Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #121
A SysOos administrator s tasked with analyzing database performance. The database runs on a single Amazon RDS D6 instance. The SysOps administrator finds that, during times of peak traffic, resources on the database are over utilized due to the amount of read traffic.
Which actions should the SysOps administrator take to improve RDS performance? (Select TWO.)
- A . Add a read replica.
- B . Modify the application to use Amazon ElastiCache for Memcached.
- C . Migrate the database from RDS to Amazon DynamoDB.
- D . Migrate the database to Amazon EC2 with enhanced networking enabled
- E . Upgrade the database to a Multi-AZ deployment.
Correct Answer: A, B
A, B
Explanation:
To improve RDS performance during peak traffic when resources are over-utilized due to read traffic, the SysOps administrator can take the following actions:
Add a Read Replica:
Amazon RDS Read Replicas provide enhanced performance and durability for database instances.
By creating a read replica, you can offload read traffic from the primary database instance to the replica.
This reduces the load on the primary instance and improves overall performance.
Reference: Amazon RDS Read Replicas
Modify the Application to Use Amazon ElastiCache for Memcached:
Amazon ElastiCache is a web service that makes it easy to deploy, operate, and scale an in-memory cache in the cloud.
By using ElastiCache for Memcached, you can cache frequently accessed data, reducing the number of read requests to the RDS instance.
This can significantly improve the performance of the database during peak traffic.
Reference: Amazon ElastiCache for Memcached
A, B
Explanation:
To improve RDS performance during peak traffic when resources are over-utilized due to read traffic, the SysOps administrator can take the following actions:
Add a Read Replica:
Amazon RDS Read Replicas provide enhanced performance and durability for database instances.
By creating a read replica, you can offload read traffic from the primary database instance to the replica.
This reduces the load on the primary instance and improves overall performance.
Reference: Amazon RDS Read Replicas
Modify the Application to Use Amazon ElastiCache for Memcached:
Amazon ElastiCache is a web service that makes it easy to deploy, operate, and scale an in-memory cache in the cloud.
By using ElastiCache for Memcached, you can cache frequently accessed data, reducing the number of read requests to the RDS instance.
This can significantly improve the performance of the database during peak traffic.
Reference: Amazon ElastiCache for Memcached
Question #122
A company must migrate its applications to AWS The company is using Chef recipes for configuration management The company wants to continue to use the existing Chef recipes after the applications are migrated to AWS.
What is the MOST operationally efficient solution that meets these requirements?
- A . Use AWS Cloud Format ion to create an Amazon EC2 instance, install a Chef server, and add Chef recipes.
- B . Use AWS CloudFormation to create a stack and add layers for Chef recipes.
- C . Use AWS Elastic Beanstalk with the Docker platform to upload Chef recipes.
- D . Use AWS OpsWorks to create a stack and add layers with Chef recipes.
Correct Answer: D
D
Explanation:
AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. This service is designed to work seamlessly with Chef recipes, making it the most operationally efficient solution for continuing to use existing Chef recipes after migrating applications to AWS.
Creating an OpsWorks Stack:
Open the AWS OpsWorks console at AWS OpsWorks Console.
Create a new stack and select Chef as the configuration management engine.
Adding Layers:
Add layers to the stack that represent different parts of your application. Each layer can have its own set of Chef recipes.
Assign instances to these layers as needed.
Deploying Chef Recipes:
Upload your existing Chef recipes to the OpsWorks stack.
Configure the layers to use these recipes during setup, deployment, and other lifecycle events.
Reference: AWS OpsWorks
Working with Stacks
D
Explanation:
AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. This service is designed to work seamlessly with Chef recipes, making it the most operationally efficient solution for continuing to use existing Chef recipes after migrating applications to AWS.
Creating an OpsWorks Stack:
Open the AWS OpsWorks console at AWS OpsWorks Console.
Create a new stack and select Chef as the configuration management engine.
Adding Layers:
Add layers to the stack that represent different parts of your application. Each layer can have its own set of Chef recipes.
Assign instances to these layers as needed.
Deploying Chef Recipes:
Upload your existing Chef recipes to the OpsWorks stack.
Configure the layers to use these recipes during setup, deployment, and other lifecycle events.
Reference: AWS OpsWorks
Working with Stacks
Question #123
A company wants to track its AWS costs in all member accounts that are part of an organization in AWS Organizations. Managers of the member accounts want to receive a notification when the estimated costs exceed a predetermined amount each month. The managers are unable to configure a billing alarm. The IAM permissions for all users are correct.
What could be the cause of this issue?
- A . The management/payer account does not have billing alerts turned on.
- B . The company has not configured AWS Resource Access Manager (AWS RAM) to share billing information between the member accounts and the management/payer account.
- C . Amazon GuardDuty is turned on for all the accounts.
- D . The company has not configured an AWS Config rule to monitor billing.
Correct Answer: A
A
Explanation:
For member accounts in AWS Organizations to receive notifications about estimated costs exceeding a predetermined amount, billing alerts must be enabled in the management/payer account.
Enable Billing Alerts in the Management Account:
Open the AWS Billing and Cost Management console at AWS Billing Console.
In the navigation pane, choose Billing preferences.
Under Billing preferences, ensure that Receive Billing Alerts is enabled.
Create a Budget and Set Up Notifications:
Open the AWS Budgets console at AWS Budgets Console.
Create a budget and configure it to monitor the estimated costs.
Set up notifications for when the budget thresholds are exceeded and specify the email addresses of the managers in the member accounts.
By enabling billing alerts in the management account, you allow member accounts to receive notifications about their estimated costs.
Reference: Setting Up Alerts and Notifications
Creating an AWS Budget
A
Explanation:
For member accounts in AWS Organizations to receive notifications about estimated costs exceeding a predetermined amount, billing alerts must be enabled in the management/payer account.
Enable Billing Alerts in the Management Account:
Open the AWS Billing and Cost Management console at AWS Billing Console.
In the navigation pane, choose Billing preferences.
Under Billing preferences, ensure that Receive Billing Alerts is enabled.
Create a Budget and Set Up Notifications:
Open the AWS Budgets console at AWS Budgets Console.
Create a budget and configure it to monitor the estimated costs.
Set up notifications for when the budget thresholds are exceeded and specify the email addresses of the managers in the member accounts.
By enabling billing alerts in the management account, you allow member accounts to receive notifications about their estimated costs.
Reference: Setting Up Alerts and Notifications
Creating an AWS Budget
Question #124
A SysOps administrator must ensure that all of a company’s current and future Amazon S3 buckets have logging enabled If an S3 bucket does not have logging enabled an automated process must enable logging for the S3 bucket.
Which solution will meet these requirements?
- A . Use AWS Trusted Advisor 10 perform a check for S3 buckets that do not have logging enabled Configure the check to enable logging for S3 buckets that do not have logging enabled.
- B . Configure an S3 bucket policy that requires all current and future S3 buckets to have logging enabled
- C . Use the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that uses an AWS Lambda function to enable logging.
- D . Use the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that uses the AWS-ConfigureS3BucketLoggmg AWS Systems Manager Automation runbook to enable logging.
Correct Answer: CD
CD
Explanation:
AWS Config Managed Rule for S3 Logging:
The s3-bucket-logging-enabled AWS Config rule checks whether S3 buckets have logging enabled.
Steps:
Go to the AWS Management Console.
Navigate to AWS Config.
Create a rule using s3-bucket-logging-enabled.
Add a remediation action using an AWS Lambda function or Systems Manager Automation runbook.
Reference: AWS Config Managed Rules
Using AWS Lambda for Remediation:
Create a Lambda function that enables logging on S3 buckets.
Steps:
Write a Lambda function in Python or Node.js to enable logging.
Configure the function to trigger on non-compliant buckets.
Reference: AWS Lambda
Using AWS Systems Manager Automation:
The AWS-ConfigureS3BucketLogging runbook automates enabling logging.
Steps:
Go to the AWS Management Console.
Navigate to Systems Manager.
Create an Automation document or use the existing AWS-ConfigureS3BucketLogging runbook.
Configure the remediation action to use this runbook.
Reference: AWS Systems Manager Automation
CD
Explanation:
AWS Config Managed Rule for S3 Logging:
The s3-bucket-logging-enabled AWS Config rule checks whether S3 buckets have logging enabled.
Steps:
Go to the AWS Management Console.
Navigate to AWS Config.
Create a rule using s3-bucket-logging-enabled.
Add a remediation action using an AWS Lambda function or Systems Manager Automation runbook.
Reference: AWS Config Managed Rules
Using AWS Lambda for Remediation:
Create a Lambda function that enables logging on S3 buckets.
Steps:
Write a Lambda function in Python or Node.js to enable logging.
Configure the function to trigger on non-compliant buckets.
Reference: AWS Lambda
Using AWS Systems Manager Automation:
The AWS-ConfigureS3BucketLogging runbook automates enabling logging.
Steps:
Go to the AWS Management Console.
Navigate to Systems Manager.
Create an Automation document or use the existing AWS-ConfigureS3BucketLogging runbook.
Configure the remediation action to use this runbook.
Reference: AWS Systems Manager Automation
Question #125
A company wants to monitor the security groups of its Amazon EC2 instances to ensure that SSH is not open to the public. If the port is opened, the company needs to close the port as soon as possible.
Which combination of actions should a SysOps administrator take to meet these requirements? (Select TWO.)
- A . Add an Amazon CloudWatch alarm to detect the security groups that allow SSH.
- B . Add an AWS Config rule to detect the security groups that allow SSH.
- C . Add an assessment template to Amazon Inspector to detect the security groups that allow SSH
- D . Call an AWS Systems Manager Automation runbook to close the port.
- E . Call AWS Systems Manager Run Command to close the port.
Correct Answer: B, D
B, D
Explanation:
To monitor and automatically respond to security groups allowing SSH access:
AWS Config: This service can be used to detect security groups that allow SSH access publicly (Option B). AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.
AWS Systems Manager Automation: This can automatically execute actions like closing the port when a non-compliant security group is detected (Option D). It allows the execution of automated workflows that can respond to Config rule findings, ensuring immediate remediation actions such as closing ports. These two services combined offer a comprehensive solution to monitor, detect, and rectify unwanted security group configurations automatically. AWS documentation on AWS Config AWS Config and on Systems Manager Automation Systems Manager Automation provides additional insights.
B, D
Explanation:
To monitor and automatically respond to security groups allowing SSH access:
AWS Config: This service can be used to detect security groups that allow SSH access publicly (Option B). AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.
AWS Systems Manager Automation: This can automatically execute actions like closing the port when a non-compliant security group is detected (Option D). It allows the execution of automated workflows that can respond to Config rule findings, ensuring immediate remediation actions such as closing ports. These two services combined offer a comprehensive solution to monitor, detect, and rectify unwanted security group configurations automatically. AWS documentation on AWS Config AWS Config and on Systems Manager Automation Systems Manager Automation provides additional insights.
Question #126
A company is running Amazon RDS for PostgreSOL Multi-AZ DB clusters. The company uses an AWS Cloud Formation template to create the databases individually with a default size of 100 GB. The company creates the databases every Monday and deletes the databases every Friday.
Occasionally, the databases run low on disk space and initiate an Amazon CloudWatch alarm. A SysOps administrator must prevent the databases from running low on disk space in the future.
Which solution will meet these requirements with the FEWEST changes to the application?
- A . Modify the CloudFormation template to use Amazon Aurora PostgreSOL as the DB engine.
- B . Modify the CloudFormation template to use Amazon DynamoDB as the database. Activate storage auto scaling during creation of the tables
- C . Modify the Cloud Formation template to activate storage auto scaling on the existing DB instances.
- D . Create a CloudWatch alarm to monitor DB instance storage space. Configure the alarm to invoke the VACUUM command.
Correct Answer: C
C
Explanation:
To prevent Amazon RDS for PostgreSQL Multi-AZ DB instances from running low on disk space, enabling storage auto-scaling is the most straightforward solution. This feature automatically adjusts the storage capacity of the DB instance when it approaches its limit, thus preventing the database from running out of space and triggering CloudWatch alarms. Option C is the least intrusive and most effective solution as it only requires a modification to the existing CloudFormation template to enable auto-scaling on storage. For reference, see AWS documentation on managing RDS storage automatically Managing RDS Storage Automatically.
C
Explanation:
To prevent Amazon RDS for PostgreSQL Multi-AZ DB instances from running low on disk space, enabling storage auto-scaling is the most straightforward solution. This feature automatically adjusts the storage capacity of the DB instance when it approaches its limit, thus preventing the database from running out of space and triggering CloudWatch alarms. Option C is the least intrusive and most effective solution as it only requires a modification to the existing CloudFormation template to enable auto-scaling on storage. For reference, see AWS documentation on managing RDS storage automatically Managing RDS Storage Automatically.
Question #127
A SysOps administrator is unable to authenticate an AWS CLI call to an AWS service.
Which of the following is the cause of this issue?
- A . The IAM password is incorrect
- B . The server certificate is missing
- C . The SSH key pair is incorrect
- D . There is no access key
Correct Answer: D
D
Explanation:
The most likely reason for being unable to authenticate an AWS CLI call to an AWS service is the absence of an access key. AWS CLI requires an access key and secret key to authenticate requests.
Access Key and Secret Key:
AWS uses access keys to identify and authenticate the identity of the requester. Ensure that the AWS CLI is configured with a valid access key and secret key. Check AWS CLI Configuration:
Use the aws configure command to set up the AWS CLI with the necessary credentials. Verify that the ~/.aws/credentials file contains the correct access key and secret key.
Reference: AWS CLI Configuration
Managing Access Keys
D
Explanation:
The most likely reason for being unable to authenticate an AWS CLI call to an AWS service is the absence of an access key. AWS CLI requires an access key and secret key to authenticate requests.
Access Key and Secret Key:
AWS uses access keys to identify and authenticate the identity of the requester. Ensure that the AWS CLI is configured with a valid access key and secret key. Check AWS CLI Configuration:
Use the aws configure command to set up the AWS CLI with the necessary credentials. Verify that the ~/.aws/credentials file contains the correct access key and secret key.
Reference: AWS CLI Configuration
Managing Access Keys
Question #128
A SysOps administrator configuring AWS Client VPN to connect use’s on a corporate network to AWS resources mat are running in a VPC According to compliance requirements, only traffic that is destined for the VPC can travel across the VPN tunnel.
How should the SysOps administrator configure Client VPN to meet these requirements?
- A . Associate the Client VPN endpoint with a private subnet that has an internet route through a NAT gateway.
- B . On the Client VPN endpoint, turns on the split-tunnel option.
- C . On the Client VPN endpoint, specify DNS server IP addresses
- D . Select a private certificate to use as the identity certificate tor the VPN client.
Correct Answer: B
B
Explanation:
Split-tunnel routing allows you to specify that only the traffic destined for your VPC is routed through the VPN tunnel. All other internet traffic is routed through the user’s local network.
Steps:
Open the Client VPN Console:
Sign in to the AWS Management Console.
Open the Amazon VPC console.
Modify the Client VPN Endpoint:
Select the Client VPN endpoint.
Choose "Modify Client VPN endpoint".
Enable the "Split-tunnel" option.
Update Route Table:
Ensure that the route table associated with the Client VPN endpoint routes traffic destined for the VPC IP range to the appropriate target (e.g., VPC subnet).
This configuration ensures that only traffic destined for resources in the VPC is sent over the VPN tunnel, while other traffic uses the user’s local internet connection.
Reference: Split-Tunnel VPN Routing
AWS Client VPN Documentation
B
Explanation:
Split-tunnel routing allows you to specify that only the traffic destined for your VPC is routed through the VPN tunnel. All other internet traffic is routed through the user’s local network.
Steps:
Open the Client VPN Console:
Sign in to the AWS Management Console.
Open the Amazon VPC console.
Modify the Client VPN Endpoint:
Select the Client VPN endpoint.
Choose "Modify Client VPN endpoint".
Enable the "Split-tunnel" option.
Update Route Table:
Ensure that the route table associated with the Client VPN endpoint routes traffic destined for the VPC IP range to the appropriate target (e.g., VPC subnet).
This configuration ensures that only traffic destined for resources in the VPC is sent over the VPN tunnel, while other traffic uses the user’s local internet connection.
Reference: Split-Tunnel VPN Routing
AWS Client VPN Documentation
Question #129
A company wants to track its expenditures for Amazon EC2 and Amazon RDS within AWS. The company decides to implement more rigorous tagging requirements for resources in its AWS accounts. A SysOps administrator needs to identify all noncompliant resources.
What is the MOST operationally efficient solution that meets these requirements?
- A . Create a rule in Amazon EventBridge (Amazon CloudWatch Events) that invokes a custom AWS Lambda function that will evaluate all created or updated resources for the specified tags.
- B . Create a rule in AWS Config that invokes a custom AWS Lambda function that will evaluate all resources for the specified tags.
- C . Create a rule in AWS Config with the required-tags managed rule to evaluate all resources for the specified tags.
- D . Create a rule in Amazon EventBridge (Amazon CloudWatch Events) with a managed rule to evaluate all created or updated resources for the specified tags.
Correct Answer: C
C
Explanation:
To efficiently monitor and identify noncompliant resources in terms of tagging within AWS, using
AWS Config with a managed rule for required tagging is most appropriate:
AWS Config Setup: Configure AWS Config to monitor and record configurations of AWS resources within your environment.
Managed Rule for Required Tags: Utilize the "required-tags" managed rule in AWS Config, which checks whether your resources have the specific tags you define as mandatory. This rule can be customized to specify which tags are required and can automatically evaluate all existing and new resources in your environment.
Compliance Reporting: AWS Config provides detailed compliance reporting that helps you identify resources that do not meet the tagging requirements, facilitating easy remediation.
This approach leverages AWS Config’s capabilities for continuous monitoring and evaluation without needing to write custom code or manage additional services, providing an operationally efficient solution for compliance management.
C
Explanation:
To efficiently monitor and identify noncompliant resources in terms of tagging within AWS, using
AWS Config with a managed rule for required tagging is most appropriate:
AWS Config Setup: Configure AWS Config to monitor and record configurations of AWS resources within your environment.
Managed Rule for Required Tags: Utilize the "required-tags" managed rule in AWS Config, which checks whether your resources have the specific tags you define as mandatory. This rule can be customized to specify which tags are required and can automatically evaluate all existing and new resources in your environment.
Compliance Reporting: AWS Config provides detailed compliance reporting that helps you identify resources that do not meet the tagging requirements, facilitating easy remediation.
This approach leverages AWS Config’s capabilities for continuous monitoring and evaluation without needing to write custom code or manage additional services, providing an operationally efficient solution for compliance management.
Question #130
A manufacturing company uses an Amazon RDS DB instance to store inventory of all stock items. The company maintains several AWS Lambda functions that interact with the database to add, update, and delete items. The Lambda functions use hardcoded credentials to connect to the database.
A SysOps administrator must ensure that the database credentials are never stored in plaintext and that the password is rotated every 30 days.
Which solution will meet these requirements in the MOST operationally efficient manner?
- A . Store the database password as an environment variable for each Lambda function. Create a new Lambda function that is named
PasswordRotate. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and update the environment variable for each Lambda function. - B . Use AWS Key Management Service (AWS KMS) to encrypt the database password and to store the encrypted password as an environment
variable for each Lambda function. Grant each Lambda function access to the KMS key so that the
database password can be decrypted when required. Create a new Lambda function that is named PasswordRotate to change the password every 30 days. - C . Use AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from SecretsManager.
- D . Use AWS Systems Manager Parameter Store to create a secure string to store credentials for the database. Create a new Lambda function called PasswordRotate. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and to update the secret within Parameter Store. Update each Lambda function to access the database password from Parameter Store.
Correct Answer: C
C
Explanation:
To ensure that database credentials are never stored in plaintext and the password is rotated every 30 days, use AWS Secrets Manager:
Store Credentials in Secrets Manager:
Open the AWS Secrets Manager console.
Click on "Store a new secret."
Select "RDS database credentials" and provide the necessary details (username, password, database instance).
Configure the secret’s name and details.
Enable Automatic Rotation:
During the secret creation process, enable automatic rotation.
Specify an automatic rotation schedule of 30 days.
Choose the Lambda function that Secrets Manager will use to update the database password automatically.
Update Lambda Functions:
Update each Lambda function to retrieve the database password from Secrets Manager.
Use the AWS SDK in your Lambda code to access Secrets Manager and fetch the secret value.
Reference: AWS Secrets Manager
Rotating AWS Secrets Manager Secrets
Retrieve Secrets from AWS Lambda
C
Explanation:
To ensure that database credentials are never stored in plaintext and the password is rotated every 30 days, use AWS Secrets Manager:
Store Credentials in Secrets Manager:
Open the AWS Secrets Manager console.
Click on "Store a new secret."
Select "RDS database credentials" and provide the necessary details (username, password, database instance).
Configure the secret’s name and details.
Enable Automatic Rotation:
During the secret creation process, enable automatic rotation.
Specify an automatic rotation schedule of 30 days.
Choose the Lambda function that Secrets Manager will use to update the database password automatically.
Update Lambda Functions:
Update each Lambda function to retrieve the database password from Secrets Manager.
Use the AWS SDK in your Lambda code to access Secrets Manager and fetch the secret value.
Reference: AWS Secrets Manager
Rotating AWS Secrets Manager Secrets
Retrieve Secrets from AWS Lambda