Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #221
An errant process is known to use an entire processor and run at 100%. A SysOps administrator wants to automate restarting the instance once the problem occurs for more than 2 minutes.
How can this be accomplished?
- A . Create an Amazon CloudWatch alarm for the Amazon EC2 instance with basic monitoring. Enable an action to restart the instance.
- B . Create a CloudWatch alarm for the EC2 instance with detailed monitoring. Enable an action to restart the instance.
- C . Create an AWS Lambda function to restart the EC2 instance, triggered on a scheduled basis every 2 minutes.
- D . Create a Lambda function to restart the EC2 instance, triggered by EC2 health checks.
Correct Answer: B
B
Explanation:
To automate restarting an EC2 instance when it uses an entire processor and runs at 100% for more than 2 minutes, follow these steps:
Enable Detailed Monitoring: Ensure that your EC2 instance has detailed monitoring enabled. This provides data at 1-minute intervals, which is necessary for setting a CloudWatch alarm based on CPU usage.
Create a CloudWatch Alarm:
Go to the CloudWatch console.
Click on "Alarms" and then "Create Alarm."
Select "EC2 Metrics" and choose the instance for which you want to create the alarm.
Select the CPU utilization metric.
Set the threshold type to static and define the threshold (e.g., CPU utilization > 90% for 2 consecutive periods of 1 minute each).
Configure the alarm actions to specify the action to take when the alarm state is triggered. Choose the "EC2 action" and then "Reboot instance."
Review and Create: Review the settings and create the alarm.
Reference: Amazon CloudWatch Alarms
Amazon EC2 Monitoring
B
Explanation:
To automate restarting an EC2 instance when it uses an entire processor and runs at 100% for more than 2 minutes, follow these steps:
Enable Detailed Monitoring: Ensure that your EC2 instance has detailed monitoring enabled. This provides data at 1-minute intervals, which is necessary for setting a CloudWatch alarm based on CPU usage.
Create a CloudWatch Alarm:
Go to the CloudWatch console.
Click on "Alarms" and then "Create Alarm."
Select "EC2 Metrics" and choose the instance for which you want to create the alarm.
Select the CPU utilization metric.
Set the threshold type to static and define the threshold (e.g., CPU utilization > 90% for 2 consecutive periods of 1 minute each).
Configure the alarm actions to specify the action to take when the alarm state is triggered. Choose the "EC2 action" and then "Reboot instance."
Review and Create: Review the settings and create the alarm.
Reference: Amazon CloudWatch Alarms
Amazon EC2 Monitoring
Question #222
An application is deployed in a VPC in both the us-east-2 and eu-west-1 Regions. A significant amount of data needs to be transferred between the two Regions.
What is the MOST cost-effective way to set up the data transfer?
- A . Establish a VPN connection between the Regions using third-party VPN products from AWS Marketplace.
- B . Establish Amazon CloudFront distributions tor the Amazon EC2 instances from both Regions.
- C . Establish an inter-Region VPC peering connection between the VPCs.
- D . Establish an AWS PrivateLinK connection between the two Regions.
Correct Answer: C
C
Explanation:
To efficiently transfer a significant amount of data between VPCs in different regions, establishing an inter-region VPC peering connection is the most cost-effective method. This setup allows direct network connectivity between two VPCs in different regions, which can handle large data transfers without the need for intermediate devices or services. Option C is the most straightforward and economical choice for this requirement. Further details can be found in the AWS documentation on VPC Peering VPC Peering.
C
Explanation:
To efficiently transfer a significant amount of data between VPCs in different regions, establishing an inter-region VPC peering connection is the most cost-effective method. This setup allows direct network connectivity between two VPCs in different regions, which can handle large data transfers without the need for intermediate devices or services. Option C is the most straightforward and economical choice for this requirement. Further details can be found in the AWS documentation on VPC Peering VPC Peering.
Question #223
A company is managing many accounts by using a single organization in AWS Organizations. The organization has all features enabled. The company wants to turn on AWS Config in all the accounts of the organization and in all AWS Regions.
What should a Sysops administrator do to meet these requirements in the MOST operationally efficient way?
- A . Use AVVS CloudFormation StackSets to deploy stack instances that turn on AWS Config in all accounts and in all Regions.
- B . Use AWS CloudFormation StackSets to deploy stack policies that turn on AWS Config in all accounts and in all Regions.
- C . Use service control policies (SCPs) to configure AWS Config in all accounts and in all Regions.
- D . Create a script that uses the AWS CLI to turn on AWS Config in all accounts in the organization. Run the script from the organization’s management account.
Correct Answer: A
A
Explanation:
To enable AWS Config in all accounts and all regions within an AWS Organization, the most operationally efficient method is to use AWS CloudFormation StackSets. This allows you to deploy CloudFormation stacks across multiple AWS accounts and regions from a single CloudFormation template.
Create CloudFormation Template:
The template should include the necessary resources to enable AWS Config, such as the AWS::Config::ConfigurationRecorder, AWS::Config::DeliveryChannel, and AWS::Config::ConfigurationAggregator resources.
Create StackSet:
Open the AWS CloudFormation console at AWS CloudFormation Console. Choose Create StackSet and upload your CloudFormation template. Configure StackSet:
Specify the AWS accounts and regions where you want to deploy the stacks.
Set the deployment options, including the execution role and administrator role.
Deploy Stack Instances:
Deploy the stack instances to all specified accounts and regions. This will automatically enable AWS Config in each account and region.
Reference: AWS CloudFormation StackSets
Managing AWS Config Across Multiple Accounts
A
Explanation:
To enable AWS Config in all accounts and all regions within an AWS Organization, the most operationally efficient method is to use AWS CloudFormation StackSets. This allows you to deploy CloudFormation stacks across multiple AWS accounts and regions from a single CloudFormation template.
Create CloudFormation Template:
The template should include the necessary resources to enable AWS Config, such as the AWS::Config::ConfigurationRecorder, AWS::Config::DeliveryChannel, and AWS::Config::ConfigurationAggregator resources.
Create StackSet:
Open the AWS CloudFormation console at AWS CloudFormation Console. Choose Create StackSet and upload your CloudFormation template. Configure StackSet:
Specify the AWS accounts and regions where you want to deploy the stacks.
Set the deployment options, including the execution role and administrator role.
Deploy Stack Instances:
Deploy the stack instances to all specified accounts and regions. This will automatically enable AWS Config in each account and region.
Reference: AWS CloudFormation StackSets
Managing AWS Config Across Multiple Accounts
Question #224
A company hosts its website in the us-east-1 Region. The company is preparing to deploy its website into the eu-central-1 Region. Website visitors who are located in Europe should access the website that is hosted in eu-central-1. All other visitors access the website that is hosted in us-east-1. The company uses Amazon Route 53 to manage the website’s DNS records.
Which routing policy should a SysOps administrator apply to the Route 53 record set to meet these requirements?
- A . Geolocation routing policy
- B . Geoproximity routing policy
- C . Latency routing policy
- D . Multivalue answer routing policy
Correct Answer: A
A
Explanation:
geolocation "Geolocation routing lets you choose the resources that serve your traffic based on the geographic location of your users, meaning the location that DNS queries originate from. For example, you might want all queries from Europe to be routed to an ELB load balancer in the Frankfurt region."
Could be confused with geoproximity – "Geoproximity routing lets Amazon Route 53 route traffic to your resources based on the geographic location of your users and your resources. You can also optionally choose to route more traffic or less to a given resource by specifying a value, known as a bias. A bias expands or shrinks the size of the geographic region from which traffic is routed to a resource" the use case is not needed as per question.
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html
A
Explanation:
geolocation "Geolocation routing lets you choose the resources that serve your traffic based on the geographic location of your users, meaning the location that DNS queries originate from. For example, you might want all queries from Europe to be routed to an ELB load balancer in the Frankfurt region."
Could be confused with geoproximity – "Geoproximity routing lets Amazon Route 53 route traffic to your resources based on the geographic location of your users and your resources. You can also optionally choose to route more traffic or less to a given resource by specifying a value, known as a bias. A bias expands or shrinks the size of the geographic region from which traffic is routed to a resource" the use case is not needed as per question.
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html
Question #225
A SysOps administrator is responsible for a large fleet of Amazon EC2 instances and must know whether any instances will be affected by upcoming hardware maintenance.
Which option would provide this information with the LEAST administrative overhead?
- A . Deploy a third-party monitoring solution to provide real-time EC2 instance monitoring
- B . List any instances with failed system status checks using the AWS Management Console
- C . Monitor AWS CloudTrail for Stopinstances API calls
- D . Review the AWS Personal Health Dashboard
Correct Answer: D
D
Explanation:
The AWS Personal Health Dashboard provides a personalized view into the performance and availability of the AWS services underlying your AWS resources. It can alert you about upcoming hardware maintenance that could affect your EC2 instances.
Access AWS Personal Health Dashboard:
Open the AWS Personal Health Dashboard at AWS Personal Health Dashboard.
View Service Health:
The dashboard shows a list of recent events, including upcoming scheduled maintenance that might impact your EC2 instances.
You can filter events to view those that specifically affect your EC2 instances.
Set Up Notifications:
You can configure AWS CloudWatch Events or Amazon SNS to send notifications based on Personal Health Dashboard events.
Reference: AWS Personal Health Dashboard
Monitoring AWS Health Events with Amazon CloudWatch Events
https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html
D
Explanation:
The AWS Personal Health Dashboard provides a personalized view into the performance and availability of the AWS services underlying your AWS resources. It can alert you about upcoming hardware maintenance that could affect your EC2 instances.
Access AWS Personal Health Dashboard:
Open the AWS Personal Health Dashboard at AWS Personal Health Dashboard.
View Service Health:
The dashboard shows a list of recent events, including upcoming scheduled maintenance that might impact your EC2 instances.
You can filter events to view those that specifically affect your EC2 instances.
Set Up Notifications:
You can configure AWS CloudWatch Events or Amazon SNS to send notifications based on Personal Health Dashboard events.
Reference: AWS Personal Health Dashboard
Monitoring AWS Health Events with Amazon CloudWatch Events
https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html
Question #225
A SysOps administrator is responsible for a large fleet of Amazon EC2 instances and must know whether any instances will be affected by upcoming hardware maintenance.
Which option would provide this information with the LEAST administrative overhead?
- A . Deploy a third-party monitoring solution to provide real-time EC2 instance monitoring
- B . List any instances with failed system status checks using the AWS Management Console
- C . Monitor AWS CloudTrail for Stopinstances API calls
- D . Review the AWS Personal Health Dashboard
Correct Answer: D
D
Explanation:
The AWS Personal Health Dashboard provides a personalized view into the performance and availability of the AWS services underlying your AWS resources. It can alert you about upcoming hardware maintenance that could affect your EC2 instances.
Access AWS Personal Health Dashboard:
Open the AWS Personal Health Dashboard at AWS Personal Health Dashboard.
View Service Health:
The dashboard shows a list of recent events, including upcoming scheduled maintenance that might impact your EC2 instances.
You can filter events to view those that specifically affect your EC2 instances.
Set Up Notifications:
You can configure AWS CloudWatch Events or Amazon SNS to send notifications based on Personal Health Dashboard events.
Reference: AWS Personal Health Dashboard
Monitoring AWS Health Events with Amazon CloudWatch Events
https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html
D
Explanation:
The AWS Personal Health Dashboard provides a personalized view into the performance and availability of the AWS services underlying your AWS resources. It can alert you about upcoming hardware maintenance that could affect your EC2 instances.
Access AWS Personal Health Dashboard:
Open the AWS Personal Health Dashboard at AWS Personal Health Dashboard.
View Service Health:
The dashboard shows a list of recent events, including upcoming scheduled maintenance that might impact your EC2 instances.
You can filter events to view those that specifically affect your EC2 instances.
Set Up Notifications:
You can configure AWS CloudWatch Events or Amazon SNS to send notifications based on Personal Health Dashboard events.
Reference: AWS Personal Health Dashboard
Monitoring AWS Health Events with Amazon CloudWatch Events
https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html
Question #227
A company recently purchased Savings Plans. The company wants to receive email notification when the company’s utilization drops below 90% for a given day.
Which solution will meet this requirement?
- A . Create an Amazon CloudWatch alarm to monitor the Savings Plan check in AWS Trusted Advisor. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification when the utilization drops below 90% for a given day.
- B . Create an Amazon CloudWatch alarm to monitor the SavingsPlansUtilization metric under the AWS/SavingsPlans namespace in CloudWatch. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification when the utilization drops below 90% for a given day.
- C . Create a Savings Plans alert to monitor the daily utilization of the Savings Plans. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification when the utilization drops below 90% for a given day.
- D . Use AWS Budgets to create a Savings Plans budget to track the daily utilization of the Savings Plans. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification when the utilization drops below 90% for a given day.
Correct Answer: D
D
Explanation:
AWS Budgets can be used to create a Savings Plans budget and track the daily utilization of the company’s Savings Plans. By creating a budget, it will trigger an action when the utilization drops below 90%, which in this case will be to send an email notification via an Amazon SNS topic. This will ensure that the company is notified when their Savings Plans utilization drops below 90%, allowing them to take action if necessary.
Reference: [1] https://docs.aws.amazon.com/savingsplans/latest/userguide/sp-usingBudgets.html
D
Explanation:
AWS Budgets can be used to create a Savings Plans budget and track the daily utilization of the company’s Savings Plans. By creating a budget, it will trigger an action when the utilization drops below 90%, which in this case will be to send an email notification via an Amazon SNS topic. This will ensure that the company is notified when their Savings Plans utilization drops below 90%, allowing them to take action if necessary.
Reference: [1] https://docs.aws.amazon.com/savingsplans/latest/userguide/sp-usingBudgets.html
Question #228
A company’s backend infrastructure contains an Amazon EC2 instance in a private subnet. The private subnet has a route to the internet through a NAT gateway in a public subnet. The instance must allow connectivity to a secure web server on the internet to retrieve data at regular intervals.
The client software times out with an error message that indicates that the client software could not establish the TCP connection.
What should a SysOps administrator do to resolve this error?
- A . Add an inbound rule to the security group for the EC2 instance with the following parameters:
Type – HTTP, Source – 0.0.0.0/0. - B . Add an inbound rule to the security group for the EC2 instance with the following parameters:
Type – HTTPS, Source – 0.0.0.0/0. - C . Add an outbound rule to the security group for the EC2 instance with the following parameters:
Type – HTTP, Destination – 0.0.0.0/0. - D . Add an outbound rule to the security group for the EC2 instance with the following parameters:
Type – HTTPS. Destination – 0.0.0.0/0.
Correct Answer: D
D
Explanation:
To allow the EC2 instance in the private subnet to establish a secure connection to an external web server, follow these steps:
Modify Security Group:
Add an outbound rule to the security group of the EC2 instance with the following parameters:
Type: HTTPS
Destination: 0.0.0.0/0
This allows outbound HTTPS traffic to the internet.
Reference: Security Group Rules
Ensure NAT Gateway Configuration:
Ensure that the NAT gateway is properly configured in the public subnet to allow internet access for the instances in the private subnet.
Reference: NAT Gateways
This configuration will resolve the connectivity issue.
D
Explanation:
To allow the EC2 instance in the private subnet to establish a secure connection to an external web server, follow these steps:
Modify Security Group:
Add an outbound rule to the security group of the EC2 instance with the following parameters:
Type: HTTPS
Destination: 0.0.0.0/0
This allows outbound HTTPS traffic to the internet.
Reference: Security Group Rules
Ensure NAT Gateway Configuration:
Ensure that the NAT gateway is properly configured in the public subnet to allow internet access for the instances in the private subnet.
Reference: NAT Gateways
This configuration will resolve the connectivity issue.
Question #229
A gaming application is deployed on four Amazon EC2 instances in a default VPC. The SysOps administrator has noticed consistently high latency in responses as data is transferred among the four instances. There is no way for the administrator to alter the application code.
The MOST effective way to reduce latency is to relaunch the EC2 instances in:
- A . a dedicated VPC.
- B . a single subnet inside the VPC.
- C . a placement group.
- D . a single Availability Zone.
Correct Answer: C
C
Explanation:
To reduce latency in data transfer among EC2 instances, especially in high-performance computing (HPC) applications or applications requiring low network latency, using a placement group is the best approach:
Understanding Placement Groups:
A placement group in Amazon EC2 is a logical grouping of instances within a single Availability Zone. Using placement groups, you can achieve low-latency network performance necessary for tightly coupled node-to-node communication.
Types of Placement Groups:
Cluster Placement Group: Instances are physically located close together in the same Availability Zone to provide low-latency network performance.
Partition Placement Group: Instances are divided into logical segments called partitions, reducing the likelihood of simultaneous failures.
Spread Placement Group: Instances are placed on distinct underlying hardware to reduce correlated failures.
Creating and Using a Placement Group:
You can create a placement group using the AWS Management Console, AWS CLI, or AWS SDKs.
When launching instances, specify the placement group to ensure they are launched within the same group.
aws ec2 create-placement-group –group-name my-placement-group –strategy cluster
aws ec2 run-instances –image-id ami-12345678 –count 4 –instance-type c5.large –placement GroupName=my-placement-group
Relocating Existing Instances:
Stop the instances, modify the placement group settings, and then restart them. Note that not all instance types are supported within placement groups, so check the documentation for compatibility.
Reference: Placement Groups
Cluster Instances for Low-Latency
C
Explanation:
To reduce latency in data transfer among EC2 instances, especially in high-performance computing (HPC) applications or applications requiring low network latency, using a placement group is the best approach:
Understanding Placement Groups:
A placement group in Amazon EC2 is a logical grouping of instances within a single Availability Zone. Using placement groups, you can achieve low-latency network performance necessary for tightly coupled node-to-node communication.
Types of Placement Groups:
Cluster Placement Group: Instances are physically located close together in the same Availability Zone to provide low-latency network performance.
Partition Placement Group: Instances are divided into logical segments called partitions, reducing the likelihood of simultaneous failures.
Spread Placement Group: Instances are placed on distinct underlying hardware to reduce correlated failures.
Creating and Using a Placement Group:
You can create a placement group using the AWS Management Console, AWS CLI, or AWS SDKs.
When launching instances, specify the placement group to ensure they are launched within the same group.
aws ec2 create-placement-group –group-name my-placement-group –strategy cluster
aws ec2 run-instances –image-id ami-12345678 –count 4 –instance-type c5.large –placement GroupName=my-placement-group
Relocating Existing Instances:
Stop the instances, modify the placement group settings, and then restart them. Note that not all instance types are supported within placement groups, so check the documentation for compatibility.
Reference: Placement Groups
Cluster Instances for Low-Latency
Question #230
A company is creating a new multi-account architecture. A Sysops administrator must implement a login solution to centrally manage user access and permissions across all AWS accounts. The solution must be integrated with AWS Organizations and must be connected to a third-party Security Assertion Markup Language (SAML) 2.0 identity provider (IdP).
What should the SysOps administrator do to meet these requirements?
- A . Configure an Amazon Cognito user pool. Integrate the user pool with the third-party IdP.
- B . Enable and configure AWS Single Sign-On with the third-party IdP.
- C . Federate the third-party IdP with AWS Identity and Access Management (IAM) for each AWS account in the organization.
- D . Integrate the third-party IdP directly with AWS Organizations.
Correct Answer: B
B
Explanation:
AWS Single Sign-On (AWS SSO) provides a centralized interface to manage SSO access to multiple AWS accounts and business applications. AWS SSO integrates with AWS Organizations and supports SAML 2.0 identity providers, making it an ideal solution for centrally managing user access and permissions across multiple AWS accounts.
AWS Single Sign-On (AWS SSO):
AWS SSO allows you to manage SSO access and user permissions to all of your AWS accounts and applications.
It integrates seamlessly with AWS Organizations.
Integration with SAML 2.0 IdP:
AWS SSO supports integration with third-party SAML 2.0 identity providers. This allows centralized management of user identities and access. Steps to Implement:
Enable AWS SSO in your AWS Organizations management account.
Configure AWS SSO to connect with your third-party SAML 2.0 IdP.
Assign user permissions and roles for each AWS account through AWS SSO.
Reference: AWS Single Sign-On
Integrating AWS SSO with SAML 2.0 Identity Providers
B
Explanation:
AWS Single Sign-On (AWS SSO) provides a centralized interface to manage SSO access to multiple AWS accounts and business applications. AWS SSO integrates with AWS Organizations and supports SAML 2.0 identity providers, making it an ideal solution for centrally managing user access and permissions across multiple AWS accounts.
AWS Single Sign-On (AWS SSO):
AWS SSO allows you to manage SSO access and user permissions to all of your AWS accounts and applications.
It integrates seamlessly with AWS Organizations.
Integration with SAML 2.0 IdP:
AWS SSO supports integration with third-party SAML 2.0 identity providers. This allows centralized management of user identities and access. Steps to Implement:
Enable AWS SSO in your AWS Organizations management account.
Configure AWS SSO to connect with your third-party SAML 2.0 IdP.
Assign user permissions and roles for each AWS account through AWS SSO.
Reference: AWS Single Sign-On
Integrating AWS SSO with SAML 2.0 Identity Providers