Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company has an Amazon RDS DB instance. The company wants to implement a caching service while maintaining high availability.
Which combination of actions will meet these requirements? (Choose two.)
- A . Add Auto Discovery to the data store.
- B . Create an Amazon ElastiCache for Memcached data store.
- C . Create an Amazon ElastiCache for Redis data store.
- D . Enable Multi-AZ for the data store.
- E . Enable Multi-threading for the data store.
CD
Explanation:
To implement a caching service while maintaining high availability for an Amazon RDS DB instance, the combination of Amazon ElastiCache for Redis and enabling Multi-AZ for the data store will meet these requirements.
Create an Amazon ElastiCache for Redis Data Store:
Redis is an in-memory data structure store that can be used as a database, cache, and message broker. It provides high availability through its replication feature.
Go to the ElastiCache console.
Choose "Create" and select "Redis."
Configure the Redis cluster with the required parameters.
Enable Multi-AZ for the Data Store:
Multi-AZ deployment provides enhanced availability and durability for Redis. In case of a failure, it automatically fails over to the replica node.
During the creation of the Redis cluster, enable Multi-AZ.
This ensures that there is a standby replica in another Availability Zone, providing high availability.
Reference: Amazon ElastiCache for Redis
ElastiCache for Redis Multi-AZ
A SysOps administrator deployed a three-tier web application to a OA environment and is now evaluating the high availability of the application. The SysOps administrator notices that, when they simulate an unavailable Availability Zone, the application fails to respond. The application stores data in Amazon RDS and Amazon DynamoDB.
How should the SysOps administrator resolve this issue?
- A . Add addilional subnets lo the RDS instance subnet group.
- B . Add an Elastic Load Balancer in front of the RDS instance.
- C . Distribute the data in DynamoDB across Availability Zones.
- D . Enable Multi-AZ for the RDS instance.
D
Explanation:
To improve the high availability of an application that utilizes Amazon RDS and experiences failure when an Availability Zone becomes unavailable:
Multi-AZ Deployment for RDS: Enable Multi-AZ deployments for your Amazon RDS instance. This setting ensures that RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone.
Automatic Failover: In the event of a primary RDS instance failure, RDS will automatically failover to the standby so that database operations can resume quickly with minimal disruption.
High Availability Configuration: This configuration not only enhances the robustness of the database component but also ensures that the application remains operational even if one Availability Zone is experiencing issues.
Enabling Multi-AZ for RDS is crucial for maintaining high availability and ensuring that the application remains resilient in the face of AZ disruptions.
A company needs to automatically monitor an AWS account for potential unauthorized AWS Management Console logins from multiple geographic locations.
Which solution will meet this requirement?
- A . Configure Amazon Cognito to detect any compromised 1AM credentials.
- B . Set up Amazon Inspector. Scan and monitor resources for unauthorized logins.
- C . Set up AWS Config. Add the iam-policy-blacklisted-check managed rule to the account.
- D . Configure Amazon GuardDuty to monitor the UnauthorizedAccess:IAMUser/ConsoleLoginSuccess finding.
D
Explanation:
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. It provides detailed monitoring for unauthorized access attempts, including console login attempts from unusual locations.
Amazon GuardDuty:
GuardDuty analyzes VPC flow logs, AWS CloudTrail logs, and DNS logs to detect suspicious activity.
It generates findings, such as UnauthorizedAccess
/ConsoleLoginSuccess, to alert administrators about potential security issues.
Setup:
Enable GuardDuty in your AWS account.
Configure GuardDuty to monitor unauthorized console logins.
Set up notifications for the relevant findings to alert administrators.
Reference: Amazon GuardDuty
GuardDuty Finding Types
A company has created a NAT gateway in a public subnet in a VPC. The VPC also contains a private subnet that includes Amazon EC2 instances. The EC2 instances use the NAT gateway to access the internet to download patches and updates. The company has configured a VPC flow log for the elastic network interface of the NAT gateway. The company is publishing the output to Amazon CloudWatch Logs.
A SysOps administrator must identify the top five internet destinations that the EC2 instances in the private subnet communicate with for downloads.
What should the SysOps administrator do to meet this requirement in the MOST operationally efficient way?
- A . Use AWS CloudTrail Insights events to identify the top five internet destinations.
- B . Use Amazon CloudFront standard logs (access logs) to identify the top five internet destinations.
- C . Use CloudWatch Logs Insights to identify the top five internet destinations.
- D . Change the flow log to publish logs to Amazon S3. Use Amazon Athena to query the log files in Amazon S3.
C
Explanation:
Amazon CloudWatch Logs Insights allows you to interactively search and analyze your log data. This can be used to quickly identify the top internet destinations accessed by the EC2 instances.
Steps:
Open CloudWatch Logs Insights:
Open the Amazon CloudWatch console.
In the navigation pane, choose "Logs Insights".
Select the Log Group:
Select the log group that contains the VPC flow logs for the NAT gateway.
Run a Query:
Use the following query to identify the top five internet destinations:
sql
Copy code
fields @timestamp, dstAddr
| stats count(*) as requestCount by dstAddr
| sort requestCount desc
| limit 5
This query will count the number of requests to each destination address, sort them in descending order, and limit the results to the top five.
Analyze Results:
Review the output to identify the top five internet destinations that the EC2 instances communicate with for downloads.
Reference: CloudWatch Logs Insights
Analyzing VPC Flow Logs with CloudWatch Logs Insights
A company with multiple AWS accounts needs to obtain recommendations for AWS Lambda functions and identify optimal resource configurations for each Lambda function.
How should a SysOps administrator provide these recommendations?
- A . Create an AWS Serverless Application Repository and export the Lambda function recommendations.
- B . Enable AWS Compute Optimizer and export the Lambda function recommendations
- C . Enable all features of AWS Organization and export the recommendations from AWS CloudTrail Insights.
- D . Run AWS Trusted Advisor and export the Lambda function recommendations
B
Explanation:
AWS Compute Optimizer provides recommendations for optimizing the performance and cost of your AWS resources, including Lambda functions.
Steps:
Enable AWS Compute Optimizer:
Open the AWS Compute Optimizer console.
Choose "Get started".
Enable Compute Optimizer for your account.
View Lambda Function Recommendations:
After enabling Compute Optimizer, allow some time for data collection and analysis.
Navigate to the "Lambda Function Recommendations" section in the Compute Optimizer console.
Review the recommendations for your Lambda functions, which may include adjustments to memory size or other configurations to improve performance and reduce costs.
Export Recommendations:
In the Compute Optimizer console, you can export the recommendations to a CSV file for further analysis and action.
Reference: AWS Compute Optimizer
Optimizing Lambda Function Configurations
A SysOps administrator launches an Amazon EC2 instance in a private subnet of a VPC. When the SysOps administrator attempts a curl command from the command line of the EC2 instance, the SysOps administrator cannot connect to https:www.example.com.
What should the SysOps administrator do to resolve this issue?
- A . Ensure that there is an outbound security group for port 443 to 0.0.0.0/0.
- B . Ensure that there is an inbound security group for port 443 from 0.0.0.0/0.
- C . Ensure that there is an outbound network ACL for ephemeral ports 1024-66535 to 0.0.0.0/0.
- D . Ensure that there is an outbound network ACL for port 80 to 0.0.0.0/0.
A
Explanation:
To resolve the issue of the EC2 instance in a private subnet not being able to connect to external websites via HTTPS (port 443), it is necessary to adjust the security group settings:
Outbound Security Group Rules: Verify that the security group associated with the EC2 instance allows outbound traffic on port 443 to any destination (0.0.0.0/0). This rule is crucial because it enables the instance to initiate HTTPS connections to external websites.
Network ACLs: While the primary concern here is the security group, ensure also that the Network Access Control List (ACL) associated with the subnet permits outbound HTTPS traffic. However, the ACLs by default allow all outbound traffic unless specifically restricted.
Internet Connectivity: Since the instance is in a private subnet, ensure that it has a route to the internet through a NAT Gateway or NAT Instance located in a public subnet. Without this, the instance won’t be able to reach external networks even if the security groups and ACLs are correctly configured.
By ensuring that the security group permits outbound HTTPS traffic, you address the most common configuration oversight that would prevent such connectivity.
A company has an initiative to reduce costs associated with Amazon EC2 and AWS Lambda.
Which action should a SysOps administrator take to meet these requirements?
- A . Analyze the AWS Cost and Usage Report by using Amazon Athena to identity cost savings.
- B . Create an AWS Budgets alert to alarm when account spend reaches 80% of the budget.
- C . Purchase Reserved Instances through the Amazon EC2 console.
- D . Use AWS Compute Optimizer and take action on the provided recommendations.
D
Explanation:
AWS Compute Optimizer recommends optimal AWS resources for your workloads to reduce costs and improve performance. It provides actionable recommendations to help you choose the right EC2 instances and AWS Lambda configurations.
Access AWS Compute Optimizer:
Open the AWS Compute Optimizer console at AWS Compute Optimizer Console.
Review the recommendations for your EC2 instances and AWS Lambda functions.
Implement Recommendations:
Analyze the recommendations, which might include resizing instances, changing instance types, or modifying Lambda memory settings.
Apply the recommendations to optimize your resources and reduce costs.
Reference: AWS Compute Optimizer
Getting Started with AWS Compute Optimizer
A company hosts a website on multiple Amazon EC2 instances that run in an Auto Scaling group. Users are reporting slow responses during peak times between 6 PM and 11 PM every weekend. A SysOps administrator must implement a solution to improve performance during these peak times.
What is the MOST operationally efficient solution that meets these requirements?
- A . Create a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS
Lambda function to increase the desired capacity before peak times. - B . Configure a scheduled scaling action with a recurrence option to change the desired capacity before and after peak times.
- C . Create a target tracking scaling policy to add more instances when memory utilization is above 70%.
- D . Configure the cooldown period for the Auto Scaling group to modify desired capacity before and after peak times.
B
Explanation:
"Scheduled scaling helps you to set up your own scaling schedule according to predictable load changes. For example, let’s say that every week the traffic to your web application starts to increase on Wednesday, remains high on Thursday, and starts to decrease on Friday. You can configure a schedule for Amazon EC2 Auto Scaling to increase capacity on Wednesday and decrease capacity on Friday." https://docs.aws.amazon.com/autoscaling/ec2/userguide/schedule_time.html
A company uses Amazon Elasticsearch Service (Amazon ES) to analyze sales and customer usage dat a. Members of the company’s geographically dispersed sales team are traveling. They need to log in
to Kibana by using their existing corporate credentials that are stored in Active Directory. The company has deployed
Active Directory Federation Services (AD FS) to enable authentication to cloud services.
Which solution will meet these requirements?
- A . Configure Active Directory as an authentication provider in Amazon ES. Add the Active Directory server’s domain name to Amazon ES. Configure Kibana to use Amazon ES authentication.
- B . Deploy an Amazon Cognito user pool. Configure Active Directory as an external identity provider for the user pool. Enable Amazon Cognito authentication for Kibana on Amazon ES.
- C . Enable Active Directory user authentication in Kibana. Create an IP-based custom domain access policy in Amazon ES that includes the Active Directory server’s IP address.
- D . Establish a trust relationship with Kibana on the Active Directory server. Enable Active Directory user authentication in Kibana. Add the Active Directory server’s IP address to Kibana.
B
Explanation:
https://aws.amazon.com/blogs/security/how-to-enable-secure-access-to-kibana-using-aws-single-sign-on/
https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-cognito-auth.html
A company is experiencing issues with legacy software running on Amazon EC2 instances. Errors occur when the total CPU utilization on the EC2 instances exceeds 80%. A short-term solution is required while the software is being rewritten. A SysOps administrator is tasked with creating a solution to restart the instances when the CPU utilization rises above 80%.
Which solution meets these requirements with the LEAST operational overhead?
- A . Write a script that monitors the CPU utilization of the EC2 instances and reboots the instances when utilization exceeds 80%. Run the script as a cron job.
- B . Add an Amazon CloudWatch alarm for CPU utilization and configure the alarm action to reboot the EC2 instances.
- C . Create an Amazon EventBridge rule using the predefined patterns for CPU utilization of the EC2 instances. When utilization exceeds 80%, invoke an AWS Lambda function to restart the instances.
- D . Add an Amazon CloudWatch alarm for CPU utilization and configure an AWS Systems Manager Automation runbook to reboot the EC2 instances when utilization exceeds 80%.
B
Explanation:
The simplest and most efficient solution to ensure that EC2 instances are restarted when CPU utilization exceeds 80% is to use Amazon CloudWatch alarms:
Create a CloudWatch Alarm: Navigate to the CloudWatch dashboard in the AWS Management Console and create a new alarm. Set the alarm to monitor the CPU utilization metric of the EC2 instances.
Set the Alarm Condition: Configure the alarm to trigger when the CPU utilization exceeds 80%. You can specify this threshold in the alarm settings.
Configure Alarm Actions: In the actions settings of the alarm, select the option to reboot the instance. This action ensures that the instance is automatically restarted whenever the alarm condition is met, without the need for manual intervention or additional scripts.
This method leverages AWS’s native capabilities, minimizing operational overhead and eliminating the need for external tools or custom scripts.