Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #130
A manufacturing company uses an Amazon RDS DB instance to store inventory of all stock items. The company maintains several AWS Lambda functions that interact with the database to add, update, and delete items. The Lambda functions use hardcoded credentials to connect to the database.
A SysOps administrator must ensure that the database credentials are never stored in plaintext and that the password is rotated every 30 days.
Which solution will meet these requirements in the MOST operationally efficient manner?
- A . Store the database password as an environment variable for each Lambda function. Create a new Lambda function that is named
PasswordRotate. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and update the environment variable for each Lambda function. - B . Use AWS Key Management Service (AWS KMS) to encrypt the database password and to store the encrypted password as an environment
variable for each Lambda function. Grant each Lambda function access to the KMS key so that the
database password can be decrypted when required. Create a new Lambda function that is named PasswordRotate to change the password every 30 days. - C . Use AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from SecretsManager.
- D . Use AWS Systems Manager Parameter Store to create a secure string to store credentials for the database. Create a new Lambda function called PasswordRotate. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and to update the secret within Parameter Store. Update each Lambda function to access the database password from Parameter Store.
Correct Answer: C
C
Explanation:
To ensure that database credentials are never stored in plaintext and the password is rotated every 30 days, use AWS Secrets Manager:
Store Credentials in Secrets Manager:
Open the AWS Secrets Manager console.
Click on "Store a new secret."
Select "RDS database credentials" and provide the necessary details (username, password, database instance).
Configure the secret’s name and details.
Enable Automatic Rotation:
During the secret creation process, enable automatic rotation.
Specify an automatic rotation schedule of 30 days.
Choose the Lambda function that Secrets Manager will use to update the database password automatically.
Update Lambda Functions:
Update each Lambda function to retrieve the database password from Secrets Manager.
Use the AWS SDK in your Lambda code to access Secrets Manager and fetch the secret value.
Reference: AWS Secrets Manager
Rotating AWS Secrets Manager Secrets
Retrieve Secrets from AWS Lambda
C
Explanation:
To ensure that database credentials are never stored in plaintext and the password is rotated every 30 days, use AWS Secrets Manager:
Store Credentials in Secrets Manager:
Open the AWS Secrets Manager console.
Click on "Store a new secret."
Select "RDS database credentials" and provide the necessary details (username, password, database instance).
Configure the secret’s name and details.
Enable Automatic Rotation:
During the secret creation process, enable automatic rotation.
Specify an automatic rotation schedule of 30 days.
Choose the Lambda function that Secrets Manager will use to update the database password automatically.
Update Lambda Functions:
Update each Lambda function to retrieve the database password from Secrets Manager.
Use the AWS SDK in your Lambda code to access Secrets Manager and fetch the secret value.
Reference: AWS Secrets Manager
Rotating AWS Secrets Manager Secrets
Retrieve Secrets from AWS Lambda
Question #132
A company is using Amazon Elastic File System (Amazon EFS) to share a file system among several
Amazon EC2 instances. As usage increases, users report that file retrieval from the EFS file system is slower than normal.
Which action should a SysOps administrator take to improve the performance of the file system?
- A . Configure the file system for Provisioned Throughput.
- B . Enable encryption in transit on the file system.
- C . Identify any unused files in the file system, and remove the unused files.
- D . Resize the Amazon Elastic Block Store (Amazon EBS) volume of each of the EC2 instances.
Correct Answer: A
A
Explanation:
To improve the performance of an Amazon Elastic File System (EFS) when users report slower file retrieval times, configuring the file system for Provisioned Throughput is an effective solution.
Login to AWS Management Console:
Open the Amazon EFS console at Amazon EFS Console.
Select the File System:
In the EFS console, select the file system that you want to modify.
Modify Throughput Settings:
Choose File system policy and then Manage file system policy.
Under Throughput mode, select Provisioned Throughput.
Specify the desired throughput in MiB/s based on your application’s needs.
Apply Changes:
Save the changes to apply the new throughput settings to the file system.
Reference: Amazon EFS Performance
Managing Throughput Modes
A
Explanation:
To improve the performance of an Amazon Elastic File System (EFS) when users report slower file retrieval times, configuring the file system for Provisioned Throughput is an effective solution.
Login to AWS Management Console:
Open the Amazon EFS console at Amazon EFS Console.
Select the File System:
In the EFS console, select the file system that you want to modify.
Modify Throughput Settings:
Choose File system policy and then Manage file system policy.
Under Throughput mode, select Provisioned Throughput.
Specify the desired throughput in MiB/s based on your application’s needs.
Apply Changes:
Save the changes to apply the new throughput settings to the file system.
Reference: Amazon EFS Performance
Managing Throughput Modes
Question #133
A company has migrated its application to AWS. The company will host the application on Amazon EC2 instances of multiple instance families.
During initial testing, a SysOps administrator identifies performance issues on selected EC2 instances. The company has a strict budget allocation policy, so the SysOps administrator must use the right resource types with the performance characteristics to match the workload.
What should the SysOps administrator do to meet this requirement?
- A . Purchase regional Reserved Instances (RIs) for immediate cost savings. Review and take action on the EC2 rightsizing recommendations in Cost Explorer. Exchange the RIs for the optimal instance family after rightsizing.
- B . Purchase zonal Reserved Instances (RIs) for the existing instances. Monitor the RI utilization in the AWS Billing and Cost Management console. Make adjustments to instance sizes to optimize utilization.
- C . Review and take action on AWS Compute Optimizer recommendations. Purchase Compute Savings Plans to reduce the cost that is required to run the compute resources. Most Voted
- D . Review resource utilization metrics in the AWS Cost and Usage Report. Rightsize the EC2 instances.
Create On-Demand Capacity Reservations for the rightsized resources.
Correct Answer: C
C
Explanation:
When managing performance and cost for EC2 instances across different families, the following steps are recommended:
Utilize AWS Compute Optimizer: This service provides recommendations for EC2 instances based on historical usage patterns and existing configurations. It helps identify optimal EC2 instance types and sizes that could deliver better performance and cost savings for your specific workload.
Implement Compute Savings Plans: After determining the most suitable instance types and sizes through Compute Optimizer, purchasing Compute Savings Plans can offer significant cost savings. These savings plans apply to any instance family across any region, providing flexibility and cost efficiency without upfront commitment to specific instance types.
AWS Documentation
Reference: Further details can be found in the AWS documentation on Compute Optimizer and Compute Savings Plans:
AWS Compute Optimizer
AWS Compute Savings Plans.
C
Explanation:
When managing performance and cost for EC2 instances across different families, the following steps are recommended:
Utilize AWS Compute Optimizer: This service provides recommendations for EC2 instances based on historical usage patterns and existing configurations. It helps identify optimal EC2 instance types and sizes that could deliver better performance and cost savings for your specific workload.
Implement Compute Savings Plans: After determining the most suitable instance types and sizes through Compute Optimizer, purchasing Compute Savings Plans can offer significant cost savings. These savings plans apply to any instance family across any region, providing flexibility and cost efficiency without upfront commitment to specific instance types.
AWS Documentation
Reference: Further details can be found in the AWS documentation on Compute Optimizer and Compute Savings Plans:
AWS Compute Optimizer
AWS Compute Savings Plans.
Question #134
A SysOps administrator manages a company’s Amazon S3 buckets. The SysOps administrator has identified 5 GB of incomplete multipart uploads in an S3 bucket in the company’s AWS account. The SysOps administrator needs to reduce the number of incomplete multipart upload objects in the S3 bucket.
Which solution will meet this requirement?
- A . Create an S3 Lifecycle rule on the S3 bucket to delete expired markers or incomplete multipart uploads
- B . Require users that perform uploads of files into Amazon S3 to use the S3 TransferUtility.
- C . Enable S3 Versioning on the S3 bucket that contains the incomplete multipart uploads.
- D . Create an S3 Object Lambda Access Point to delete incomplete multipart uploads.
Correct Answer: A
A
Explanation:
To manage incomplete multipart uploads in an Amazon S3 bucket, creating an S3 Lifecycle rule to specifically address these uploads is the most effective method. The rule can be configured to automatically delete expired multipart upload parts, which helps in cleaning up unused data and reducing storage costs. Option A is correct as it directly addresses the requirement to manage incomplete uploads effectively. Reference on setting up S3 Lifecycle policies can be found here Amazon S3 Lifecycle.
A
Explanation:
To manage incomplete multipart uploads in an Amazon S3 bucket, creating an S3 Lifecycle rule to specifically address these uploads is the most effective method. The rule can be configured to automatically delete expired multipart upload parts, which helps in cleaning up unused data and reducing storage costs. Option A is correct as it directly addresses the requirement to manage incomplete uploads effectively. Reference on setting up S3 Lifecycle policies can be found here Amazon S3 Lifecycle.
Question #135
A company is hosting applications on Amazon EC2 instances. The company is hosting a database on an Amazon RDS for PostgreSQL DB instance. The company requires all connections to the DB instance to be encrypted.
What should a SysOps administrator do to meet this requirement?
- A . Allow SSL connections to the database by using an inbound security group rule.
- B . Encrypt the database by using an AWS Key Management Service (AWS KMS) encryption key.
- C . Enforce SSL connections to the database by using a custom parameter group.
- D . Patch the database with SSL/TLS by using a custom PostgreSQL extension.
Correct Answer: C
C
Explanation:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.SSL.htm
Amazon RDS supports SSL/TLS encryption for connections to the database, and this can be enabled by creating a custom parameter group and setting the rds.force_ssl parameter to 1. This will ensure that all connections to the database are encrypted, protecting the data and maintaining compliance with the company’s requirements.l
C
Explanation:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.SSL.htm
Amazon RDS supports SSL/TLS encryption for connections to the database, and this can be enabled by creating a custom parameter group and setting the rds.force_ssl parameter to 1. This will ensure that all connections to the database are encrypted, protecting the data and maintaining compliance with the company’s requirements.l
Question #136
A company stores files on 50 Amazon S3 buckets in the same AWS Region The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost
Which solution will meet these requirements?
- A . Create a gateway VPC endpoint lor each S3 bucket Attach the gateway VPC endpoints to each subnet inside the VPC
- B . Create an interface VPC endpoint (or each S3 bucket Attach the interface VPC endpoints to each subnet inside the VPC
- C . Create one gateway VPC endpoint for all the S3 buckets Add the gateway VPC endpoint to the VPC route table
- D . Create one interface VPC endpoint for all the S3 buckets Add the interface VPC endpoint to the VPC route table
Correct Answer: C
C
Explanation:
To securely connect to Amazon S3 buckets from Amazon EC2 instances over a private connection without incurring additional costs, you can use a gateway VPC endpoint for S3. This method allows you to create a single gateway VPC endpoint for all S3 buckets in the same region, ensuring secure, private communication.
Create a Gateway VPC Endpoint:
Navigate to the VPC console.
In the navigation pane, choose "Endpoints" and then click "Create Endpoint".
Select "AWS services" and then choose "com.amazonaws.<region>.s3" from the service name dropdown.
Select the VPC in which to create the endpoint and the appropriate route tables.
Click "Create endpoint".
Update the Route Tables:
The gateway VPC endpoint will automatically update the selected route tables to include routes that direct S3 traffic through the endpoint.
Ensure that the route tables associated with your subnets include routes for the S3 service pointing to the gateway VPC endpoint.
Verify the Configuration:
Ensure that instances in the VPC can access the S3 buckets using private IP addresses.
Check the routing configuration to confirm that traffic to S3 is routed through the gateway VPC endpoint.
Reference: Gateway VPC Endpoints for Amazon S3
Creating a Gateway Endpoint
C
Explanation:
To securely connect to Amazon S3 buckets from Amazon EC2 instances over a private connection without incurring additional costs, you can use a gateway VPC endpoint for S3. This method allows you to create a single gateway VPC endpoint for all S3 buckets in the same region, ensuring secure, private communication.
Create a Gateway VPC Endpoint:
Navigate to the VPC console.
In the navigation pane, choose "Endpoints" and then click "Create Endpoint".
Select "AWS services" and then choose "com.amazonaws.<region>.s3" from the service name dropdown.
Select the VPC in which to create the endpoint and the appropriate route tables.
Click "Create endpoint".
Update the Route Tables:
The gateway VPC endpoint will automatically update the selected route tables to include routes that direct S3 traffic through the endpoint.
Ensure that the route tables associated with your subnets include routes for the S3 service pointing to the gateway VPC endpoint.
Verify the Configuration:
Ensure that instances in the VPC can access the S3 buckets using private IP addresses.
Check the routing configuration to confirm that traffic to S3 is routed through the gateway VPC endpoint.
Reference: Gateway VPC Endpoints for Amazon S3
Creating a Gateway Endpoint
Question #137
A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted.
What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?
- A . Set up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
- B . Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.
- C . Create an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
- D . Use AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.
Correct Answer: B
B
Explanation:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
If you’re using AWS Organizations, check the service control policies for any statements that explicitly deny Amazon S3 access. In particular, check the service control policies for statements denying the s3:PutBucketPolicy action. https://aws.amazon.com/tw/premiumsupport/knowledge-center/s3-access-denied-bucket-policy/
B
Explanation:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
If you’re using AWS Organizations, check the service control policies for any statements that explicitly deny Amazon S3 access. In particular, check the service control policies for statements denying the s3:PutBucketPolicy action. https://aws.amazon.com/tw/premiumsupport/knowledge-center/s3-access-denied-bucket-policy/
Question #138
A company needs to monitor the disk utilization of Amazon Elastic Block Store (Amazon EBS) volumes The EBS volumes are attached to Amazon EC2 Linux Instances A SysOps administrator must set up an Amazon CloudWatch alarm that provides an alert when disk utilization increases to more than 80%.
Which combination of steps must the SysOps administrator lake lo meet these requirements? (Select THREE.)
- A . Create an 1AM role that includes the Cloud Watch AgentServerPol icy AWS managed policy Attach me role to the instances
- B . Create an 1AM role that includes the CloudWatchApplicationInsightsReadOnlyAccess AWS managed policy. Attach the role to the instances
- C . Install and start the CloudWatch agent by using AWS Systems Manager or the command line
- D . Install and start the CloudWatch agent by using an 1AM role. Attach the Cloud Watch AgentServerPolicy AWS managed policy to the role.
- E . Configure a CloudWatch alarm to enter ALARM state when the disk_used_percent CloudWatch metric is greater than 80%.
- F . Configure a CloudWatch alarm to enter ALARM state when the disk_used CloudWatch metric is greater than 80% or when the disk_free CloudWatch metric is less than 20%.
Correct Answer: A, C, E
A, C, E
Explanation:
Create an IAM role with the CloudWatchAgentServerPolicy:
This policy grants the necessary permissions for the CloudWatch agent to collect and send metrics.
Steps:
Go to the AWS Management Console.
Navigate to IAM and create a new role.
Choose "EC2" as the trusted entity.
Attach the "CloudWatchAgentServerPolicy" managed policy to the role.
Attach this IAM role to your EC2 instances.
Reference: AWS IAM Roles
Install and start the CloudWatch agent:
The CloudWatch agent must be installed and configured to collect disk utilization metrics.
Steps:
Use AWS Systems Manager or SSH to connect to your instances.
Install the CloudWatch agent using the following commands:
sudo yum install amazon-cloudwatch-agent
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 –
c file:/path/to/your-config-file.json -s Start the agent:
sudo systemctl start amazon-cloudwatch-agent Configure a CloudWatch alarm:
Create an alarm based on the disk_used_percent metric. Steps:
Go to the AWS Management Console.
Navigate to CloudWatch and select "Alarms" from the left-hand menu. Click on "Create alarm."
Select the disk_used_percent metric.
Set the threshold to 80% and configure the alarm actions (e.g., sending a notification).
Reference: Creating a CloudWatch Alarm
A, C, E
Explanation:
Create an IAM role with the CloudWatchAgentServerPolicy:
This policy grants the necessary permissions for the CloudWatch agent to collect and send metrics.
Steps:
Go to the AWS Management Console.
Navigate to IAM and create a new role.
Choose "EC2" as the trusted entity.
Attach the "CloudWatchAgentServerPolicy" managed policy to the role.
Attach this IAM role to your EC2 instances.
Reference: AWS IAM Roles
Install and start the CloudWatch agent:
The CloudWatch agent must be installed and configured to collect disk utilization metrics.
Steps:
Use AWS Systems Manager or SSH to connect to your instances.
Install the CloudWatch agent using the following commands:
sudo yum install amazon-cloudwatch-agent
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 –
c file:/path/to/your-config-file.json -s Start the agent:
sudo systemctl start amazon-cloudwatch-agent Configure a CloudWatch alarm:
Create an alarm based on the disk_used_percent metric. Steps:
Go to the AWS Management Console.
Navigate to CloudWatch and select "Alarms" from the left-hand menu. Click on "Create alarm."
Select the disk_used_percent metric.
Set the threshold to 80% and configure the alarm actions (e.g., sending a notification).
Reference: Creating a CloudWatch Alarm
Question #139
A Sysops administrator creates an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that uses AWS Fargate. The cluster is deployed successfully. The Sysops administrator needs to manage the cluster by using the kubect1 command line tool.
Which of the following must be configured on the Sysops administrator’s machine so that kubect1 can communicate with the cluster API server?
- A . The kubeconfig file
- B . The kube-proxy Amazon EKS add-on
- C . The Fargate profile
- D . The eks-connector.yaml file
Correct Answer: A
A
Explanation:
The kubeconfig file is a configuration file used to store cluster authentication information, which is required to make requests to the Amazon EKS cluster API server. The kubeconfig file will need to be configured on the SysOps administrator’s machine in order for kubectl to be able to communicate with the cluster API server.
https://aws.amazon.com/blogs/developer/running-a-kubernetes-job-in-amazon-eks-on-aws-fargate-using-aws-stepfunctions/
A
Explanation:
The kubeconfig file is a configuration file used to store cluster authentication information, which is required to make requests to the Amazon EKS cluster API server. The kubeconfig file will need to be configured on the SysOps administrator’s machine in order for kubectl to be able to communicate with the cluster API server.
https://aws.amazon.com/blogs/developer/running-a-kubernetes-job-in-amazon-eks-on-aws-fargate-using-aws-stepfunctions/
Question #140
A SysOps administrator needs to create a report that shows how many bytes are sent to and received from each target group member for an Application Load Balancer (ALB).
Which combination of steps should the SysOps administrator take to meet these requirements? (Select TWO.)
- A . Enable access logging for the ALB. Save the logs to an Amazon S3 bucket.
- B . Install the Amazon CloudWatch agent on the Instances in the target group.
- C . Use Amazon Athena to query the ALB logs Query the table Use the received_bytes and senl_byt.es fields to calculate the total bytes grouped by the target:port field.
- D . Use Amazon Athena to query the ALB logs Query the table. Use the received_bytes and
sent_byt.es fields to calculate the total bytes grouped by the clientport field - E . Create an Amazon CloudWatch dashboard that shows the Sum statistic of the ProcessedBytes metric for the ALB.
Correct Answer: AC
AC
Explanation:
Enable Access Logging for the ALB:
Access logging provides detailed information about requests sent to your load balancer.
Steps:
Go to the AWS Management Console.
Navigate to EC2 and select "Load Balancers."
Select your Application Load Balancer.
Under the "Attributes" tab, enable "Access logs."
Specify an S3 bucket where the logs will be saved.
Reference: Enable Access Logs for Your Load Balancer
Use Amazon Athena to Query the ALB Logs:
Athena allows you to run SQL queries on data stored in S3.
Steps:
Go to the AWS Management Console.
Navigate to Athena.
Create a table for the ALB logs using the appropriate schema.
Run queries to calculate the total bytes sent and received, grouped by the target field.
Example query:
SELECT target, SUM(received_bytes) as total_received, SUM(sent_bytes) as total_sent
FROM alb_logs
GROUP BY target, port
Reference: Analyzing Elastic Load Balancing Logs in Athena
AC
Explanation:
Enable Access Logging for the ALB:
Access logging provides detailed information about requests sent to your load balancer.
Steps:
Go to the AWS Management Console.
Navigate to EC2 and select "Load Balancers."
Select your Application Load Balancer.
Under the "Attributes" tab, enable "Access logs."
Specify an S3 bucket where the logs will be saved.
Reference: Enable Access Logs for Your Load Balancer
Use Amazon Athena to Query the ALB Logs:
Athena allows you to run SQL queries on data stored in S3.
Steps:
Go to the AWS Management Console.
Navigate to Athena.
Create a table for the ALB logs using the appropriate schema.
Run queries to calculate the total bytes sent and received, grouped by the target field.
Example query:
SELECT target, SUM(received_bytes) as total_received, SUM(sent_bytes) as total_sent
FROM alb_logs
GROUP BY target, port
Reference: Analyzing Elastic Load Balancing Logs in Athena