Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company hosts a database on an Amazon RDS Multi-AZ DB instance. The database is not encrypted.
The company’s new security policy requires all AWS resources to be encrypted at rest and in transit.
What should a SysOps administrator do to encrypt the database?
- A . Configure encryption on the existing DB instance.
- B . Take a snapshot of the DB instance. Encrypt the snapshot. Restore the snapshot to the same DB instance.
- C . Encrypt the standby replica in a secondary Availability Zone. Promote the standby replica to the primary DB instance.
- D . Take a snapshot of the DB instance. Copy and encrypt the snapshot. Create a new DB instance by restoring the encrypted copy.
D
Explanation:
To encrypt an existing Amazon RDS DB instance that is not encrypted, you cannot directly enable encryption. Instead, you need to follow these steps:
Take a Snapshot:
Open the Amazon RDS console at Amazon RDS Console.
Select the DB instance and take a snapshot.
Copy and Encrypt the Snapshot:
After the snapshot is created, select the snapshot and choose Copy Snapshot. In the copy snapshot dialog, enable encryption and choose a KMS key. Restore the Encrypted Snapshot:
Once the encrypted snapshot is created, select it and choose Restore Snapshot. Provide the necessary details to create a new DB instance from the encrypted snapshot. This process ensures that the new DB instance is encrypted at rest.
Reference: Encrypting Amazon RDS Resources
Copying an Amazon RDS Snapshot
A company recently migrated its application to a VPC on AWS. An AWS Site-to-Site VPN connection connects the company’s on-premises network to the VPC. The application retrieves customer data from another system that resides on premises. The application uses an on-premises DNS server to resolve domain records. After the migration, the application is not able to connect to the customer data because of name resolution errors.
Which solution will give the application the ability to resolve the internal domain names?
- A . Launch EC2 instances in the VPC. On the EC2 instances, deploy a custom DNS forwarder that forwards all DNS requests to the on-premises DNS server. Create an Amazon Route 53 private hosted zone that uses the EC2 instances for name servers.
- B . Create an Amazon Route 53 Resolver outbound endpoint. Configure the outbound endpoint to forward DNS queries against the on-premises domain to the on-premises DNS server.
- C . Set up two AWS Direct Connect connections between the AWS environment and the on-premises network. Set up a link aggregation group (LAG) that includes the two connections. Change the VPC resolver address to point to the on-premises DNS server.
- D . Create an Amazon Route 53 public hosted zone for the on-premises domain. Configure the network ACLs to forward DNS requests against the on-premises domain to the Route 53 public hosted zone.
B
Explanation:
https://docs.aws.amazon.com/zh_tw/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html
To give the application the ability to resolve internal domain names, the SysOps administrator should create an Amazon Route 53 Resolver outbound endpoint and configure it to forward DNS queries to the on-premises DNS server.
Route 53 Resolver Outbound Endpoint:
An outbound endpoint enables DNS queries to be forwarded from AWS resources in a VPC to an on-premises DNS server.
Steps to Implement:
In the Route 53 console, create a new outbound endpoint in the VPC.
Configure the outbound endpoint with the IP address of the on-premises DNS server.
Update the VPC DNS settings to use the Route 53 Resolver.
Reference: Route 53 Resolver Endpoints
Creating an Outbound Endpoint
A company needs to implement a managed file system to host Windows file shares for users on premises. Resources in the AWS Cloud also need access to the data on these file shares. A SysOps administrator needs to present the user file shares on premises and make the user file shares available on AWS with minimum latency.
What should the SysOps administrator do to meet these requirements?
- A . Set up an Amazon S3 File Gateway.
- B . Set up an AWS Direct Connect connection.
- C . Use AWS DataSync to automate data transfers between the existing file servers and AWS.
- D . Set up an Amazon FSx File Gateway.
D
Explanation:
Amazon FSx provides a fully managed file system that is optimized for Windows-based workloads and can be used to create file shares that can be accessed both on premises and in the AWS Cloud. The file shares that are created in Amazon FSx are highly available and can be accessed with low latency. Additionally, Amazon FSx supports Windows-based authentication, making it easy to integrate with existing Windows user accounts.
Reference: [1] https://aws.amazon.com/fsx/ [2] https://aws.amazon.com/storage/file-storage/ [3] https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-
is.html [4] https://aws.amazon.com/premiumsupport/knowledge-center/fsx-file-gateway-access/
A SysOps administrator is testing an application mat is hosted on five Amazon EC2 instances. The instances run in an Auto Scaling group behind an Application Load Balancer (ALB) High CPU utilization during load testing is causing the Auto Scaling group to scale out. The SysOps administrator must troubleshoot to find the root cause of the high CPU utilization before the Auto Scaling group scales out.
Which action should the SysOps administrator take to meet these requirements?
- A . Enable instance scale-in protection.
- B . Place the instance into the Standby stale.
- C . Remove the listener from the ALB
- D . Suspend the Launch and Terminate process types.
D
Explanation:
To troubleshoot high CPU utilization during load testing without scaling out, the SysOps administrator should suspend the Launch and Terminate process types in the Auto Scaling group.
Suspending Processes:
Suspending the Launch and Terminate processes will temporarily stop the Auto Scaling group from adding or removing instances, allowing for troubleshooting without automatic scaling interruptions.
This ensures that the root cause of the high CPU utilization can be investigated without the Auto Scaling group launching additional instances.
Steps to Suspend Processes:
Go to the Auto Scaling group in the AWS Management Console.
Select the group and choose the "Suspend Processes" option.
Suspend the Launch and Terminate processes.
After troubleshooting, resume the processes to re-enable scaling.
Reference: Suspending and Resuming Scaling Processes
A company uses AWS Cloud Formation templates to deploy cloud infrastructure. An analysis of all the company’s templates shows that the company has declared the same components in multiple templates. A SysOps administrator needs to create dedicated templates that have their own parameters and conditions for these common components.
Which solution will meet this requirement?
- A . Develop a CloudFormaiion change set.
- B . Develop CloudFormation macros.
- C . Develop CloudFormation nested stacks.
- D . Develop CloudFormation stack sets.
C
Explanation:
To manage common components across multiple CloudFormation templates efficiently:
Create Nested Stacks:
Develop separate CloudFormation templates for the common components.
Use these templates as nested stacks within the main templates.
Reference: AWS CloudFormation Nested Stacks Define Parameters and Conditions:
Each nested stack can have its own parameters and conditions to customize the deployment.
Reference: Working with Nested Stacks
This solution promotes reuse and modularization, reducing duplication and simplifying template maintenance.
A SysOps administrator receives an alert from Amazon GuardDuty about suspicious network activity on an Amazon EC2 instance. The GuardDuty finding lists a new external IP address as a traffic destination. The SysOps administrator does not recognize the external IP address. The SysOps administrator must block traffic to the external IP address that GuardDuty identified.
Which solution will meet this requirement?
- A . Create a new security group to block traffic to the external IP address. Assign the new security group to the EC2 instance.
- B . Use VPC flow logs with Amazon Athena to block traffic to the external IP address.
- C . Create a network ACL. Add an outbound deny rule for traffic to the external IP address.
- D . Create a new security group to block traffic to the external IP address. Assign the new security group to the entire VPC.
C
Explanation:
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
To block traffic to the external IP address identified by Amazon GuardDuty, the SysOps administrator should create a network ACL and add an outbound deny rule for traffic to the external IP address.
Network ACL:
Network ACLs (Access Control Lists) are stateless and operate at the subnet level. They can allow or deny specific inbound and outbound traffic based on rules.
Steps to Implement:
Go to the VPC console and select the network ACL associated with the subnet containing the EC2 instance.
Add an outbound rule to deny traffic to the external IP address provided by GuardDuty. Ensure the rule is properly placed in the rule number order to be evaluated correctly.
Reference: Network ACLs
GuardDuty Documentation
A company wants to store sensitive financial data within Amazon S3 buckets. The company has a corporate policy that does not allow public read or write access to the buckets. A SysOps administrator must create a solution to automatically remove S3 permissions that allow public read or write access.
Which AWS service should the SysOps administrator use to meet these requirements in the MOST operationally efficient manner?
- A . AWSConfig
- B . AWS Security Hub
- C . AWS Trusted Advisor
- D . Amazon Inspector
A
Explanation:
AWS Config is the best service to automatically manage and remediate S3 bucket permissions that violate corporate policies against public access. AWS Config continuously monitors and records AWS resource configurations and allows you to create rules that trigger automatic responses when public access configurations are detected. This approach is highly operationally efficient as it automates compliance and enforcement of security policies without manual intervention. Option A is correct. AWS Config can be used to assess, audit, and evaluate the configurations of AWS resources, including S3 buckets. Reference AWS Config.
A SysOps administrator receives an alert from Amazon GuardDuty about suspicious network activity on an Amazon FC2 instance. The GuardDuty finding lists a new external IP address as a traffic destination. The SysOps administrator does not recognize the external IP address. The SysOps administrator must block traffic to the external IP address that GuardDuty identified
Which solution will meet this requirement?
- A . Create a new security group to block traffic to the external IP address. Assign the new security group to the EC2 instance
- B . Use VPC flow logs with Amazon Athena to block traffic to the external IP address
- C . Create a network ACL Add an outbound deny rule tor traffic to the external IP address
- D . Create a new security group to block traffic to the external IP address Assign the new security group to the entire VPC
C
Explanation:
To block traffic to a specific external IP address that has been identified as suspicious by GuardDuty, you should use a network ACL to add an outbound deny rule.
Create or Update Network ACL:
Open the Amazon VPC console at Amazon VPC Console.
Select Network ACLs in the navigation pane.
Create a new network ACL or select an existing one that is associated with the subnet containing the EC2 instance.
Add Outbound Deny Rule:
Choose Inbound Rules or Outbound Rules and then choose Edit rules.
Add a new rule to deny traffic to the specific external IP address.
Rule Number: Choose a rule number that is not used by another rule.
Type: All traffic or specific to the protocol and port.
Destination: The external IP address identified by GuardDuty.
Allow/Deny: Deny
Apply Changes:
Save the rule and ensure it is active.
Using a network ACL to block traffic at the subnet level provides an additional layer of security.
Reference: Network ACLs
Working with Network ACLs
A company’s SysOps administrator manages a fleet of hundreds of Amazon EC2 instances that run Windows-based workloads and Linux-based workloads. Each EC2 instance has a tag that identifies its operating system. All the EC2 instances run AWS Systems Manager Session Manager.
A zero-day vulnerability is reported, and no patches are available. The company’s security team provides code for all the relevant operating systems to reduce the risk of the vulnerability. The SysOps administrator needs to implement the code on the EC2 instances and must provide a report that shows that the code has successfully run on all the instances.
What should the SysOps administrator do to meet these requirements as quickly as possible?
- A . Use Systems Manager Run Command. Choose either the AWS-RunShellScript document or the AWS-RunPowerShellScript document. Configure Run Command with the code from the security team. Specify the operating system tag in the Targets parameter. Run the command. Provide the command history’s evidence to the security team.
- B . Create an AWS Lambda function that connects to the EC2 instances through Session Manager. Configure the Lambda function to identify the operating system, run the code from the security team, and return the results to an Amazon RDS DB instance. Query the DB instance for the results. Provide the results as evidence to the security team.
- C . Log on to each EC2 instance. Run the code from the security team on each EC2 instance. Copy and paste the results of each run into a single spreadsheet. Provide the spreadsheet as evidence to the security team.
- D . Update the launch templates of the EC2 instances to include the code from the security team in the user data. Relaunch the EC2 instances by using the updated launch templates. Retrieve the EC2 instance logs of each instance. Provide the EC2 instance logs as evidence to the security team.
A
Explanation:
AWS Systems Manager Run Command provides an efficient method to execute administrative tasks on EC2 instances. This solution will minimize the time and complexity involved:
Select Document: Choose AWS-RunShellScript for Linux-based instances or AWS-RunPowerShellScript for Windows-based instances.
Configure Command: Enter the mitigation script provided by the security team into the command document.
Target Instances: Use the tagging system to target only the instances that match the specific OS as identified by their tags.
Execute Command: Run the command across the targeted instances.
Verification and Reporting: The command history in Systems Manager will serve as evidence of execution and success, which can be reported back to the security team.
AWS Documentation
Reference: More about Run Command can be found here: AWS Systems Manager Run Command.
A SysOps administrator is preparing to deploy an application to Amazon EC2 instances that are in an Auto Scaling group. The application requires dependencies to be installed. Application updates are Issued weekly.
The SysOps administrator needs to implement a solution to incorporate the application updates on a regular basis. The solution also must conduct a vulnerability scan during Amazon Machine Image (AMI) creation.
What is the MOST operationally efficient solution that meets these requirements?
- A . Create a script that uses Packer. Schedule a cron job to run the script.
- B . Install the application and its dependencies on an EC2 instance. Create an AMI of the H£2 instance.
- C . Use EC2 Image Builder with a custom recipe to install the application and its dependencies.
- D . Invoke the EC2 Createlmage API operation by using an Amazon EventBridge scheduled rule.
C
Explanation:
To efficiently manage application deployments and updates on Amazon EC2 instances within an Auto Scaling group, along with ensuring security through vulnerability scans:
EC2 Image Builder: This AWS service automates the creation, management, and deployment of customized, secure, and up-to-date "golden" server images. By using EC2 Image Builder, you can automate the installation of software, patches, and security configurations.
Custom Recipes: Define a custom recipe in EC2 Image Builder that includes steps to install the application and its dependencies. Additionally, configure the recipe to perform vulnerability scans as part of the image creation process.
Automated Pipeline: Set up an Image Builder pipeline that triggers on a regular schedule (e.g., weekly) to incorporate the latest application updates and security patches into the AMI. The new AMIs can then be automatically used by the Auto Scaling group to launch updated and secure instances.
This solution not only streamlines the management of application deployments and updates but also ensures that all instances launched by the Auto Scaling group meet the latest security and compliance standards, minimizing operational overhead and enhancing security.