Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #201
A company has multiple AWS accounts. The company uses AWS Organizations with an organizational unit (OU) for the production account and another OU for the development account. Corporate policies state that developers may use only approved AWS services in the production account.
What is the MOST operationally efficient solution to control the production account?
- A . Create a customer managed policy in AWS Identity and Access Management (IAM). Apply the policy to all users within the production account.
- B . Create a job function policy in AWS Identity and Access Management (IAM). Apply the policy to all users within the production OU.
- C . Create a service control policy (SCP). Apply the SCP to the production OU.
- D . Create an IAM policy. Apply the policy in Amazon API Gateway to restrict the production account.
Correct Answer: C
C
Explanation:
To control the production account efficiently, the most operationally efficient solution is to create a service control policy (SCP) and apply it to the production OU. SCPs allow you to manage permissions for AWS Organizations at the organizational unit (OU) or account level.
Service Control Policies (SCPs):
SCPs are a type of policy that can restrict what services and actions can be used in the accounts within an OU.
They are applied at the organizational unit level and provide a way to enforce corporate policies across multiple AWS accounts.
Steps to Implement:
Navigate to the AWS Organizations console.
Create a new SCP that specifies the allowed or denied services and actions.
Apply the SCP to the production OU.
Reference: AWS Organizations SCPs
C
Explanation:
To control the production account efficiently, the most operationally efficient solution is to create a service control policy (SCP) and apply it to the production OU. SCPs allow you to manage permissions for AWS Organizations at the organizational unit (OU) or account level.
Service Control Policies (SCPs):
SCPs are a type of policy that can restrict what services and actions can be used in the accounts within an OU.
They are applied at the organizational unit level and provide a way to enforce corporate policies across multiple AWS accounts.
Steps to Implement:
Navigate to the AWS Organizations console.
Create a new SCP that specifies the allowed or denied services and actions.
Apply the SCP to the production OU.
Reference: AWS Organizations SCPs
Question #202
A SysOps administrator needs to track the costs of data transfer between AWS Regions. The SysOps administrator must implement a solution to send alerts to an email distribution list when transfer costs reach 75% of a specific threshold.
What should the SysOps administrator do to meet these requirements?
- A . Create an AWS Cost and Usage Report. Analyze the results in Amazon Athena. Configure an alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when costs reach 75% of the threshold. Subscribe the email distribution list to the topic.
- B . Create an Amazon CloudWatch billing alarm to detect when costs reach 75% of the threshold. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email distribution list to the topic.
- C . Use AWS Budgets to create a cost budget for data transfer costs. Set an alert at 75% of the budgeted amount. Configure the budget to send a notification to the email distribution list when costs reach 75% of the threshold.
- D . Set up a VPC flow log. Set up a subscription filter to an AWS Lambda function to analyze data transfer. Configure the Lambda function to send a notification to the email distribution list when costs reach 75% of the threshold.
Correct Answer: B
B
Explanation:
The reason is that it uses the Amazon CloudWatch billing alarm which is a built-in service specifically designed to monitor and alert on cost usage of your AWS account, which makes it a more suitable solution for this use case. The alarm can be configured to detect when costs reach 75% of the threshold and when it is triggered, it can publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. The email distribution list can be subscribed to the topic, so that they will receive the alerts when costs reach 75% of the threshold.
AWS Budgets allows you to track and manage your costs, but it doesn’t specifically focus on data transfer costs between regions, and it might not provide as much granularity as CloudWatch Alarms.
B
Explanation:
The reason is that it uses the Amazon CloudWatch billing alarm which is a built-in service specifically designed to monitor and alert on cost usage of your AWS account, which makes it a more suitable solution for this use case. The alarm can be configured to detect when costs reach 75% of the threshold and when it is triggered, it can publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. The email distribution list can be subscribed to the topic, so that they will receive the alerts when costs reach 75% of the threshold.
AWS Budgets allows you to track and manage your costs, but it doesn’t specifically focus on data transfer costs between regions, and it might not provide as much granularity as CloudWatch Alarms.
Question #203
An application team uses an Amazon Aurora MySQL DB cluster with one Aurora Replica. The application team notices that the application read performance degrades when user connections exceed 200. The number of user connections is typically consistent around 180. with occasional sudden increases above 200 connections. The application team wants the application to automatically scale as user demand increases or decreases.
Which solution will meet these requirements?
- A . Migrate to a new Aurora multi-master DB cluster. Modify the application database connection string.
- B . Modify the DB cluster by changing to serverless mode whenever user connections exceed 200.
- C . Create an auto scaling policy with a target metric of 195 DatabaseConnections
- D . Modify the DB cluster by increasing the Aurora Replica instance size.
Correct Answer: C
C
Explanation:
Step-by-Step
Understand the Problem:
The application read performance degrades when user connections exceed 200.
Need to automatically scale the database based on user demand.
Analyze the Requirements:
Implement auto scaling based on user connections to ensure optimal performance.
Evaluate the Options:
Option A: Migrate to a new Aurora multi-master DB cluster.
Multi-master clusters provide read and write scalability but may require significant changes to the application.
Option B: Modify the DB cluster to serverless mode.
Aurora Serverless provides automatic scaling, but it is more suitable for variable workloads with unpredictable demand.
Option C: Create an auto scaling policy with a target metric of 195 DatabaseConnections.
This directly addresses the need to scale based on user connections.
Auto scaling can add or remove replicas to maintain optimal performance.
Option D: Increase the Aurora Replica instance size.
This may improve performance but does not address scalability for sudden increases in user connections.
Select the Best Solution:
Option C: Creating an auto scaling policy with a target metric of 195 DatabaseConnections ensures the DB cluster scales automatically to handle increased load.
Reference: Amazon Aurora Auto Scaling
Scaling Aurora DB Instances
Auto scaling based on DatabaseConnections ensures the Aurora DB cluster maintains optimal performance as user demand fluctuates.
C
Explanation:
Step-by-Step
Understand the Problem:
The application read performance degrades when user connections exceed 200.
Need to automatically scale the database based on user demand.
Analyze the Requirements:
Implement auto scaling based on user connections to ensure optimal performance.
Evaluate the Options:
Option A: Migrate to a new Aurora multi-master DB cluster.
Multi-master clusters provide read and write scalability but may require significant changes to the application.
Option B: Modify the DB cluster to serverless mode.
Aurora Serverless provides automatic scaling, but it is more suitable for variable workloads with unpredictable demand.
Option C: Create an auto scaling policy with a target metric of 195 DatabaseConnections.
This directly addresses the need to scale based on user connections.
Auto scaling can add or remove replicas to maintain optimal performance.
Option D: Increase the Aurora Replica instance size.
This may improve performance but does not address scalability for sudden increases in user connections.
Select the Best Solution:
Option C: Creating an auto scaling policy with a target metric of 195 DatabaseConnections ensures the DB cluster scales automatically to handle increased load.
Reference: Amazon Aurora Auto Scaling
Scaling Aurora DB Instances
Auto scaling based on DatabaseConnections ensures the Aurora DB cluster maintains optimal performance as user demand fluctuates.
Question #204
A company has an existing web application that runs on two Amazon EC2 instances behind an Application Load Balancer (ALB) across two Availability Zones The application uses an Amazon RDS Multi-AZ DB Instance Amazon Route 53 record sets route requests tor dynamic content to the load balancer and requests for static content to an Amazon S3 bucket Site visitors are reporting extremely long loading times.
Which actions should be taken to improve the performance of the website? (Select TWO)
- A . Add Amazon CloudFront caching for static content
- B . Change the load balancer listener from HTTPS to TCP
- C . Enable Amazon Route 53 latency-based routing
- D . Implement Amazon EC2 Auto Scaling for the web servers
- E . Move the static content from Amazon S3 to the web servers
Correct Answer: AD
AD
Explanation:
To improve the performance of the website with long loading times, leveraging Amazon CloudFront for caching static content and implementing EC2 Auto Scaling are effective strategies.
Add Amazon CloudFront Caching:
Navigate to the CloudFront console and create a new distribution.
For the origin, specify the S3 bucket where the static content is stored.
Configure caching settings to ensure that static content is cached at edge locations for faster delivery to end users.
Update the DNS settings in Amazon Route 53 to point to the CloudFront distribution for static content.
Implement EC2 Auto Scaling:
Go to the EC2 console and create a new launch configuration or launch template for the web servers.
Set up an Auto Scaling group using the launch configuration/template.
Configure the Auto Scaling group to use health checks, and specify the desired, minimum, and maximum number of instances.
Define scaling policies to add or remove instances based on CPU utilization or other metrics. Distribute instances across multiple Availability Zones for high availability.
Reference: Amazon CloudFront Developer Guide
Amazon EC2 Auto Scaling
AD
Explanation:
To improve the performance of the website with long loading times, leveraging Amazon CloudFront for caching static content and implementing EC2 Auto Scaling are effective strategies.
Add Amazon CloudFront Caching:
Navigate to the CloudFront console and create a new distribution.
For the origin, specify the S3 bucket where the static content is stored.
Configure caching settings to ensure that static content is cached at edge locations for faster delivery to end users.
Update the DNS settings in Amazon Route 53 to point to the CloudFront distribution for static content.
Implement EC2 Auto Scaling:
Go to the EC2 console and create a new launch configuration or launch template for the web servers.
Set up an Auto Scaling group using the launch configuration/template.
Configure the Auto Scaling group to use health checks, and specify the desired, minimum, and maximum number of instances.
Define scaling policies to add or remove instances based on CPU utilization or other metrics. Distribute instances across multiple Availability Zones for high availability.
Reference: Amazon CloudFront Developer Guide
Amazon EC2 Auto Scaling
Question #205
A SysOps administrator is using Amazon EC2 instances to host an application. The SysOps administrator needs to grant permissions for the application to access an Amazon DynamoDB table.
Which solution will meet this requirement?
- A . Create access keys to access the DynamoDB table. Assign the access keys to the EC2 instance profile.
- B . Create an EC2 key pair to access the DynamoDB table. Assign the key pair to the EC2 instance profile.
- C . Create an IAM user to access the DynamoDB table. Assign the IAM user to the EC2 instance profile.
- D . Create an IAM role to access the DynamoDB table. Assign the IAM role to the EC2 instance profile.
Correct Answer: D
D
Explanation:
Access to Amazon DynamoDB requires credentials. Those credentials must have permissions to access AWS resources, such as an Amazon DynamoDB table or an Amazon Elastic Compute Cloud (Amazon EC2) instance. The following sections provide details on how you can use AWS Identity and Access Management (IAM) and DynamoDB to help secure access to your resources. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/authentication-and-access-control.html
D
Explanation:
Access to Amazon DynamoDB requires credentials. Those credentials must have permissions to access AWS resources, such as an Amazon DynamoDB table or an Amazon Elastic Compute Cloud (Amazon EC2) instance. The following sections provide details on how you can use AWS Identity and Access Management (IAM) and DynamoDB to help secure access to your resources. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/authentication-and-access-control.html
Question #206
To automatically reboot an EC2 instance when disk usage reaches 100%, a solution with minimal operational overhead is needed.
- A . Create a CloudWatch alarm for the EC2 instance. Create an Amazon EventBridge event rule that reacts to the CloudWatch alarm and reboots the EC2 instance.
- B . Create a CloudWatch alarm for the EC2 instance. Create an Amazon Simple Email Service (Amazon SES) notification that reacts to the CloudWatch alarm and reboots the EC2 instance.
- C . Create an AWS Lambda function to reboot the EC2 instance. Create a CloudWatch alarm that uses Amazon EventBridge to invoke the Lambda function.
- D . Create an AWS Lambda function to reboot the EC2 instance. Use EC2 health checks to invoke the Lambda function.
Correct Answer: A
A
Explanation:
Using a CloudWatch alarm with an EventBridge rule provides an automated, direct way to reboot the EC2 instance without extra components like SES or Lambda. This is a straightforward approach with low operational overhead.
A
Explanation:
Using a CloudWatch alarm with an EventBridge rule provides an automated, direct way to reboot the EC2 instance without extra components like SES or Lambda. This is a straightforward approach with low operational overhead.
Question #207
A SysOps administrator is tasked with deploying a company’s infrastructure as code. The SysOps administrator want to write a single template that can be reused for multiple environments.
How should the SysOps administrator use AWS CloudFormation to create a solution?
- A . Use Amazon EC2 user data in a CloudFormation template
- B . Use nested stacks to provision resources
- C . Use parameters in a CloudFormation template
- D . Use stack policies to provision resources
Correct Answer: C
C
Explanation:
Reuse templates to replicate stacks in multiple environments After you have your stacks and resources set up, you can reuse your templates to replicate your infrastructure in multiple environments. For example, you can create environments for development, testing, and production so that you can test changes before implementing them into production. To make templates reusable, use the parameters, mappings, and conditions sections so that you can customize your stacks when you create them. For example, for your development environments, you can specify a lower-cost instance type compared to your production environment, but all other configurations and settings remain the same.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#reuse
C
Explanation:
Reuse templates to replicate stacks in multiple environments After you have your stacks and resources set up, you can reuse your templates to replicate your infrastructure in multiple environments. For example, you can create environments for development, testing, and production so that you can test changes before implementing them into production. To make templates reusable, use the parameters, mappings, and conditions sections so that you can customize your stacks when you create them. For example, for your development environments, you can specify a lower-cost instance type compared to your production environment, but all other configurations and settings remain the same.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#reuse
Question #208
A company is using AWS Certificate Manager (ACM) to manage public SSL/TLS certificates. A SysOps administrator needs to send an email notification when a certificate has less than 14 days until expiration.
Which solution will meet this requirement with the LEAST operational overhead?
- A . Create an Amazon CloudWatch custom metric to monitor certificate expiration for all ACM certificates. Create an Amazon EventBridge rule that has an event source of a ws. cloud watch Configure the rule to send an event to a target Amazon Simple Notification Service (Amazon SNS) topic if the DaysToExpiry metric is less than 14. Subscribe the appropriate email addresses to the SNS topic.
- B . Create an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry melric for all ACM certificates.
Configure the rule to send an event to a target Amazon Simple Notification Service (Amazon SNS) topic if DaysToExpiry is less than 14. Subscribe the appropriate email addresses to the SNS topic. - C . Create an Amazon CloudWatch dashboard that displays the DaysToExpiry metric for all ACM certificates. If DaysToExpiry is less than 14, send an email
message to the appropriate email addresses. Send the email message by running a predefined CLI command to publish to an Amazon Simple Notification Service (Amazon SNS) topic. - D . Create an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to evaluate the DaysToExpiry metric for all ACM certificates. Configure a target SMS identity that uses a predefined email template. Configure the rule to send an event to the target SMS identity if DaysToExpiry is less than 14.
Correct Answer: B
B
Explanation:
To send an email notification when an ACM certificate has less than 14 days until expiration, the most operationally efficient solution is to create an Amazon EventBridge rule that directly monitors AWS ACM for certificate expiry details. EventBridge can capture aws.acm events related to certificate expiration and evaluate the DaysToExpiry metric directly. Configure the rule to send notifications to an Amazon SNS topic when DaysToExpiry is less than 14, and subscribe the necessary email addresses to this SNS topic. This approach avoids the need for custom metrics or manual monitoring, providing a streamlined and automatic notification system. Option B is the correct answer as it leverages native integration between ACM, EventBridge, and SNS for minimal operational overhead. More details on EventBridge rules can be found in AWS documentation EventBridge Rules.
B
Explanation:
To send an email notification when an ACM certificate has less than 14 days until expiration, the most operationally efficient solution is to create an Amazon EventBridge rule that directly monitors AWS ACM for certificate expiry details. EventBridge can capture aws.acm events related to certificate expiration and evaluate the DaysToExpiry metric directly. Configure the rule to send notifications to an Amazon SNS topic when DaysToExpiry is less than 14, and subscribe the necessary email addresses to this SNS topic. This approach avoids the need for custom metrics or manual monitoring, providing a streamlined and automatic notification system. Option B is the correct answer as it leverages native integration between ACM, EventBridge, and SNS for minimal operational overhead. More details on EventBridge rules can be found in AWS documentation EventBridge Rules.
Question #209
The company requires a disaster recovery solution for an Aurora PostgreSQL database with a 20-second RPO.
- A . Reconfigure the database to be an Aurora global database. Set the RPO to 20 seconds.
- B . Reconfigure the database to be an Aurora Serverless v2 database with an Aurora Replica in a separate Availability Zone. Set the replica lag to 20 seconds.
- C . Modify the database to use a Multi-AZ cluster that has two readable standby instances in separate Availability Zones. Add an Aurora Replica in a separate Availability Zone. Set the replica lag to 20 seconds.
Correct Answer: A
A
Explanation:
Aurora Global Databases are designed for cross-Region disaster recovery with very low RPO, meeting the 20-second requirement. Setting up Aurora as a global database with the correct configuration ensures low-latency replication and rapid failover, making it ideal for compliance with strict disaster recovery requirements.
A
Explanation:
Aurora Global Databases are designed for cross-Region disaster recovery with very low RPO, meeting the 20-second requirement. Setting up Aurora as a global database with the correct configuration ensures low-latency replication and rapid failover, making it ideal for compliance with strict disaster recovery requirements.
Question #210
A company has an application that is running on Amazon EC2 instances in a VPC. The application needs access to download software updates from the internet. The VPC has public subnets and private signets. The company’s security policy requires all ECS instances to be deployed in private subnets
What should a SysOps administrator do to meet those requirements?
- A . Add an internet gateway to the VPC In the route table for the private subnets, odd a route to the interne; gateway.
- B . Add a NAT gateway to a private subnet. In the route table for the private subnets, add a route to the NAT gateway.
- C . Add a NAT gateway to a public subnet in the route table for the private subnets, add a route to the NAT gateway.
- D . Add two internet gateways to the VPC. In The route tablet for the private subnets and public subnets, add a route to each internet gateway.
Correct Answer: C
C
Explanation:
To ensure that EC2 instances in private subnets can access the internet for software updates while complying with the security policy that requires instances to be in private subnets, you should use a NAT gateway. A NAT gateway allows instances in private subnets to initiate outbound traffic to the internet but prevents the internet from initiating connections to those instances.
Steps:
Create a NAT Gateway:
Open the Amazon VPC console.
In the navigation pane, choose "NAT Gateways".
Choose "Create NAT Gateway".
Select the public subnet where you want to create the NAT gateway.
Choose an Elastic IP address for the NAT gateway.
Choose "Create a NAT Gateway".
Update the Route Table for Private Subnets:
Open the Amazon VPC console.
In the navigation pane, choose "Route Tables".
Select the route table associated with your private subnets.
Choose the "Routes" tab and then "Edit routes".
Add a route with the destination 0.0.0.0/0 and the target as the NAT gateway ID.
Save the changes.
This setup ensures that instances in private subnets can access the internet via the NAT gateway in the public subnet.
Reference: AWS NAT Gateway Documentation
VPC Route Tables
C
Explanation:
To ensure that EC2 instances in private subnets can access the internet for software updates while complying with the security policy that requires instances to be in private subnets, you should use a NAT gateway. A NAT gateway allows instances in private subnets to initiate outbound traffic to the internet but prevents the internet from initiating connections to those instances.
Steps:
Create a NAT Gateway:
Open the Amazon VPC console.
In the navigation pane, choose "NAT Gateways".
Choose "Create NAT Gateway".
Select the public subnet where you want to create the NAT gateway.
Choose an Elastic IP address for the NAT gateway.
Choose "Create a NAT Gateway".
Update the Route Table for Private Subnets:
Open the Amazon VPC console.
In the navigation pane, choose "Route Tables".
Select the route table associated with your private subnets.
Choose the "Routes" tab and then "Edit routes".
Add a route with the destination 0.0.0.0/0 and the target as the NAT gateway ID.
Save the changes.
This setup ensures that instances in private subnets can access the internet via the NAT gateway in the public subnet.
Reference: AWS NAT Gateway Documentation
VPC Route Tables