Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
The SysOps administrator finds that users can no longer download a file from an S3 presigned URL after a few days. (Select TWO):
- A . The presigned URL’s expiration date and time have passed.
- B . The SysOps administrator’s access key is no longer valid.
- C . The S3 bucket’s Block Public Access settings are enabled.
- D . The S3 object’s ACL does not include READ access for the All Users group.
- E . The S3 object’s ACL does not include READ_ACP access for the All Users group.
A, B
Explanation:
Several factors can affect the availability of an S3 object through a presigned URL:
Expiration of Presigned URL: A presigned URL is valid only until its specified expiration time. Once expired, it becomes inaccessible.
Invalid Access Key: If the access key of the SysOps administrator who generated the presigned URL is revoked or rotated, the URL will no longer be valid.
Other options like enabling Block Public Access or changing the object ACL to All Users are not necessary for presigned URLs, as these URLs temporarily grant access regardless of public bucket settings.
A company runs its entire suite of applications on Amazon EC2 instances. The company plans to move the applications to containers and AWS Fargate. Within 6 months, the company plans to retire its EC2 instances and use only Fargate. The company has been able to estimate its future Fargate costs.
A SysOps administrator needs to choose a purchasing option to help the company minimize costs. The SysOps administrator must maximize any discounts that are available and must ensure that there are no unused reservations.
Which purchasing option will meet these requirements?
- A . Compute Savings Plans for 1 year with the No Upfront payment option
- B . Compute Savings Plans for 1 year with the Partial Upfront payment option
- C . EC2 Instance Savings Plans for 1 year with the All Upfront payment option
- D . EC2 Reserved Instances for 1 year with the Partial Upfront payment option
A
Explanation:
To minimize costs while moving from EC2 instances to AWS Fargate, Compute Savings Plans are the most flexible and cost-effective option. Compute Savings Plans apply to a variety of compute services including AWS Fargate, Amazon EC2, and AWS Lambda, allowing for greater flexibility in managing costs as the company transitions to using only Fargate.
Compute Savings Plans:
Savings Plans provide significant savings over On-Demand pricing, up to 66% savings.
Compute Savings Plans offer the flexibility to move across instance types, AWS Regions, and operating systems.
Payment Options:
The No Upfront payment option provides the most flexibility and avoids large upfront capital expenditures.
The Partial Upfront payment option offers more savings but requires an initial payment.
1-Year Term:
A 1-year term is suitable for the company’s 6-month transition period, allowing for cost savings without a long-term commitment.
Reference: AWS Savings Plans
Compute Savings Plans
The company’s ecommerce website running on EC2 instances behind an ALB intermittently returns HTTP 500 errors. The Auto Scaling group is only using EC2 status checks.
- A . Replace the ALB with a Network Load Balancer.
- B . Add Elastic Load Balancing (ELB) health checks to the Auto Scaling group.
- C . Update the target group configuration on the ALB. Enable session affinity (sticky sessions).
- D . Install the Amazon CloudWatch agent on all the instances. Configure the agent to reboot the instances.
B
Explanation:
Using ALB health checks in the Auto Scaling group will provide more accurate health monitoring and replace instances if they are unhealthy.
ALB Health Checks: Configure health checks based on HTTP response codes, which will detect application-level issues causing the HTTP 500 errors and replace instances as needed.
EC2 vs. ALB Health Checks: EC2 status checks only verify instance hardware and OS, not the application’s responsiveness. By using ALB health checks, Auto Scaling can remove instances that are failing at the application level, thus preventing users from receiving 500 errors.
Replacing the ALB with a Network Load Balancer does not address HTTP 500 errors, and enabling session affinity does not resolve application health issues. The CloudWatch agent would not provide the required health check functionality for automated instance replacement.
The company’s ecommerce website running on EC2 instances behind an ALB intermittently returns HTTP 500 errors. The Auto Scaling group is only using EC2 status checks.
- A . Replace the ALB with a Network Load Balancer.
- B . Add Elastic Load Balancing (ELB) health checks to the Auto Scaling group.
- C . Update the target group configuration on the ALB. Enable session affinity (sticky sessions).
- D . Install the Amazon CloudWatch agent on all the instances. Configure the agent to reboot the instances.
B
Explanation:
Using ALB health checks in the Auto Scaling group will provide more accurate health monitoring and replace instances if they are unhealthy.
ALB Health Checks: Configure health checks based on HTTP response codes, which will detect application-level issues causing the HTTP 500 errors and replace instances as needed.
EC2 vs. ALB Health Checks: EC2 status checks only verify instance hardware and OS, not the application’s responsiveness. By using ALB health checks, Auto Scaling can remove instances that are failing at the application level, thus preventing users from receiving 500 errors.
Replacing the ALB with a Network Load Balancer does not address HTTP 500 errors, and enabling session affinity does not resolve application health issues. The CloudWatch agent would not provide the required health check functionality for automated instance replacement.
A SysOps administrator configures an Amazon S3 gateway endpoint in a VPC. The private subnets inside the VPC do not nave outbound internet access. A user logs in to an Amazon EC2 instance in one of the private subnets and cannot upload a file to an Amazon S3 bucket in the same AWS Region
Which solution will solve this problem?
- A . Update the EC2 instance role policy to allow s3:PutObjed access to the target S3 bucket.
- B . Update the EC2 security group to allow outbound traffic to 0.0.0.070 for port 80.
- C . Update the EC2 subnet route table to include the S3 prefix list destination routes to the S3 gateway endpoint.
- D . Update the S3 bucket policy to allow s3 PurObject access from the private subnet CIDR block.
C
Explanation:
The issue with the inability to upload a file to an Amazon S3 bucket from an EC2 instance in a private subnet is likely due to missing route table entries for the S3 gateway endpoint.
Update the Route Table:
Ensure that the route table associated with the EC2 subnet includes the S3 prefix list destination routes to the S3 gateway endpoint.
This allows the EC2 instance to communicate with the S3 bucket using the S3 gateway endpoint.
Reference: VPC Endpoints for Amazon S3
Routing for S3 Endpoints
A company recently acquired another corporation and all of that corporation’s AWS accounts. A financial analyst needs the cost data from these accounts. A SysOps administrator uses Cost Explorer to generate cost and usage reports. The SysOps administrator notices that "No Tagkey" represents 20% of the monthly cost.
What should the SysOps administrator do to tag the "No Tagkey" resources?
- A . Add the accounts to AWS Organizations. Use a service control policy (SCP) to tag all the untagged resources.
- B . Use an AWS Config rule to find the untagged resources. Set the remediation action to terminate the resources.
- C . Use Cost Explorer to find and tag all the untagged resources.
- D . Use Tag Editor to find and taq all the untaqqed resources.
D
Explanation:
"You can add tags to resources when you create the resource. You can use the resource’s service console or API to add, change, or remove those tags one resource at a time. To add tags to―or edit or delete tags of―multiple resources at once, use Tag Editor. With Tag Editor, you search for the resources that you want to tag, and then manage tags for the resources in your search results." https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html
A company is expanding its use of AWS services across its portfolios The company wants to provision AWS accounts for each team to ensure a separation of business processes for security compliance and billing Account creation and bootstrapping should be completed m a scalable and efficient way so new accounts are created with a defined baseline and governance guardrails in place A SysOps administrator needs to design a provisioning process that saves time and resources
Which action should be taken to meet these requirements?
- A . Automate using AWS Elastic Beanstalk to provision the AWS accounts set up infrastructure and integrate with AWS Organizations
- B . Create bootstrapping scripts in AWS OpsWorks and combine them with AWS CloudFormation templates to provision accounts and infrastructure
- C . Use AWS Config to provision accounts and deploy instances using AWS Service Catalog
- D . Use AWS Control Tower to create a template in Account Factory and use the template to provision new accounts
D
Explanation:
To provision AWS accounts for each team with a defined baseline and governance guardrails in a scalable and efficient way, using AWS Control Tower is the best solution.
AWS Control Tower:
AWS Control Tower provides a straightforward way to set up and govern a secure, multi-account AWS environment based on best practices.
It uses Account Factory, a feature that automates the creation of new AWS accounts with predefined configurations.
Creating Accounts with Control Tower:
Navigate to the AWS Control Tower console.
Use Account Factory to create a new account.
Customize the account template to include the necessary configurations, such as organizational units (OUs), guardrails, and baselines.
Advantages:
Ensures consistent security and compliance across all accounts.
Automates account creation and configuration, saving time and reducing errors.
Reference: AWS Control Tower
Setting Up Account Factory
A data storage company provides a service that gives users the ability to upload and download files as needed. The files are stored in Amazon S3 Standard and must be immediately retrievable for 1 year. Users access files frequently during the first 30 days after the files are stored. Users rarely access files after 30 days.
The company’s SysOps administrator must use S3 Lifecycle policies to implement a solution that maintains object availability and minimizes cost.
Which solution will meet these requirements?
- A . Move objects to S3 Glacier after 30 days.
- B . Move objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.
- C . Move objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.
- D . Move objects to S3 Standard-Infrequent Access (S3 Standard-IA) immediately.
C
Explanation:
To minimize cost while maintaining immediate retrievability for files stored in Amazon S3, you can use S3 Lifecycle policies to transition objects to different storage classes based on their access patterns. Given that files are frequently accessed in the first 30 days and rarely accessed afterward, transitioning to S3 Standard-IA after 30 days is the most cost-effective solution.
Understand S3 Storage Classes:
S3 Standard: Suitable for frequently accessed data.
S3 Standard-Infrequent Access (S3 Standard-IA): Suitable for data that is less frequently accessed but requires rapid access when needed. It offers lower storage costs compared to S3 Standard but has a retrieval fee.
S3 One Zone-Infrequent Access (S3 One Zone-IA): Similar to S3 Standard-IA but stores data in a single Availability Zone, making it less resilient.
S3 Glacier: Suitable for archival storage where data retrieval time is not critical (minutes to hours).
Requirements and Solution:
Access Pattern: Frequent access in the first 30 days, rare access afterward.
Retrievability: Immediate access required for one year.
Cost Efficiency: Minimize storage costs after the first 30 days.
Implementing Lifecycle Policy:
Lifecycle Policy: Configure a lifecycle policy to transition objects to S3 Standard-IA after 30 days.
Step-by-Step Implementation:
Login to AWS Management Console:
A company is trying to connect two applications. One application runs in an on-premises data center that has a hostname of hostl .onprem.private. The other application runs on an Amazon EC2 instance that has a hostname of hostl.awscloud.private. An AWS Site-to-Site VPN connection is in place between the on-premises network and AWS.
The application that runs in the data center tries to connect to the application that runs on the EC2 instance, but DNS resolution fails. A SysOps administrator must implement DNS resolution between on-premises and AWS resources.
Which solution allows the on-premises application to resolve the EC2 instance hostname?
- A . Set up an Amazon Route 53 inbound resolver endpoint with a forwarding rule for the onprem.private hosted zone. Associate the resolver with the VPC of the EC2 instance. Configure the on-premises DNS resolver to forward onprem.private DNS queries to the inbound resolver endpoint.
- B . Set up an Amazon Route 53 inbound resolver endpoint. Associate the resolver with the VPC of the EC2 instance. Configure the on-premises DNS resolver to forward awscloud.private DNS queries to the inbound resolver endpoint.
- C . Set up an Amazon Route 53 outbound resolver endpoint with a forwarding rule for the onprem.private hosted zone. Associate the resolver with the AWS Region of the EC2 instance. Configure the on-premises DNS resolver to forward onprem.private DNS queries to the outbound resolver endpoint.
- D . Set up an Amazon Route 53 outbound resolver endpoint. Associate the resolver with the AWS Region of the EC2 instance. Configure the on-premises DNS resolver to forward awscloud.private DNS queries to the outbound resolver endpoint.
A
Explanation:
Step-by-Step
Understand the Problem:
There are two applications, one in an on-premises data center and the other on an Amazon EC2 instance.
DNS resolution fails when the on-premises application tries to connect to the EC2 instance. The goal is to implement DNS resolution between on-premises and AWS resources.
Analyze the Requirements:
Need to resolve the hostname of the EC2 instance from the on-premises network. Utilize the existing AWS Site-to-Site VPN connection for DNS queries.
Evaluate the Options:
Option A: Set up an Amazon Route 53 inbound resolver endpoint with a forwarding rule for the onprem.private hosted zone.
This allows DNS queries from on-premises to be forwarded to Route 53 for resolution.
The resolver endpoint is associated with the VPC, enabling resolution of AWS resources.
Option B: Set up an Amazon Route 53 inbound resolver endpoint without specifying the forwarding rule.
This option does not address the specific need to resolve onprem.private DNS queries.
Option C: Set up an Amazon Route 53 outbound resolver endpoint.
Outbound resolver endpoints are used for forwarding DNS queries from AWS to on-premises, not vice versa.
Option D: Set up an Amazon Route 53 outbound resolver endpoint without specifying the forwarding rule.
Similar to Option C, this does not meet the requirement of resolving on-premises queries in AWS.
Select the Best Solution:
Option A: Setting up an inbound resolver endpoint with a forwarding rule for onprem.private and associating it with the VPC ensures that DNS queries from on-premises can resolve AWS resources effectively.
Reference: Amazon Route 53 Resolver
Integrating AWS and On-Premises Networks with Route 53
Using an Amazon Route 53 inbound resolver endpoint with a forwarding rule ensures that on-premises applications can resolve EC2 instance hostnames effectively.
A company is trying to connect two applications. One application runs in an on-premises data center that has a hostname of hostl .onprem.private. The other application runs on an Amazon EC2 instance that has a hostname of hostl.awscloud.private. An AWS Site-to-Site VPN connection is in place between the on-premises network and AWS.
The application that runs in the data center tries to connect to the application that runs on the EC2 instance, but DNS resolution fails. A SysOps administrator must implement DNS resolution between on-premises and AWS resources.
Which solution allows the on-premises application to resolve the EC2 instance hostname?
- A . Set up an Amazon Route 53 inbound resolver endpoint with a forwarding rule for the onprem.private hosted zone. Associate the resolver with the VPC of the EC2 instance. Configure the on-premises DNS resolver to forward onprem.private DNS queries to the inbound resolver endpoint.
- B . Set up an Amazon Route 53 inbound resolver endpoint. Associate the resolver with the VPC of the EC2 instance. Configure the on-premises DNS resolver to forward awscloud.private DNS queries to the inbound resolver endpoint.
- C . Set up an Amazon Route 53 outbound resolver endpoint with a forwarding rule for the onprem.private hosted zone. Associate the resolver with the AWS Region of the EC2 instance. Configure the on-premises DNS resolver to forward onprem.private DNS queries to the outbound resolver endpoint.
- D . Set up an Amazon Route 53 outbound resolver endpoint. Associate the resolver with the AWS Region of the EC2 instance. Configure the on-premises DNS resolver to forward awscloud.private DNS queries to the outbound resolver endpoint.
A
Explanation:
Step-by-Step
Understand the Problem:
There are two applications, one in an on-premises data center and the other on an Amazon EC2 instance.
DNS resolution fails when the on-premises application tries to connect to the EC2 instance. The goal is to implement DNS resolution between on-premises and AWS resources.
Analyze the Requirements:
Need to resolve the hostname of the EC2 instance from the on-premises network. Utilize the existing AWS Site-to-Site VPN connection for DNS queries.
Evaluate the Options:
Option A: Set up an Amazon Route 53 inbound resolver endpoint with a forwarding rule for the onprem.private hosted zone.
This allows DNS queries from on-premises to be forwarded to Route 53 for resolution.
The resolver endpoint is associated with the VPC, enabling resolution of AWS resources.
Option B: Set up an Amazon Route 53 inbound resolver endpoint without specifying the forwarding rule.
This option does not address the specific need to resolve onprem.private DNS queries.
Option C: Set up an Amazon Route 53 outbound resolver endpoint.
Outbound resolver endpoints are used for forwarding DNS queries from AWS to on-premises, not vice versa.
Option D: Set up an Amazon Route 53 outbound resolver endpoint without specifying the forwarding rule.
Similar to Option C, this does not meet the requirement of resolving on-premises queries in AWS.
Select the Best Solution:
Option A: Setting up an inbound resolver endpoint with a forwarding rule for onprem.private and associating it with the VPC ensures that DNS queries from on-premises can resolve AWS resources effectively.
Reference: Amazon Route 53 Resolver
Integrating AWS and On-Premises Networks with Route 53
Using an Amazon Route 53 inbound resolver endpoint with a forwarding rule ensures that on-premises applications can resolve EC2 instance hostnames effectively.