Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company runs a web application on three Amazon EC2 instances behind an Application Load Balancer (ALB). The company notices that random periods of increased traffic cause a degradation in the application’s performance. A SysOps administrator must scale the application to meet the increased traffic.
Which solution meets these requirements?
- A . Create an Amazon CloudWatch alarm to monitor application latency and increase the size of each
EC2 instance if the desired threshold is reached. - B . Create an Amazon EventBridge (Amazon CloudWatch Events) rule to monitor application latency and add an EC2 instance to the ALB if the desired threshold is reached.
- C . Deploy the application to an Auto Scaling group of EC2 instances with a target tracking scaling policy. Attach the ALB to the Auto Scaling group.
- D . Deploy the application to an Auto Scaling group of EC2 instances with a scheduled scaling policy.
Attach the ALB to the Auto Scaling group.
C
Explanation:
Auto Scaling groups automatically adjust the number of EC2 instances to handle the load on your application. A target tracking scaling policy adjusts the capacity of the Auto Scaling group based on a target metric, such as CPU utilization or application latency.
Create an Auto Scaling Group:
Navigate to the EC2 console and select "Auto Scaling Groups".
Create a new Auto Scaling group and specify the launch template or configuration for your EC2 instances.
Configure Target Tracking Scaling Policy:
In the Auto Scaling group settings, add a scaling policy.
Choose "Target Tracking" and select a predefined metric such as "Average CPU Utilization".
Set the target value (e.g., 50% CPU utilization).
Attach ALB to Auto Scaling Group:
In the "Load Balancing" section of the Auto Scaling group settings, attach your existing ALB. This ensures that new instances are automatically registered with the ALB. Review and Create:
Review the Auto Scaling group settings and create the group.
Reference: Amazon EC2 Auto Scaling
Target Tracking Scaling Policies
A company is partnering with an external vendor to provide data processing services. For this integration, the vendor must host the company’s data in an Amazon S3 bucket in the vendor’s AWS account. The vendor is allowing the company to provide an AWS Key Management Service (AWS KMS) key to encrypt the company’s data. The vendor has provided an IAM role Amazon Resource Name (ARN) to the company for this integration.
What should a SysOps administrator do to configure this integration?
- A . Create a new KMS key. Add the vendor’s IAM role ARN to the KMS key policy. Provide the new KMS key ARN to the vendor.
- B . Create a new KMS key. Create a new IAM user. Add the vendor’s IAM role ARN to an inline policy that is attached to the IAM user. Provide the new IAM user ARN to the vendor.
- C . Configure encryption using the KMS managed S3 key. Add the vendor’s IAM role ARN to the KMS managed S3 key policy. Provide the KMS managed S3 key ARN to the vendor.
- D . Configure encryption using the KMS managed S3 key. Create an S3 bucket. Add the vendor’s IAM role ARN to the S3 bucket policy. Provide the S3 bucket ARN to the vendor.
A
Explanation:
To configure integration with an external vendor and ensure that the vendor can use the AWS KMS key to encrypt the company’s data in the vendor’s AWS account, follow these steps:
Create a New KMS Key:
Navigate to the AWS KMS console.
Create a new KMS key that will be used to encrypt the data.
Reference: Creating Keys
Add the Vendor’s IAM Role ARN to the KMS Key Policy:
Edit the key policy of the new KMS key to allow the vendor’s IAM role to use the key.
Example key policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::vendor-account-id:role/vendor-role-name"
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
}
]
}
Reference: Key Policies in AWS KMS
Provide the KMS Key ARN to the Vendor:
After updating the key policy, provide the ARN of the newly created KMS key to the vendor. The vendor can then use this key to encrypt the data before storing it in their S3 bucket.
By following these steps, the company can ensure that its data is securely encrypted using its own KMS key while allowing the vendor to host the data in their AWS account.
A team of On-call engineers frequently needs to connect to Amazon EC2 Instances In a private subnet to troubleshoot and run commands. The Instances use either the latest AWS-provided Windows Amazon Machine Images (AMIs) or Amazon Linux AMIs.
The team has an existing IAM role for authorization. A SysOps administrator must provide the team with access to the Instances by granting IAM permissions to this
Which solution will meet this requirement?
- A . Add a statement to the IAM role policy to allow the ssm:StartSession action on the instances. Instruct the team to use AWS Systems Manager Session Manager to connect to the Instances by using the assumed IAM role.
- B . Associate an Elastic IP address and a security group with each instance. Add the engineers’ IP addresses to the security group inbound rules. Add a statement to the IAM role policy to allow the ec2:AuthoflzeSecurityGroupIngress action so that the team can connect to the Instances.
- C . Create a bastion host with an EC2 Instance, and associate the bastion host with the VPC. Add a statement to the IAM role policy to allow the ec2:CreateVpnConnection action on the bastion host. Instruct the team to use the bastion host endpoint to connect to the instances.
D Create an internet-facing Network Load Balancer. Use two listeners. Forward port 22 to a target group of Linux instances. Forward port 3389 to a target group of Windows Instances. Add a statement to the IAM role policy to allow the ec2:CreateRoute action so that the team can connect to the Instances.
A
Explanation:
Step-by-Step
Understand the Problem:
Engineers need to connect to EC2 instances in a private subnet for troubleshooting. The instances are using Windows or Amazon Linux AMIs. The team already has an IAM role for authorization. Analyze the Requirements:
Provide secure and efficient access to the instances without exposing them directly to the internet.
Utilize existing IAM role for access control.
Evaluate the Options:
Option A: Use AWS Systems Manager Session Manager.
Allows secure and auditable SSH or RDP access to EC2 instances without the need for bastion hosts or opening inbound ports.
Add a policy to allow the ssm:StartSession action.
Option B: Use Elastic IP and security group.
Exposes instances to direct access, increasing security risks.
Option C: Use a bastion host.
Requires additional infrastructure and maintenance.
Option D: Use an internet-facing Network Load Balancer.
Exposes instances to direct access via load balancer, not ideal for private subnets.
Select the Best Solution:
Option A: Using AWS Systems Manager Session Manager is the most secure and efficient solution. It eliminates the need for additional infrastructure and avoids exposing instances to the internet.
Reference: AWS Systems Manager Session Manager
Controlling Access to Session Manager
AWS Systems Manager Session Manager provides secure and auditable access to EC2 instances in a private subnet using IAM roles.
A company runs an application on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The application sometimes becomes slow and unresponsive. Amazon CloudWatch metrics show that some EC2 instances are experiencing high CPU load.
A SysOps administrator needs to create a CloudWatch dashboard that can automatically display CPU metrics of all the EC2 instances. The metrics must include new instances that are launched as part of the Auto Scaling group.
What should the SysOps administrator do to meet these requirements in the MOST operationally efficient way?
- A . Create a CloudWatch dashboard. Use activity notifications from the Auto Scaling group to invoke a custom AWS Lambda function. Use the Lambda function to update the CloudWatch dashboard to monitor the CPUUtilization metric for the new instance IDs.
- B . Create a CloudWatch dashboard. Run a custom script on each EC2 instance to stream the CPU utilization to the dashboard.
- C . Use CloudWatch metrics explorer to filter by the aws:autoscaling:groupName tag and to create a visualization for the CPUUtilization metric. Add the visualization to a CloudWatch dashboard.
- D . Use CloudWatch metrics explorer to filter by instance state and to create a visualization for the CPUUtilization metric. Add the visualization to a CloudWatch dashboard.
C
Explanation:
CloudWatch Metrics Explorer is a powerful tool for creating dynamic dashboards based on tags. This method is efficient for monitoring Auto Scaling groups:
Use Metrics Explorer: Navigate to the Metrics Explorer in the CloudWatch console and select the CPUUtilization metric. Use the aws:autoscaling:groupName tag to filter the metric, ensuring that it only shows data for EC2 instances within the specified Auto Scaling group.
Create Visualization: Configure the visualization settings as needed and add it to a CloudWatch dashboard.
Monitor Automatically: This setup will automatically update to include metrics from new EC2 instances that join the Auto Scaling group, without any need for manual intervention or scripting.
AWS Documentation
Reference: You can learn more about using Metrics Explorer here: Using CloudWatch Metrics Explorer.
A company wants to create an automated solution for all accounts managed by AWS Organizations to detect any worry groups that urn 0.0.0.0/0 as the source address for inbound traffic. The company also wants to automatically remediate any noncompliant security groups by restricting access to a specific CIDR block corresponds with the company’s intranet.
- A . Create an AWS Config rule to detect noncompliant security groups. Set up automatic remediation to change the 0.0.0.0/0 source address to the approved CIDK block.
- B . Create an IAM policy to deny the creation of security groups that have 0.0.0.0/0 as the source address Attach this 1AM policy to every user in the company.
- C . Create an AWS Lambda function to inspect now and existing security groups check for a noncompliant 0.0.0.0A) source address and change the source address to the approved CIDR block.
- D . Create a service control policy (SCP) for the organizational unit (OU) to deny the creation of security groups that have the 0.0.0.0/0 source address. Set up automatic remediation to change Vie 0.0.0.0/0 source address to the approved CIDR block.
A
Explanation:
AWS Config rules can be used to automatically detect and remediate noncompliant resources, such as security groups that allow inbound traffic from 0.0.0.0/0.
Steps:
Create a Custom AWS Config Rule:
Open the AWS Config console.
Choose "Rules" and then "Add rule".
Create a custom rule or use a predefined rule such as security-group-rule-restricted.
Configure Remediation:
Use AWS Config to set up automatic remediation.
Define an AWS Systems Manager Automation document that changes the source address from 0.0.0.0/0 to the approved CIDR block.
Associate this automation document with the AWS Config rule.
Deploy Across Accounts:
Use AWS Config Aggregator to aggregate the compliance data across multiple accounts. Ensure the remediation actions are consistently applied across all accounts.
Reference: AWS Config Rules
AWS Config Remediation
Creating a Custom AWS Config Rule
A company uses AWS Organizations to manage its AWS accounts. A SysOps administrator must create a backup strategy for all Amazon EC2 instances across all the company’s AWS accounts.
Which solution will meet these requirements In the MOST operationally efficient way?
- A . Deploy an AWS Lambda function to each account to run EC2 instance snapshots on a scheduled basis.
- B . Create an AWS CloudFormation stack set in the management account to add an AutoBackup=True tag to every EC2 instance
- C . Use AWS Backup In the management account to deploy policies for all accounts and resources.
- D . Use a service control policy (SCP) to run EC2 instance snapshots on a scheduled basis in each account.
C
Explanation:
To create a backup strategy for all Amazon EC2 instances across all the company’s AWS accounts using AWS Organizations, AWS Backup is the most operationally efficient solution.
AWS Backup:
AWS Backup provides centralized backup management and automates the backup of data across AWS services.
It supports creating backup plans that can apply to resources across multiple AWS accounts within an AWS Organization.
Using AWS Backup:
Open the AWS Backup console in the management account.
Create a backup plan and define backup policies (e.g., frequency, retention).
Use the backup policies to automatically apply to all EC2 instances in all member accounts of the AWS Organization.
Reference: AWS Backup
AWS Backup for Multi-Account
ASysOps administrator configures an application to run on Amazon EC2 instances behind an Application Load Balancer (ALB) in a simple scaling Auto Scaling group with the default settings. The Auto Scaling group is configured to use the RequestCountPerTarget metric for scaling. The SysOps administrator notices that the RequestCountPerTarget metric exceeded the specified limit twice in 180 seconds.
How will the number of EC2 instances in this Auto Scaling group be affected in this scenario?
- A . The Auto Scaling group will launch an additional EC2 instance every time the RequestCountPerTarget metric exceeds the predefined limit.
- B . The Auto Scaling group will launch one EC2 instance and will wait for the default cooldown period before launching another instance.
- C . The Auto Scaling group will send an alert to the ALB to rebalance the traffic and not add new EC2 instances until the load is normalized.
- D . The Auto Scaling group will try to distribute the traffic among all EC2 instances before launching another instance.
B
Explanation:
When using the RequestCountPerTarget metric for scaling in an Auto Scaling group, the behavior of instance scaling follows specific rules set by Auto Scaling policies and cooldown periods:
Scaling Trigger: The Auto Scaling group triggers a scaling action whenever the RequestCountPerTarget exceeds the predefined limit set in the scaling policy.
Cooldown Period: After launching an EC2 instance due to a scaling action, the Auto Scaling group enters a cooldown period. During this period, despite further breaches of the threshold, no additional instances will be launched. This is designed to give the newly launched instance time to start and begin handling traffic, preventing the Auto Scaling group from launching too many instances too quickly.
This mechanism helps maintain efficient use of resources by adapting to changes in load while avoiding rapid, unnecessary scaling actions.
ASysOps administrator configures an application to run on Amazon EC2 instances behind an Application Load Balancer (ALB) in a simple scaling Auto Scaling group with the default settings. The Auto Scaling group is configured to use the RequestCountPerTarget metric for scaling. The SysOps administrator notices that the RequestCountPerTarget metric exceeded the specified limit twice in 180 seconds.
How will the number of EC2 instances in this Auto Scaling group be affected in this scenario?
- A . The Auto Scaling group will launch an additional EC2 instance every time the RequestCountPerTarget metric exceeds the predefined limit.
- B . The Auto Scaling group will launch one EC2 instance and will wait for the default cooldown period before launching another instance.
- C . The Auto Scaling group will send an alert to the ALB to rebalance the traffic and not add new EC2 instances until the load is normalized.
- D . The Auto Scaling group will try to distribute the traffic among all EC2 instances before launching another instance.
B
Explanation:
When using the RequestCountPerTarget metric for scaling in an Auto Scaling group, the behavior of instance scaling follows specific rules set by Auto Scaling policies and cooldown periods:
Scaling Trigger: The Auto Scaling group triggers a scaling action whenever the RequestCountPerTarget exceeds the predefined limit set in the scaling policy.
Cooldown Period: After launching an EC2 instance due to a scaling action, the Auto Scaling group enters a cooldown period. During this period, despite further breaches of the threshold, no additional instances will be launched. This is designed to give the newly launched instance time to start and begin handling traffic, preventing the Auto Scaling group from launching too many instances too quickly.
This mechanism helps maintain efficient use of resources by adapting to changes in load while avoiding rapid, unnecessary scaling actions.
A company’s AWS Lambda function is experiencing performance issues. The Lambda function performs many CPU-intensive operations. The Lambda function is not running fast enough and is creating bottlenecks in the system.
What should a SysOps administrator do to resolve this issue?
- A . In the CPU launch options for the Lambda function, activate hyperthreading.
- B . Turn off the AWS managed encryption.
- C . Increase the amount of memory for the Lambda function.
- D . Load the required code into a custom layer.
C
Explanation:
Increasing the amount of memory for the Lambda function will help to improve the performance of the function. This is because the Lambda function is CPU-intensive and increasing the memory will give it access to more CPU resources and help it run faster. The other options (activating hyperthreading in the CPU launch options for the Lambda function, turning off the AWS managed encryption, and loading the required code into a custom layer) will not help to improve the performance of the Lambda function and are not the correct solutions for this issue.
https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-common.html#configuration-memory-console
A Sysops administrator needs to configure automatic rotation for Amazon RDS database credentials.
The credentials must rotate every 30 days. The solution must integrate with Amazon RDS.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Store the credentials in AWS Systems Manager Parameter Store as a secure string. Configure automatic rotation with a rotation interval of 30 days.
- B . Store the credentials in AWS Secrets Manager. Configure automatic rotation with a rotation interval of 30 days.
- C . Store the credentials in a file in an Amazon S3 bucket. Deploy an AWS Lambda function to automatically rotate the credentials every 30 days.
- D . Store the credentials in AWS Secrets Manager. Deploy an AWS Lambda function to automatically rotate the credentials every 30 days.
B
Explanation:
Storing the credentials in AWS Secrets Manager and configuring automatic rotation with a rotation interval of 30 days is the most efficient way to meet the requirements with the least operational overhead. AWS Secrets Manager automatically rotates the credentials at the specified interval, so there is no need for an additional AWS Lambda function or manual rotation. Additionally, Secrets Manager is integrated with Amazon RDS, so the credentials can be easily used with the RDS database.