administrator deploys a Linux Amazon EC2 instance in VPC1 and deploys an Amazon RDS for MySQL DB instance in VPC2. The DB instance is deployed in a private subnet. An application that runs on the EC2 instance needs to connect to the database.
What should the SysOps administrator do to give the EC2 instance the ability to connect to the database?
- A . Enter the DB instance connection string into the VPC1 route table.
- B . Configure VPC peering between the two VPCs.
- C . Add the same IPv4 CIDR range for both VPCs.
- D . Connect to the DB instance by using the DB instance’s public IP address.
Correct Answer: B
B
Explanation:
VPC peering allows two VPCs to communicate with each other securely. By configuring VPC peering between the two VPCs, the SysOps administrator will be able to give the EC2 instance in VPC1 the ability to connect to the database in VPC2. Once the VPC peering is configured, the EC2 instance will be able to communicate with the database using the private IP address of the DB instance in the private subnet.
B
Explanation:
VPC peering allows two VPCs to communicate with each other securely. By configuring VPC peering between the two VPCs, the SysOps administrator will be able to give the EC2 instance in VPC1 the ability to connect to the database in VPC2. Once the VPC peering is configured, the EC2 instance will be able to communicate with the database using the private IP address of the DB instance in the private subnet.
Question #102
The SysOps administrator needs to complete the KMS key policy for least privilege read access for the DataEngineer role to decrypt S3 objects encrypted with a KMS key.
- A . "kms:ReEncrypt", "kms:GenerateDataKey*", "kms:Encrypt", "kms:DescribeKey"
- B . "kms:ListAliases", "kms:GetKeyPolicy", "kms:Describe*", "kms:Decrypt"
- C . "kms:ListAliases", "kms:DescribeKey", "kms:Decrypt"
- D . "kms:Update*", "kms:TagResource", "kms:Revoke*", "kms:Put*", "kms:List*", "kms:Get*", "kms:Enable*", "kms:Disable*", "kms:Describe*", "kms:Delete*", "kms:Create*", "kms:CancelKeyDeletion"
Correct Answer: C
C
Explanation:
To enable decryption of objects, the role only requires minimal permissions with least privilege:
kms
: Necessary for reading and decrypting the data encrypted with KMS. kms
: Allows the role to check key properties, confirming it’s the correct key for decryption. kms
: Useful if multiple keys are in use and validation against an alias is needed.
These permissions are sufficient for decryption without granting additional permissions like encryption or key management.
C
Explanation:
To enable decryption of objects, the role only requires minimal permissions with least privilege:
kms
: Necessary for reading and decrypting the data encrypted with KMS. kms
: Allows the role to check key properties, confirming it’s the correct key for decryption. kms
: Useful if multiple keys are in use and validation against an alias is needed.
These permissions are sufficient for decryption without granting additional permissions like encryption or key management.
Question #103
A SysOps administrator trust manage the security of An AWS account Recently an IAM users access key was mistakenly uploaded to a public code repository. The SysOps administrator must identity anything that was changed by using this access key.
- A . Create an Amazon EventBridge (Amazon CloudWatch Events) rule to send all IAM events lo an AWS Lambda function for analysis
- B . Query Amazon EC2 togs by using Amazon CloudWatch Logs Insights for all events Heated with the compromised access key within the suspected timeframe
- C . Search AWS CloudTrail event history tor all events initiated with the compromised access key within the suspected timeframe
- D . Search VPC Flow Logs foe all events initiated with the compromised access key within the suspected Timeframe.
Correct Answer: C
C
Explanation:
To identify changes made by the compromised access key, the SysOps administrator should search the AWS CloudTrail event history:
AWS CloudTrail:
CloudTrail logs all API calls made in an AWS account, which includes events initiated by access keys.
This makes it the ideal service to investigate changes made using the compromised access key.
Reference: AWS CloudTrail Documentation
Search CloudTrail Event History:
Use the CloudTrail console to filter and search for events associated with the compromised access key within the suspected timeframe.
Reference: Viewing Events with CloudTrail Event History
C
Explanation:
To identify changes made by the compromised access key, the SysOps administrator should search the AWS CloudTrail event history:
AWS CloudTrail:
CloudTrail logs all API calls made in an AWS account, which includes events initiated by access keys.
This makes it the ideal service to investigate changes made using the compromised access key.
Reference: AWS CloudTrail Documentation
Search CloudTrail Event History:
Use the CloudTrail console to filter and search for events associated with the compromised access key within the suspected timeframe.
Reference: Viewing Events with CloudTrail Event History
Question #104
A company runs several workloads on AWS. The company identifies five AWS Trusted Advisor service quota metrics to monitor in a specific AWS Region. The company wants to receive email notification each time resource usage exceeds 60% of one of the service quotas.
Which solution will meet these requirements?
- A . Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of one of the service quotas.
- B . Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification each time that usage exceeds 60% of one of the service quotas.
- C . Use the AWS Service Health Dashboard to monitor each Trusted Advisor service quota metric. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification each time that usage exceeds 60% of one of the service quotas.
- D . Use the AWS Service Health Dashboard to monitor each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of one of the service quotas.
Correct Answer: A
A
Explanation:
CloudWatch alarms allow you to monitor AWS resources, and you can configure an SNS topic to send an email notification each time one of the alarms is triggered. This will ensure that the company receives email notifications each time one of the service quotas is exceeded, allowing the company to take action as needed.
A
Explanation:
CloudWatch alarms allow you to monitor AWS resources, and you can configure an SNS topic to send an email notification each time one of the alarms is triggered. This will ensure that the company receives email notifications each time one of the service quotas is exceeded, allowing the company to take action as needed.
Question #105
A company manages a set of accounts on AWS by using AWS Organizations. The company’s security team wants to use a native AWS service to regularly scan all AWS accounts against the Center for Internet Security (CIS) AWS Foundations Benchmark.
What is the MOST operationally efficient way to meet these requirements?
- A . Designate a central security account as the AWS Security Hub administrator account. Create a script that sends an invitation from the Security Hub administrator account and accepts the invitation from the member account. Run the script every time a new account is created. Configure Security Hub to run the CIS AWS Foundations Benchmark scans.
- B . Run the CIS AWS Foundations Benchmark across all accounts by using Amazon Inspector.
- C . Designate a central security account as the Amazon GuardDuty administrator account. Create a script that sends an invitation from the GuardDuty administrator account and accepts the invitation
from the member account. Run the script every time a new account is created. Configure GuardDuty to run the CIS AWS Foundations Benchmark scans. - D . Designate an AWS Security Hub administrator account. Configure new accounts in the organization to automatically become member accounts. Enable CIS AWS Foundations Benchmark scans.
Correct Answer: D
D
Explanation:
To ensure comprehensive and automated security scanning across multiple AWS accounts:
Security Hub Administrator Account: Designate one account within AWS Organizations as the Security Hub administrator account. This centralizes security findings management.
Automate Account Association: Configure Security Hub to automatically associate new accounts in the organization as member accounts. This ensures all new and existing accounts are continuously monitored under the same security policies.
Enable CIS Benchmark Scans: Within Security Hub, enable the CIS AWS Foundations Benchmark standard. This automatically scans all member accounts against this set of security best practices and compliance standards.
This configuration provides an operationally efficient and scalable way to manage security and compliance across an extensive AWS environment, leveraging the native integration of AWS services.
D
Explanation:
To ensure comprehensive and automated security scanning across multiple AWS accounts:
Security Hub Administrator Account: Designate one account within AWS Organizations as the Security Hub administrator account. This centralizes security findings management.
Automate Account Association: Configure Security Hub to automatically associate new accounts in the organization as member accounts. This ensures all new and existing accounts are continuously monitored under the same security policies.
Enable CIS Benchmark Scans: Within Security Hub, enable the CIS AWS Foundations Benchmark standard. This automatically scans all member accounts against this set of security best practices and compliance standards.
This configuration provides an operationally efficient and scalable way to manage security and compliance across an extensive AWS environment, leveraging the native integration of AWS services.
Question #106
A SysOps administrator has set up a new Amazon EC2 instance as a web server in a public subnet.
The instance uses HTTP port 80 and HTTPS port 443.
The SysOps administrator has confirmed internet connectivity by downloading operating system updates and software from public repositories. However, the SysOps administrator cannot access the instance from a web browser on the internet.
Which combination of steps should the SysOps administrator take to troubleshoot this issue? (Select THREE.)
- A . Ensure that the inbound rules of the instance’s security group allow traffic on ports 80 and 443.
- B . Ensure that the outbound rules of the instance’s security group allow traffic on ports 80 and 443.
- C . Ensure that ephemeral ports 1024-65535 are allowed in the inbound rules of the network ACL that is associated with the instance’s subnet.
- D . Ensure that ephemeral ports 1024-65535 are allowed in the outbound rules of the network ACL that is associated with the instance’s subnet.
- E . Ensure that the filtering rules for any firewalls that are running on the instance allow inbound traffic on ports 80 and 443.
- F . Ensure that AWS WAF is turned on for the instance and is blocking web traffic.
Correct Answer: A, D, E
A, D, E
Explanation:
When troubleshooting inability to access an EC2 instance from the internet, you should:
A: Verify that the security group rules allow inbound HTTP and HTTPS traffic on ports 80 and 443. Security groups act as a virtual firewall to control the traffic to instances.
D: Check that outbound rules in the network ACL allow traffic for ephemeral ports 1024-65535. This is crucial for return traffic from web requests, which typically use these higher port numbers for responses.
E: Confirm that any software-based firewalls on the instance (such as Windows Firewall or iptables in Linux) are configured to allow inbound traffic on HTTP and HTTPS. These steps will ensure that the web server is correctly configured to receive and respond to web traffic from the internet. AWS provides guidelines on these configurations in their documentation on security groups EC2 Security Groups and network ACLs Network ACLs.
A, D, E
Explanation:
When troubleshooting inability to access an EC2 instance from the internet, you should:
A: Verify that the security group rules allow inbound HTTP and HTTPS traffic on ports 80 and 443. Security groups act as a virtual firewall to control the traffic to instances.
D: Check that outbound rules in the network ACL allow traffic for ephemeral ports 1024-65535. This is crucial for return traffic from web requests, which typically use these higher port numbers for responses.
E: Confirm that any software-based firewalls on the instance (such as Windows Firewall or iptables in Linux) are configured to allow inbound traffic on HTTP and HTTPS. These steps will ensure that the web server is correctly configured to receive and respond to web traffic from the internet. AWS provides guidelines on these configurations in their documentation on security groups EC2 Security Groups and network ACLs Network ACLs.
Question #107
A company needs to deploy instances of an application and associated infrastructure to multiple AWS Regions. The company wants to use a single AWS CloudFormation template to achieve this goal. The company uses AWS Organizations and wants to administer and run this template from a central administration account.
What should a SysOps administrator do to meet these requirements?
- A . Create a CloudFormation template that is stored in Amazon S3. Configure Cross-Region Replication (CRR) on the S3 bucket. Reference the required accounts and remote Regions in the input template parameters.
- B . In the central administration account, create a CloudFormation primary template that loads CloudFormation nested stacks from Amazon S3 buckets in the target Regions.
- C . Create CloudFormation nested stacks by using a primary template in the central administration account. Configure the required accounts and Regions for deployment of the nested stacks.
- D . Create a CloudFormation stack set that includes service-managed permissions. Deploy the stack set into the required accounts and Regions from the central administration account.
Correct Answer: D
D
Explanation:
AWS CloudFormation StackSets extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation. Using a stack set, the SysOps administrator can manage deployments across different regions and accounts within AWS Organizations efficiently.
Setting up StackSets: First, define your CloudFormation template that describes all the resources that need to be deployed across the regions. Store this template in an S3 bucket accessible by the central administration account.
Service-Managed Permissions: When creating a stack set, select the option for service-managed permissions if you are using AWS Organizations. This allows AWS CloudFormation to automatically set up the necessary permissions in the target accounts.
Deploying the Stack Set: From the central administration account, create the stack set and specify the target accounts and regions. CloudFormation will then ensure that the resources defined in the template are instantiated in each of the specified regions and accounts.
This method simplifies management and ensures consistency of infrastructure across multiple regions and accounts, leveraging the organizational units in AWS Organizations for centralized governance.
D
Explanation:
AWS CloudFormation StackSets extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation. Using a stack set, the SysOps administrator can manage deployments across different regions and accounts within AWS Organizations efficiently.
Setting up StackSets: First, define your CloudFormation template that describes all the resources that need to be deployed across the regions. Store this template in an S3 bucket accessible by the central administration account.
Service-Managed Permissions: When creating a stack set, select the option for service-managed permissions if you are using AWS Organizations. This allows AWS CloudFormation to automatically set up the necessary permissions in the target accounts.
Deploying the Stack Set: From the central administration account, create the stack set and specify the target accounts and regions. CloudFormation will then ensure that the resources defined in the template are instantiated in each of the specified regions and accounts.
This method simplifies management and ensures consistency of infrastructure across multiple regions and accounts, leveraging the organizational units in AWS Organizations for centralized governance.
Question #108
A SysOps administrator developed a Python script that uses the AWS SDK to conduct several maintenance tasks. The script needs to run automatically every night.
What is the MOST operationally efficient solution that meets this requirement?
- A . Convert the Python script to an AWS Lambda (unction. Use an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the function every night.
- B . Convert the Python script to an AWS Lambda function. Use AWS CloudTrail to invoke the function every night.
- C . Deploy the Python script to an Amazon EC2 Instance. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the instance to start and stop every night.
- D . Deploy the Python script to an Amazon EC2 instance. Use AWS Systems Manager to schedule the instance to start and stop every night.
Correct Answer: A
A
Explanation:
To automate the execution of a Python script every night efficiently:
Convert Python Script to Lambda:
Create an AWS Lambda function and upload the Python script.
Ensure the function has the necessary IAM permissions to perform the required maintenance tasks.
Reference: AWS Lambda Developer Guide
Create EventBridge Rule:
Navigate to the Amazon EventBridge console and create a new rule. Set the rule to trigger the Lambda function on a nightly schedule.
Reference: Creating Scheduled Events with Amazon EventBridge
This solution is operationally efficient because Lambda functions are managed, scale automatically, and you only pay for the compute time you consume.
A
Explanation:
To automate the execution of a Python script every night efficiently:
Convert Python Script to Lambda:
Create an AWS Lambda function and upload the Python script.
Ensure the function has the necessary IAM permissions to perform the required maintenance tasks.
Reference: AWS Lambda Developer Guide
Create EventBridge Rule:
Navigate to the Amazon EventBridge console and create a new rule. Set the rule to trigger the Lambda function on a nightly schedule.
Reference: Creating Scheduled Events with Amazon EventBridge
This solution is operationally efficient because Lambda functions are managed, scale automatically, and you only pay for the compute time you consume.
Question #109
A SysOps administrator has Nocked public access to all company Amazon S3 buckets. The SysOps administrator wants to be notified when an S3 bucket becomes publicly readable in the future.
What is the MOST operationally efficient way to meet this requirement?
- A . Create an AWS Lambda function that periodically checks the public access settings for each S3 bucket. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications.
- B . Create a cron script that uses the S3 API to check the public access settings for each S3 bucket. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications
- C . Enable S3 Event notified tons for each S3 bucket. Subscribe S3 Event Notifications to an Amazon Simple Notification Service (Amazon SNS) topic.
- D . Enable the s3-bucket-public-read-prohibited managed rule in AWS Config. Subscribe the AWS Config rule to an Amazon Simple Notification Service (Amazon SNS) topic.
Correct Answer: D
D
Explanation:
AWS Config can continuously monitor and record your AWS resource configurations. It provides AWS Config rules that automatically check the configuration of AWS resources and notify you of compliance and non-compliance.
Steps:
Enable AWS Config:
Open the AWS Config console.
Follow the steps to set up AWS Config if it is not already enabled.
Add AWS Managed Rules:
In the AWS Config console, choose "Rules".
Add the s3-bucket-public-read-prohibited managed rule.
Configure the rule to check all S3 buckets.
Set Up SNS Notifications:
Create an Amazon SNS topic.
Subscribe your email or other communication channels to the SNS topic.
In AWS Config, configure the rule to send notifications to the SNS topic whenever there is a compliance change.
This approach ensures operational efficiency as AWS Config will automatically monitor S3 buckets and notify you through SNS if any bucket becomes publicly accessible.
Reference: AWS Config Managed Rules
Setting Up AWS Config
D
Explanation:
AWS Config can continuously monitor and record your AWS resource configurations. It provides AWS Config rules that automatically check the configuration of AWS resources and notify you of compliance and non-compliance.
Steps:
Enable AWS Config:
Open the AWS Config console.
Follow the steps to set up AWS Config if it is not already enabled.
Add AWS Managed Rules:
In the AWS Config console, choose "Rules".
Add the s3-bucket-public-read-prohibited managed rule.
Configure the rule to check all S3 buckets.
Set Up SNS Notifications:
Create an Amazon SNS topic.
Subscribe your email or other communication channels to the SNS topic.
In AWS Config, configure the rule to send notifications to the SNS topic whenever there is a compliance change.
This approach ensures operational efficiency as AWS Config will automatically monitor S3 buckets and notify you through SNS if any bucket becomes publicly accessible.
Reference: AWS Config Managed Rules
Setting Up AWS Config
Question #110
An ecommerce company uses an Amazon ElastiCache for Memcached cluster for in-memory caching of popular product queries on the shopping site. When viewing recent Amazon CloudWatch metrics data for the ElastiCache cluster, the SysOps administrator notices a large number of evictions.
Which of the following actions will reduce these evictions? (Choose two.)
- A . Add an additional node to the ElastiCache cluster.
- B . Increase the ElastiCache time to live (TTL).
- C . Increase the individual node size inside the ElastiCache cluster.
- D . Put an Elastic Load Balancer in front of the ElastiCache cluster.
- E . Use Amazon Simple Queue Service (Amazon SQS) to decouple the ElastiCache cluster.
Correct Answer: AC
AC
Explanation:
https://d1.awsstatic.com/training-and-certification/docs-sysops-associate/AWS-Certified-SysOps-Administrator-Associate_Sample-Questions_C02.pdf
Evictions in Amazon ElastiCache for Memcached occur when the cache runs out of available memory and needs to remove existing data to store new data. To reduce evictions, you can either add more nodes to the cluster or increase the size of the individual nodes.
Add an Additional Node:
Open the Amazon ElastiCache console at Amazon ElastiCache Console.
Select your Memcached cluster and choose Modify.
Increase the number of nodes in the cluster to add more memory capacity.
Apply the changes to scale out the cluster.
Increase the Individual Node Size:
Open the Amazon ElastiCache console and select your Memcached cluster.
Choose Modify and change the node type to a larger instance size with more memory.
Apply the changes to scale up the cluster.
Both actions will provide additional memory capacity, reducing the likelihood of evictions due to insufficient memory.
Reference: Scaling ElastiCache for Memcached
Amazon ElastiCache for Memcached User Guide
AC
Explanation:
https://d1.awsstatic.com/training-and-certification/docs-sysops-associate/AWS-Certified-SysOps-Administrator-Associate_Sample-Questions_C02.pdf
Evictions in Amazon ElastiCache for Memcached occur when the cache runs out of available memory and needs to remove existing data to store new data. To reduce evictions, you can either add more nodes to the cluster or increase the size of the individual nodes.
Add an Additional Node:
Open the Amazon ElastiCache console at Amazon ElastiCache Console.
Select your Memcached cluster and choose Modify.
Increase the number of nodes in the cluster to add more memory capacity.
Apply the changes to scale out the cluster.
Increase the Individual Node Size:
Open the Amazon ElastiCache console and select your Memcached cluster.
Choose Modify and change the node type to a larger instance size with more memory.
Apply the changes to scale up the cluster.
Both actions will provide additional memory capacity, reducing the likelihood of evictions due to insufficient memory.
Reference: Scaling ElastiCache for Memcached
Amazon ElastiCache for Memcached User Guide