Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company hosts an application on an Amazon EC2 instance in a single AWS Region. The application requires support for non-HTTP TCP traffic and HTTP traffic.
The company wants to deliver content with low latency by leveraging the AWS network. The company also wants to implement an Auto Scaling group with an Elastic Load Balancer.
How should a SysOps administrator meet these requirements?
- A . Create an Auto Scaling group with an Application Load Balancer (ALB). Add an Amazon CloudFront distribution with the ALB as the origin.
- B . Create an Auto Scaling group with an Application Load Balancer (ALB). Add an accelerator with AWS Global Accelerator with the ALB as an endpoint.
- C . Create an Auto Scaling group with a Network Load Balancer (NLB). Add an Amazon CloudFront distribution with the NLB as the origin.
- D . Create an Auto Scaling group with a Network Load Balancer (NLB). Add an accelerator with AWS Global Accelerator with the NLB as an endpoint.
D
Explanation:
AWS Global Accelerator and Amazon CloudFront are separate services that use the AWS global network and its edge locations around the world. CloudFront improves performance for both cacheable content (such as images and videos) and dynamic content (such as API acceleration and dynamic site delivery). Global Accelerator improves performance for a wide range of applications over TCP or UDP by proxying packets at the edge to applications running in one or more AWS Regions. Global Accelerator is a good fit for non-HTTP use cases, such as gaming (UDP), IoT (MQTT), or Voice over IP, as well as for HTTP use cases that specifically require static IP addresses or deterministic, fast regional failover. Both services integrate with AWS Shield for DDoS protection.
https://medium.com/awesome-cloud/aws-difference-between-application-load-balancer-and-network-load-balancer-cb8b6cd296a4 https://aws.amazon.com/global-accelerator/faqs/?nc1=h_ls
A company is managing a website with a global user base hosted on Amazon EC2 with an Application Load Balancer (ALB). To reduce the load on the web servers, a SysOps administrator configures an Amazon CloudFront distribution with the ALB as the origin. After a week of monitoring the solution, the administrator notices that requests are still being served by the ALB and there is no change in the web server load.
What are possible causes for this problem? (Choose two.)
- A . CloudFront does not have the ALB configured as the origin access identity.
- B . The DNS is still pointing to the ALB instead of the CloudFront distribution.
- C . The ALB security group is not permitting inbound traffic from CloudFront.
- D . The default, minimum, and maximum Time to Live (TTL) are set to 0 seconds on the CloudFront distribution.
- E . The target groups associated with the ALB are configured for sticky sessions.
BD
Explanation:
To effectively use Amazon CloudFront as a content delivery network for an application using an Application Load Balancer as the origin, several configuration steps need to be correctly implemented:
DNS Configuration: Ensure that the DNS records for the domain serving the content point to the CloudFront distribution’s DNS name rather than directly to the ALB. If the DNS still points to the ALB, users’ requests will bypass CloudFront, leading directly to the ALB and maintaining the existing load on your web servers.
TTL Settings: The Time to Live (TTL) settings in the CloudFront distribution dictate how long the content is cached in CloudFront edge locations before CloudFront fetches a fresh copy from the origin. If the TTL values are set to 0, it means that CloudFront does not cache the content at all, resulting in each user request being forwarded to the ALB, which does not reduce the load.
AWS Documentation
Reference: For more information on DNS and TTL configurations for CloudFront, you can refer to the following AWS documentation:
Configuring DNS
CloudFront TTL Settings.
A company is planning to host an application on a set of Amazon EC2 instances that are distributed across multiple Availability Zones. The application must be able to scale to millions of requests each second.
A SysOps administrator must design a solution to distribute the traffic to the EC2 instances. The solution must be optimized to handle sudden and volatile traffic patterns while using a single static IP address for each Availability Zone.
Which solution will meet these requirements?
- A . Amazon Simple Queue Service (Amazon SQS) queue
- B . Application Load Balancer
- C . AWS Global Accelerator
- D . Network Load Balancer
D
Explanation:
"Network Load Balancer is optimized to handle sudden and volatile traffic patterns while using a single static IP address per Availability Zone."
https://aws.amazon.com/elasticloadbalancing/network-load-balancer/
For an application that must scale to millions of requests per second and requires a single static IP address for each Availability Zone, a Network Load Balancer (NLB) is the most suitable option. NLBs are designed for high-performance, low-latency networking, and they support static IP addresses for each Availability Zone, making it ideal for volatile traffic patterns. Option D is the correct choice. AWS provides extensive documentation on NLB capabilities and configurations that suit these requirements AWS Network Load Balancer.
A company has multiple Amazon EC2 instances that run a resource-intensive application in a
development environment. A SysOps administrator is implementing a solution to stop these EC2 instances when they are not in use.
Which solution will meet this requirement?
- A . Assess AWS CloudTrail logs to verify that there is no EC2 API activity. Invoke an AWS Lambda function to stop the EC2 instances.
- B . Create an Amazon CloudWatch alarm to stop the EC2 instances when the average CPU utilization is lower than 5% for a 30-minute period.
- C . Create an Amazon CloudWatch metric to stop the EC2 instances when the VolumeReadBytes metric is lower than 500 for a 30-minute period.
- D . Use AWS Config to invoke an AWS Lambda function to stop the EC2 instances based on resource configuration changes.
C
Explanation:
To stop EC2 instances in a development environment when they are not in use, you can create a CloudWatch alarm based on CPU utilization.
Create CloudWatch Alarm:
Navigate to the CloudWatch console.
Select "Alarms" and click on "Create Alarm".
Choose the EC2 instance metric for CPU utilization.
Set the condition to trigger the alarm when the average CPU utilization is less than 5% for a continuous 30-minute period.
Reference: Creating Amazon CloudWatch Alarms
Configure Alarm Actions:
In the actions section of the alarm creation, specify the action to stop the instance.
This can be done by creating an alarm action that uses an AWS Lambda function or directly through EC2 actions.
Example using Lambda:
def lambda_handler(event, context):
ec2 = boto3.client(‘ec2’)
response = ec2.stop_instances(
InstanceIds=[
‘instance-id’
]
)
return response
Reference: Using Amazon CloudWatch Alarms
By setting up this CloudWatch alarm, the EC2 instances will automatically stop when they are not being utilized, reducing costs in the development environment.
A company has applications that process transaction requests multiple times each minute. The applications write transaction data to a single Amazon RDS DB instance. As the company begins to process more transactions, the company becomes concerned that it has no failover solution in place for disaster recovery (DR). The company needs the DB instance to fail over automatically without losing any committed transactions.
Which solution will meet these requirements?
- A . Create an RDS read replica in the same AWS Region. Configure an AWS Lambda function to promote the replica as the primary DB instance during a DR scenario.
- B . Create an RDS read replica in a different AWS Region. Configure an AWS Lambda function to promote the replica as the primary DB instance during a DR scenario.
- C . Modify the DB instance to be a Multi-AZ deployment.
- D . Setup an Amazon CloudWatch alarm that monitors the DB instance memory utilization with a threshold greater than 90%. Invoke an AWS Lambda function to restart the DB instance.
C
Explanation:
For an RDS instance that needs high availability and automatic failover capabilities, setting it up as a Multi-AZ deployment is the most effective solution:
Multi-AZ Deployment: This feature allows Amazon RDS to automatically provision and manage a synchronous standby replica of your database in a different Availability Zone (AZ). The primary DB instance and the standby replica contain the same data, providing data redundancy and fail-safe mechanism.
Automatic Failover: In the event of a planned or unplanned outage of your primary DB instance (including DB instance failure, AZ failure, or network failure), RDS automatically fails over to the standby so that database operations can resume quickly without administrative intervention.
Data Integrity: This setup ensures no data loss for committed transactions, as the standby replica is always in sync with the primary.
By enabling Multi-AZ deployment, you ensure that your database environment has high availability and robustness, addressing both disaster recovery and operational continuity without losing any committed transactions.
An application runs on multiple Amazon EC2 instances in an Auto Scaling group The Auto Scaling group is configured to use the latest version of a launch template A SysOps administrator must devise a solution that centrally manages the application logs and retains the logs for no more than 90 days
Which solution will meet these requirements?
- A . Launch an Amazon Machine Image (AMI) that is preconfigured with the Amazon CloudWatch Logs agent to send logs to an Amazon S3 bucket Apply a 90-day S3 Lifecycle policy on the S3 bucket to expire the application logs
- B . Launch an Amazon Machine Image (AMI) that is preconfigured with the Amazon CloudWatch Logs agent to send logs to a log group Create an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule to perform an instance refresh every 90 days
- C . Update the launch template user data to install and configure the Amazon CloudWatch Logs agent to send logs to a log group Configure the retention period on the log group to be 90 days
- D . Update the launch template user data to install and configure the Amazon CloudWatch Logs agent to send logs to a log group Set the log rotation configuration of the EC2 instances to 90 days
C
Explanation:
To centrally manage application logs and retain them for no more than 90 days, you can use the Amazon CloudWatch Logs agent to send logs to a CloudWatch log group and configure the log group’s retention period.
Update the Launch Template User Data:
Navigate to the EC2 console.
Select the launch template used by the Auto Scaling group.
Edit the launch template to include the following user data script:
#!/bin/bash
yum update -y
yum install -y awslogs
cat <<EOF > /etc/awslogs/awslogs.conf
[general]
state_file = /var/lib/awslogs/agent-state
[/var/log/messages]
file = /var/log/messages
log_group_name = /my-log-group
log_stream_name = {instance_id}/messages
datetime_format = %b %d %H:%M:%S
[/var/log/secure]
file = /var/log/secure
log_group_name = /my-log-group
log_stream_name = {instance_id}/secure
datetime_format = %b %d %H:%M:%S
EOF
systemctl start awslogsd
systemctl enable awslogsd
Replace /my-log-group with the name of your CloudWatch log group.
Configure the Log Group Retention Period:
Navigate to the CloudWatch console.
In the navigation pane, choose "Logs".
Select the log group created by the CloudWatch Logs agent.
Click on "Actions" and then "Edit retention settings".
Set the retention period to 90 days.
Verify the Configuration:
Ensure that logs from the EC2 instances are being sent to the CloudWatch log group.
Verify that the log group’s retention period is correctly set to 90 days.
Reference: Amazon CloudWatch Logs Agent
Setting Log Retention in CloudWatch
A company uses AWS Organizations to manage multiple AWS accounts with consolidated billing enabled. Organization member account owners want the benefits of Reserved Instances (RIs) but do not want to share RIs with other accounts.
Which solution will meet these requirements?
- A . Purchase RIs in individual member accounts. Disable Rl discount sharing in the management
account. - B . Purchase RIs in individual member accounts. Disable Rl discount sharing in the member accounts.
- C . Purchase RIs in the management account. Disable Rl discount sharing in the management account.
- D . Purchase RIs in the management account. Disable Rl discount sharing in the member accounts.
A
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ri-consolidated-billing/
RI discounts apply to accounts in an organization’s consolidated billing family depending upon whether RI sharing is turned on or off for the accounts. By default, RI sharing for all accounts in an organization is turned on. The management account of an organization can change this setting by turning off RI sharing for an account. The capacity reservation for an RI applies only to the account the RI was purchased on, no matter whether RI sharing is turned on or off.
A company uses AWS Organizations to manage multiple AWS accounts with consolidated billing enabled. Organization member account owners want the benefits of Reserved Instances (RIs) but do not want to share RIs with other accounts.
Which solution will meet these requirements?
- A . Purchase RIs in individual member accounts. Disable Rl discount sharing in the management
account. - B . Purchase RIs in individual member accounts. Disable Rl discount sharing in the member accounts.
- C . Purchase RIs in the management account. Disable Rl discount sharing in the management account.
- D . Purchase RIs in the management account. Disable Rl discount sharing in the member accounts.
A
Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-ri-consolidated-billing/
RI discounts apply to accounts in an organization’s consolidated billing family depending upon whether RI sharing is turned on or off for the accounts. By default, RI sharing for all accounts in an organization is turned on. The management account of an organization can change this setting by turning off RI sharing for an account. The capacity reservation for an RI applies only to the account the RI was purchased on, no matter whether RI sharing is turned on or off.
A company runs an application on hundreds of Amazon EC2 instances in three Availability Zones The
application calls a third-parly API over the public internet A SysOps administrator must provide the third party with a list of static IP addresses so that the third party can allow traffic from the application
Which solution will meet these requirements?
- A . Add a NAT gateway in the public subnet of each Availability Zone. Make the NAT gateway the default route of all private subnets In those Availability Zones.
- B . Allocate one Elastic IP address in each Availability Zone. Associate the Elastic IP address with all the instances in the Availability Zone
- C . Place the instances behind a Network Load Balancer (NLB). Send the traffic to the interne! through the private IP address of the NLB
- D . Update the main route table to send the traffic to the internet through an Elastic IP address that is assigned to each instance.
A
Explanation:
NAT Gateway Setup:
A NAT gateway allows instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating a connection with those instances.
Steps:
Go to the AWS Management Console.
Navigate to VPC and select "NAT Gateways."
Create a NAT gateway in the public subnet of each Availability Zone.
Allocate an Elastic IP address to each NAT gateway.
Update the route tables for the private subnets to route internet-bound traffic to the NAT gateways.
Reference: Creating a NAT Gateway
A company is using an Amazon EC2 Auto Scaling group to support a workload A Sytfhe company now needs to centruito Scaling group is configured with two similar scaling policies
dP) to centrally manage access to One scaling policy adds 5 instances when CPU utilization reaches 80%. The other sctrator can connect to the extemahen CPU utilization leaches 80%.
What will happen when CPU utilization reaches the 80% threshold?
- A . Amazon EC2 Auto Scaling will add 5 instances
- B . Amazon EC2 Auto Scaling will add 10 instances
- C . Amazon EC2 Auto Scaling will add 15 instances.
- D . The Auto Scaling group will not scale because of conflicting policies
B
Explanation:
Scaling Policies in Auto Scaling:
When multiple scaling policies trigger at the same time, each policy is executed independently.
If both policies are set to add 5 instances when CPU utilization reaches 80%, they will both be executed when the threshold is met.
Therefore, the total number of instances added will be the sum of the instances specified in both policies.
In this case, 5 instances from one policy and 5 instances from the other policy will result in a total of 10 instances being added.
Steps to Configure and Verify Scaling Policies:
Go to the AWS Management Console.
Navigate to EC2 and select "Auto Scaling Groups."
Select your Auto Scaling group and review the scaling policies.
Ensure that both scaling policies are configured to trigger at 80% CPU utilization.
Monitor the Auto Scaling group’s activity to verify the addition of instances when the CPU utilization threshold is reached.
Reference: Scaling Policies for Amazon EC2 Auto Scaling