Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #211
A Sysops administrator configured AWS Backup to capture snapshots from a single Amazon EC2 instance that has one Amazon Elastic Block Store (Amazon EBS) volume attached. On the first snapshot, the EBS volume has 10 GiB of data. On the second snapshot, the EBS volume still contains 10 GiB of data, but 4 GiB have changed. On the third snapshot, 2 GiB of data have been added to the volume, for a total of 12 GiB.
How much total storage is required to store these snapshots?
- A . 12 GiB
- B . 16 GiB
- C . 26 GiB
- D . 32 GiB
Correct Answer: B
B
Explanation:
AWS EBS snapshots are incremental, meaning that after the initial full snapshot, only the blocks that have changed since the last snapshot are saved. Here’s how the storage adds up based on your scenario:
First Snapshot: Captures all 10 GiB of data.
Second Snapshot: Only 4 GiB have changed, so only these changed blocks are stored.
Third Snapshot: An additional 2 GiB of data are added, making only these new 2 GiB stored.
Thus, the total storage required is 10 GiB (initial snapshot) + 4 GiB (second snapshot) + 2 GiB (third snapshot) = 16 GiB.
AWS Documentation
Reference: Details on how EBS snapshots store data can be found here: Amazon EBS Snapshots.
B
Explanation:
AWS EBS snapshots are incremental, meaning that after the initial full snapshot, only the blocks that have changed since the last snapshot are saved. Here’s how the storage adds up based on your scenario:
First Snapshot: Captures all 10 GiB of data.
Second Snapshot: Only 4 GiB have changed, so only these changed blocks are stored.
Third Snapshot: An additional 2 GiB of data are added, making only these new 2 GiB stored.
Thus, the total storage required is 10 GiB (initial snapshot) + 4 GiB (second snapshot) + 2 GiB (third snapshot) = 16 GiB.
AWS Documentation
Reference: Details on how EBS snapshots store data can be found here: Amazon EBS Snapshots.
Question #212
A company migrates a write-once, read-many (WORM) drive to an Amazon S3 bucket that has S3 Object Lock configured in governance mode. During the migration, the company copies unneeded data to the S3 bucket.
A SysOps administrator attempts to delete the unneeded data from the S3 bucket by using the AWS CLI. However, the SysOps administrator receives an error.
Which combination of steps should the SysOps administrator take to successfully delete the unneeded data? (Select TWO.)
- A . Increase the Retain Until Date.
- B . Assume a role that has the s3:BypassLegalRetention permission.
- C . Assume a role that has the s3:BypassGovernanceRetention permission.
- D . Include the x-amz-bypass-governance-retention:true header in the request when issuing the delete command.
- E . Include the x-amz-bypass-legal-retention:true header in the request when issuing the delete command.
Correct Answer: C, D
C, D
Explanation:
When using Amazon S3 Object Lock configured in governance mode, deleting objects before their retention period ends requires specific permissions. To bypass these governance restrictions, the administrator must:
C: Assume a role that has the s3:BypassGovernanceRetention permission. This permission allows the role to override the governance mode restrictions.
D: Include the x-amz-bypass-governance-retention:true header in the delete request. This header is necessary to programmatically bypass the governance retention settings when making a delete request via the AWS CLI or SDK. These steps enable the deletion of objects under governance mode retention without waiting for the retention period to expire, addressing the need to remove unintended data uploads effectively. For further details, refer to the AWS documentation on S3 Object Lock Amazon S3 Object Lock.
C, D
Explanation:
When using Amazon S3 Object Lock configured in governance mode, deleting objects before their retention period ends requires specific permissions. To bypass these governance restrictions, the administrator must:
C: Assume a role that has the s3:BypassGovernanceRetention permission. This permission allows the role to override the governance mode restrictions.
D: Include the x-amz-bypass-governance-retention:true header in the delete request. This header is necessary to programmatically bypass the governance retention settings when making a delete request via the AWS CLI or SDK. These steps enable the deletion of objects under governance mode retention without waiting for the retention period to expire, addressing the need to remove unintended data uploads effectively. For further details, refer to the AWS documentation on S3 Object Lock Amazon S3 Object Lock.
Question #213
A company has deployed AWS Security Hub and AWS Config in a newly implemented organization in AWS Organizations. A SysOps administrator must implement a solution to restrict all member accounts in the organization from deploying Amazon EC2 resources in the ap-southeast-2 Region. The solution must be implemented from a single point and must govern an current and future accounts. The use of root credentials also must be restricted in member accounts.
Which AWS feature should the SysOps administrator use to meet these requirements?
- A . AWS Config aggregator
- B . IAM user permissions boundaries
- C . AWS Organizations service control policies (SCPs)
- D . AWS Security Hub conformance packs
Correct Answer: C
C
Explanation:
To restrict EC2 resource deployment in a specific region and restrict root credentials usage:
Create Service Control Policies (SCPs):
Use AWS Organizations to create SCPs that restrict actions for all member accounts.
Create an SCP to deny the creation of EC2 instances in the ap-southeast-2 region.
Create an SCP to deny the use of root credentials in member accounts.
Reference: Service Control Policies
Attach SCPs:
Attach the SCPs to the organizational units (OUs) or directly to the accounts as needed.
Reference: Attaching SCPs
This approach provides centralized control over account policies, ensuring compliance across current and future accounts.
C
Explanation:
To restrict EC2 resource deployment in a specific region and restrict root credentials usage:
Create Service Control Policies (SCPs):
Use AWS Organizations to create SCPs that restrict actions for all member accounts.
Create an SCP to deny the creation of EC2 instances in the ap-southeast-2 region.
Create an SCP to deny the use of root credentials in member accounts.
Reference: Service Control Policies
Attach SCPs:
Attach the SCPs to the organizational units (OUs) or directly to the accounts as needed.
Reference: Attaching SCPs
This approach provides centralized control over account policies, ensuring compliance across current and future accounts.
Question #214
The company wants to ensure that SSH access to EC2 instances is not publicly accessible, and if it
becomes open, it needs to close the port immediately. (Select TWO):
- A . Add an Amazon CloudWatch alarm to detect the security groups that allow SSH.
- B . Add an AWS Config rule to detect the security groups that allow SSH.
- C . Add an assessment template to Amazon Inspector to detect the security groups that allow SSH.
- D . Call an AWS Systems Manager Automation runbook to close the port.
- E . Call AWS Systems Manager Run Command to close the port.
Correct Answer: B, D
B, D
Explanation:
To monitor and remediate open SSH ports, AWS Config and Systems Manager Automation are ideal:
AWS Config Rule: Use AWS Config to monitor security groups and detect when SSH (port 22) is open to the public. Config rules can be set up to trigger remediation actions automatically.
Systems Manager Automation Runbook: Create or use a predefined automation runbook that can remove the open SSH rule from security groups, thus closing port 22 to the public.
CloudWatch alarms are not ideal for monitoring security group configurations. Amazon Inspector focuses on vulnerability assessment rather than continuous monitoring for specific port access.
B, D
Explanation:
To monitor and remediate open SSH ports, AWS Config and Systems Manager Automation are ideal:
AWS Config Rule: Use AWS Config to monitor security groups and detect when SSH (port 22) is open to the public. Config rules can be set up to trigger remediation actions automatically.
Systems Manager Automation Runbook: Create or use a predefined automation runbook that can remove the open SSH rule from security groups, thus closing port 22 to the public.
CloudWatch alarms are not ideal for monitoring security group configurations. Amazon Inspector focuses on vulnerability assessment rather than continuous monitoring for specific port access.
Question #215
A company has deployed a web application in a VPC that has subnets in three Availability Zones. The company launches three Amazon EC2 instances from an EC2 Auto Scaling group behind an Application Load Balancer (ALB).
A SysOps administrator notices that two of the EC2 instances are in the same Availability Zone, rather than being distributed evenly across all three Availability Zones. There are no errors in the Auto Scaling group’s activity history.
What is the MOST likely reason for the unexpected placement of EC2 instances?
- A . One Availability Zone did not have sufficient capacity for the requested EC2 instance type.
- B . The ALB was configured for only two Availability Zones.
- C . The Auto Scaling group was configured for only two Availability Zones.
- D . Amazon EC2 Auto Scaling randomly placed the instances in Availability Zones.
Correct Answer: A
A
Explanation:
The most likely reason for the unexpected placement of EC2 instances is that one Availability Zone did not have sufficient capacity for the requested EC2 instance type.
Capacity Constraints:
AWS manages EC2 instance placement based on available capacity in the Availability Zones.
If a particular Availability Zone does not have enough capacity for the instance type you requested, AWS will place instances in other Availability Zones with sufficient capacity.
Auto Scaling Group Configuration:
Even if the Auto Scaling group is configured to use all three Availability Zones, instances might not be evenly distributed if one zone lacks the required capacity.
This can result in instances being placed in the remaining zones with available capacity.
Monitoring and Mitigation:
Monitor the capacity limits and instance distribution using CloudWatch and the Auto Scaling group’s activity history.
Consider using smaller instance types or different instance families to avoid capacity issues in specific zones.
Reference: Amazon EC2 Auto Scaling
Troubleshooting Amazon EC2 Capacity Issues
A
Explanation:
The most likely reason for the unexpected placement of EC2 instances is that one Availability Zone did not have sufficient capacity for the requested EC2 instance type.
Capacity Constraints:
AWS manages EC2 instance placement based on available capacity in the Availability Zones.
If a particular Availability Zone does not have enough capacity for the instance type you requested, AWS will place instances in other Availability Zones with sufficient capacity.
Auto Scaling Group Configuration:
Even if the Auto Scaling group is configured to use all three Availability Zones, instances might not be evenly distributed if one zone lacks the required capacity.
This can result in instances being placed in the remaining zones with available capacity.
Monitoring and Mitigation:
Monitor the capacity limits and instance distribution using CloudWatch and the Auto Scaling group’s activity history.
Consider using smaller instance types or different instance families to avoid capacity issues in specific zones.
Reference: Amazon EC2 Auto Scaling
Troubleshooting Amazon EC2 Capacity Issues
Question #216
A company uses an Amazon CloudFront distribution to deliver its website. Traffic logs for the website must be centrally stored, and all data must be encrypted at rest.
Which solution will meet these requirements?
- A . Create an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with internet access and server-side encryption that uses the default AWS managed key. Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination.
- B . Create an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with VPC access and server-side encryption that uses AES-256 Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination.
- C . Create an Amazon S3 bucket that Is configured with default server-side encryption that uses AES-256. Configure CloudFront to use the S3 bucket as a log destination.
- D . Create an Amazon S3 bucket that is configured with no default encryption. Enable encryption in the CloudFront distribution, and use the S3 bucket as a log destination.
Correct Answer: C
C
Explanation:
To centrally store traffic logs for a website delivered through Amazon CloudFront and ensure all data is encrypted at rest, using an S3 bucket with default server-side encryption is the optimal solution.
Create an S3 Bucket:
Open the Amazon S3 console at Amazon S3 Console.
Create a new S3 bucket for storing the logs.
Enable Default Encryption:
Select the S3 bucket, navigate to Properties, and enable Default encryption. Choose AES-256 for server-side encryption. Configure CloudFront Logging:
Open the Amazon CloudFront console at Amazon CloudFront Console.
Select the CloudFront distribution and navigate to Edit.
In the logging section, enable logging and specify the S3 bucket created for log storage.
This setup ensures that all logs are encrypted at rest using AES-256 and stored centrally in an S3 bucket.
Reference: Amazon CloudFront Access Logs
Amazon S3 Default Encryption
C
Explanation:
To centrally store traffic logs for a website delivered through Amazon CloudFront and ensure all data is encrypted at rest, using an S3 bucket with default server-side encryption is the optimal solution.
Create an S3 Bucket:
Open the Amazon S3 console at Amazon S3 Console.
Create a new S3 bucket for storing the logs.
Enable Default Encryption:
Select the S3 bucket, navigate to Properties, and enable Default encryption. Choose AES-256 for server-side encryption. Configure CloudFront Logging:
Open the Amazon CloudFront console at Amazon CloudFront Console.
Select the CloudFront distribution and navigate to Edit.
In the logging section, enable logging and specify the S3 bucket created for log storage.
This setup ensures that all logs are encrypted at rest using AES-256 and stored centrally in an S3 bucket.
Reference: Amazon CloudFront Access Logs
Amazon S3 Default Encryption
Question #216
A company uses an Amazon CloudFront distribution to deliver its website. Traffic logs for the website must be centrally stored, and all data must be encrypted at rest.
Which solution will meet these requirements?
- A . Create an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with internet access and server-side encryption that uses the default AWS managed key. Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination.
- B . Create an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with VPC access and server-side encryption that uses AES-256 Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination.
- C . Create an Amazon S3 bucket that Is configured with default server-side encryption that uses AES-256. Configure CloudFront to use the S3 bucket as a log destination.
- D . Create an Amazon S3 bucket that is configured with no default encryption. Enable encryption in the CloudFront distribution, and use the S3 bucket as a log destination.
Correct Answer: C
C
Explanation:
To centrally store traffic logs for a website delivered through Amazon CloudFront and ensure all data is encrypted at rest, using an S3 bucket with default server-side encryption is the optimal solution.
Create an S3 Bucket:
Open the Amazon S3 console at Amazon S3 Console.
Create a new S3 bucket for storing the logs.
Enable Default Encryption:
Select the S3 bucket, navigate to Properties, and enable Default encryption. Choose AES-256 for server-side encryption. Configure CloudFront Logging:
Open the Amazon CloudFront console at Amazon CloudFront Console.
Select the CloudFront distribution and navigate to Edit.
In the logging section, enable logging and specify the S3 bucket created for log storage.
This setup ensures that all logs are encrypted at rest using AES-256 and stored centrally in an S3 bucket.
Reference: Amazon CloudFront Access Logs
Amazon S3 Default Encryption
C
Explanation:
To centrally store traffic logs for a website delivered through Amazon CloudFront and ensure all data is encrypted at rest, using an S3 bucket with default server-side encryption is the optimal solution.
Create an S3 Bucket:
Open the Amazon S3 console at Amazon S3 Console.
Create a new S3 bucket for storing the logs.
Enable Default Encryption:
Select the S3 bucket, navigate to Properties, and enable Default encryption. Choose AES-256 for server-side encryption. Configure CloudFront Logging:
Open the Amazon CloudFront console at Amazon CloudFront Console.
Select the CloudFront distribution and navigate to Edit.
In the logging section, enable logging and specify the S3 bucket created for log storage.
This setup ensures that all logs are encrypted at rest using AES-256 and stored centrally in an S3 bucket.
Reference: Amazon CloudFront Access Logs
Amazon S3 Default Encryption
Question #218
A company is managing multiple AWS accounts in AWS Organizations. The company is reviewing internal security of its AWS environment. The company’s security administrator has their own AWS account and wants to review the VPC configuration of developer AWS accounts.
Which solution will meet these requirements in the MOST secure manner?
- A . Create an IAM policy in each developer account that has read-only access related to VPC resources Assign the policy to an IAM user. Share the user credentials with the security administrator.
- B . Create an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions. Assign the policy to an IAM
user. Share the user credentials with the security administrator. - C . Create an IAM policy in each developer account that has administrator access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.
- D . Create an IAM policy in each developer account that has read-only access related to VPC resources Assign the policy to a cross-account IAM role Ask the security administrator to assume the role from their account.
Correct Answer: D
D
Explanation:
To securely allow a security administrator to review the VPC configuration of developer AWS accounts, the best approach is to create a cross-account IAM role with read-only access to VPC resources. Here’s how to do it:
Create IAM Policy:
In each developer account, create an IAM policy with read-only permissions "Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeNetworkAcls"
],
"Resource": "*"
}
]
}
Create Cross-Account IAM Role:
Create an IAM role in each developer account, assign the read-only policy to the role, and allow the security administrator’s account to assume the role.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::security-admin-account-id:root"
},
"Action": "sts:AssumeRole"
}
]
}
Assume the Role:
The security administrator can assume the role from their own account using the AWS Management Console or AWS CLI.
aws sts assume-role –role-arn arn:aws:iam::developer-account-id:role/role-name –role-session-name security-admin-session
Review VPC Configuration:
After assuming the role, the security administrator can review the VPC configuration using the AWS Management Console or AWS CLI with the temporary credentials.
Reference: IAM Policies and Roles
Cross-Account Access
AWS CLI Assume Role
D
Explanation:
To securely allow a security administrator to review the VPC configuration of developer AWS accounts, the best approach is to create a cross-account IAM role with read-only access to VPC resources. Here’s how to do it:
Create IAM Policy:
In each developer account, create an IAM policy with read-only permissions "Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeNetworkAcls"
],
"Resource": "*"
}
]
}
Create Cross-Account IAM Role:
Create an IAM role in each developer account, assign the read-only policy to the role, and allow the security administrator’s account to assume the role.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::security-admin-account-id:root"
},
"Action": "sts:AssumeRole"
}
]
}
Assume the Role:
The security administrator can assume the role from their own account using the AWS Management Console or AWS CLI.
aws sts assume-role –role-arn arn:aws:iam::developer-account-id:role/role-name –role-session-name security-admin-session
Review VPC Configuration:
After assuming the role, the security administrator can review the VPC configuration using the AWS Management Console or AWS CLI with the temporary credentials.
Reference: IAM Policies and Roles
Cross-Account Access
AWS CLI Assume Role
Question #219
The SysOps administrator needs to create a key policy that grants data engineers least privilege access to decrypt and read data from an S3 bucket encrypted with KMS.
- A . "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:Encrypt", "kms:DescribeKey"
- B . "kms:ListAliases", "kms:GetKeyPolicy", "kms:Describe*", "kms:Decrypt"
- C . "kms:ListAliases", "kms:DescribeKey", "kms:Decrypt"
- D . "kms:Update*", "kms:TagResource", "kms:Revoke*", "kms:Put*", "kms:List*", "kms:Get*", "kms:Enable*", "kms:Disable*", "kms:Describe*", "kms:Delete*", "kms:Create*", kms:CancelKeyDeletion
Correct Answer: C
C
Explanation:
The least privilege required for reading encrypted data involves kms:Decrypt to decrypt, kms:DescribeKey to understand key properties, and kms:ListAliases if needed to identify the key alias.
C
Explanation:
The least privilege required for reading encrypted data involves kms:Decrypt to decrypt, kms:DescribeKey to understand key properties, and kms:ListAliases if needed to identify the key alias.
Question #220
A SysOps administrator needs to give users the ability to upload objects to an Amazon S3 bucket. The SysOps administrator creates a presigned URL and provides the URL to a user, but the user cannot upload an object to the S3 bucket. The presigned URL has not expired, and no bucket policy is applied to the S3 bucket.
Which of the following could be the cause of this problem?
- A . The user has not properly configured the AWS CLI with their access key and secret access key.
- B . The SysOps administrator does not have the necessary permissions to upload the object to the S3 bucket.
- C . The SysOps administrator must apply a bucket policy to the S3 bucket to allow the user to upload the object.
- D . The object already has been uploaded through the use of the presigned URL, so the presigned URL is no longer valid.
Correct Answer: B
B
Explanation:
Step-by-Step
Understand the Problem:
A user cannot upload an object to an S3 bucket using a presigned URL, even though the URL is valid and the bucket has no policy applied.
Analyze the Requirements:
Determine the cause of the issue preventing the upload via the presigned URL.
Evaluate the Options:
Option A: The user has not properly configured the AWS CLI.
CLI configuration is not relevant to using a presigned URL.
Option B: The SysOps administrator does not have the necessary permissions.
The administrator’s permissions are required to generate a valid presigned URL with sufficient permissions.
Option C: A bucket policy is required.
A bucket policy is not necessary if the presigned URL has the correct permissions.
Option D: The object has already been uploaded.
A presigned URL remains valid until it expires or the specified permissions are revoked.
Select the Best Solution:
Option B: Ensuring that the SysOps administrator has the necessary permissions to upload objects to the S3 bucket is crucial for generating valid presigned URLs.
Reference: Amazon S3 Presigned URLs
IAM Policies for Amazon S3
The SysOps administrator must have the necessary permissions to upload objects to the S3 bucket, ensuring that the presigned URL generated allows the user to upload successfully.
B
Explanation:
Step-by-Step
Understand the Problem:
A user cannot upload an object to an S3 bucket using a presigned URL, even though the URL is valid and the bucket has no policy applied.
Analyze the Requirements:
Determine the cause of the issue preventing the upload via the presigned URL.
Evaluate the Options:
Option A: The user has not properly configured the AWS CLI.
CLI configuration is not relevant to using a presigned URL.
Option B: The SysOps administrator does not have the necessary permissions.
The administrator’s permissions are required to generate a valid presigned URL with sufficient permissions.
Option C: A bucket policy is required.
A bucket policy is not necessary if the presigned URL has the correct permissions.
Option D: The object has already been uploaded.
A presigned URL remains valid until it expires or the specified permissions are revoked.
Select the Best Solution:
Option B: Ensuring that the SysOps administrator has the necessary permissions to upload objects to the S3 bucket is crucial for generating valid presigned URLs.
Reference: Amazon S3 Presigned URLs
IAM Policies for Amazon S3
The SysOps administrator must have the necessary permissions to upload objects to the S3 bucket, ensuring that the presigned URL generated allows the user to upload successfully.