Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #241
A company has an Amazon CloudFront distribution that uses an Amazon S3 bucket as its origin. During a review of the access logs, the company determines that some requests are going directly to the S3 bucket by using the website hosting endpoint. A SysOps administrator must secure the S3 bucket to allow requests only from CloudFront.
What should the SysOps administrator do to meet this requirement?
- A . Create an origin access identity (OAI) in CloudFront. Associate the OAI with the distribution. Remove access to and from other principals in the S3 bucket policy. Update the S3 bucket policy to allow access only from the OAI.
- B . Create an origin access identity (OAI) in CloudFront. Associate the OAI with the distribution. Update the S3 bucket policy to allow access only from the OAI. Create a new origin, and specify the S3 bucket as the new origin. Update the distribution behavior to use the new origin. Remove the existing origin.
- C . Create an origin access identity (OAI) in CloudFront. Associate the OAI with the distribution. Update the S3 bucket policy to allow access only from the OAI. Disable website hosting. Create a new origin, and specify the S3 bucket as the new origin. Update the distribution behavior to use the new origin. Remove the existing origin.
- D . Update the S3 bucket policy to allow access only from the CloudFront distribution. Remove access to and from other principals in the S3 bucket policy. Disable website hosting. Create a new origin, and specify the S3 bucket as the new origin. Update the distribution behavior to use the new origin. Remove the existing origin.
Correct Answer: A
A
Explanation:
To secure the S3 bucket and allow access only from CloudFront, the following steps should be taken:
Create an OAI in CloudFront:
In the CloudFront console, create an origin access identity (OAI) and associate it with your CloudFront distribution.
Reference: Restricting Access to S3 Buckets
Update S3 Bucket Policy:
Modify the S3 bucket policy to allow access only from the OAI. This involves adding a policy statement that grants the OAI permission to get objects from the bucket and removing any other public access permissions.
Example Policy:
json
Copy code
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3EXAMPLE"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
}
]
}
Reference: Bucket Policy Examples
Test Configuration:
Ensure that the S3 bucket is not publicly accessible and that requests to the bucket through the CloudFront distribution are successful.
Reference: Testing CloudFront OAI
A
Explanation:
To secure the S3 bucket and allow access only from CloudFront, the following steps should be taken:
Create an OAI in CloudFront:
In the CloudFront console, create an origin access identity (OAI) and associate it with your CloudFront distribution.
Reference: Restricting Access to S3 Buckets
Update S3 Bucket Policy:
Modify the S3 bucket policy to allow access only from the OAI. This involves adding a policy statement that grants the OAI permission to get objects from the bucket and removing any other public access permissions.
Example Policy:
json
Copy code
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3EXAMPLE"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
}
]
}
Reference: Bucket Policy Examples
Test Configuration:
Ensure that the S3 bucket is not publicly accessible and that requests to the bucket through the CloudFront distribution are successful.
Reference: Testing CloudFront OAI
Question #242
A company updates its security policy to clarify cloud hosting arrangements for regulated workloads. Workloads that are identified as sensitive must run on hardware that is not shared with other
customers or with other AWS accounts within the company.
Which solution will ensure compliance with this policy?
- A . Deploy workloads only to Dedicated Hosts.
- B . Deploy workloads only to Dedicated Instances.
- C . Deploy workloads only to Reserved Instances.
- D . Place all instances in a dedicated placement group.
Correct Answer: A
A
Explanation:
Dedicated Hosts are physical servers that are dedicated to a single customer, ensuring that the customer’s workloads are not shared with other customers or with other AWS accounts within the company. This will ensure that the company’s security policy is followed and that sensitive workloads are running on hardware that is not shared with other customers or with other AWS accounts within the company.
A
Explanation:
Dedicated Hosts are physical servers that are dedicated to a single customer, ensuring that the customer’s workloads are not shared with other customers or with other AWS accounts within the company. This will ensure that the company’s security policy is followed and that sensitive workloads are running on hardware that is not shared with other customers or with other AWS accounts within the company.
Question #243
A SysOps administrator needs to configure the Amazon Route 53 hosted zone for example.com and www.example.com to point to an Application Load Balancer (ALB).
Which combination of actions should the SysOps administrator take to meet these requirements? (Select TWO.)
- A . Configure anArecordforexample.com to point to the IP address of the ALB.
- B . Configure an A record for www.example.com to point to the IP address of the ALB.
- C . Configure an alias record for example.com to point to the CNAME of the ALB.
- D . Configure an alias record for www.example.com to point to the Route 53 example.com record.
- E . Configure a CNAME record for example com to point to the CNAME of the ALB.
Correct Answer: C, D
C, D
Explanation:
You are correct that an A record typically points to an IP address. However, in the case of an Application Load Balancer (ALB), you cannot use an A record with an IP address because the IP addresses of an ALB can change over time. Instead, you can use an alias record to point to the DNS name of the ALB. An alias record is a Route 53 extension to DNS that allows you to route traffic to selected AWS resources, such as an ALB, by using a friendly DNS name, such as example.com, instead of the resource’s IP address or DNS name.
C, D
Explanation:
You are correct that an A record typically points to an IP address. However, in the case of an Application Load Balancer (ALB), you cannot use an A record with an IP address because the IP addresses of an ALB can change over time. Instead, you can use an alias record to point to the DNS name of the ALB. An alias record is a Route 53 extension to DNS that allows you to route traffic to selected AWS resources, such as an ALB, by using a friendly DNS name, such as example.com, instead of the resource’s IP address or DNS name.
Question #244
A company recently deployed an application in production. The production environment currently runs on a single Amazon EC2 instance that hosts the application’s web application and a MariaDB database. Company policy states that all IT production environments must be highly available.
What should a SysOps administrator do to meet this requirement?
- A . Migrale the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance.
Run the application on EC2 instances that are in an Auto Scaling group that extends across multiple
Availability Zones. Place the EC2 instances behind a load balancer. - B . Migrate the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance.
Use AWS Application Migration Service to convert the application into an AWS Lambda function.
Specify the Multi-AZ option for the Lambda function. - C . Copy the database to a different EC2 instance in a different Availability Zone. Use AWS Backup to create Amazon Machine Images (AMIs) of the application EC2 instance and the database EC2 instance. Create an AWS Lambda function that performs health checks every minute. In case of failure, configure the Lambda function to launch a new EC2 instance from the AMIs that AWS Backup created.
- D . Migrate the database to a different EC2 instance. Place the application EC2 instance in an Auto Scaling group that extends across multiple Availability Zones. Create an Amazon Machine Image (AMI) from the database EC2 instance. Use the AMI to launch a second database EC2 instance in a different Availability Zone. Put the second database EC2 instance in the stopped state. Use the second database EC2 instance as a standby.
Correct Answer: A
A
Explanation:
To make the production environment highly available in accordance with company policy:
Database Migration: Move the MariaDB database from a single EC2 instance to Amazon RDS for MariaDB configured for Multi-AZ. This setup ensures high availability of the database with synchronous replication to a standby instance in a different Availability Zone.
Application Scalability: Deploy the application on EC2 instances within an Auto Scaling group. Configure the Auto Scaling group to operate across multiple Availability Zones to ensure that the application remains available even if one zone becomes unavailable.
Load Balancing: Place the EC2 instances behind an Elastic Load Balancer (ELB). The load balancer will distribute incoming application traffic across the multiple, geographically dispersed EC2 instances, further enhancing the availability and fault tolerance of the application.
This solution leverages AWS managed services to increase the reliability and availability of both the application and database layers, adhering to best practices for deploying critical production environments on AWS.
A
Explanation:
To make the production environment highly available in accordance with company policy:
Database Migration: Move the MariaDB database from a single EC2 instance to Amazon RDS for MariaDB configured for Multi-AZ. This setup ensures high availability of the database with synchronous replication to a standby instance in a different Availability Zone.
Application Scalability: Deploy the application on EC2 instances within an Auto Scaling group. Configure the Auto Scaling group to operate across multiple Availability Zones to ensure that the application remains available even if one zone becomes unavailable.
Load Balancing: Place the EC2 instances behind an Elastic Load Balancer (ELB). The load balancer will distribute incoming application traffic across the multiple, geographically dispersed EC2 instances, further enhancing the availability and fault tolerance of the application.
This solution leverages AWS managed services to increase the reliability and availability of both the application and database layers, adhering to best practices for deploying critical production environments on AWS.
Question #245
A SysOps administrator needs to configure a solution that will deliver digital content to a set of authorized users through Amazon CloudFront. Unauthorized users must be restricted from access.
Which solution will meet these requirements?
- A . Store the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed URLs to access the S3 bucket through CloudFront.
- B . Store the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Restrict S3 bucket access with signed URLs in CloudFront.
- C . Store the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Enable field-level encryption.
- D . Store the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed cookies for restricted delivery of the content through CloudFront.
Correct Answer: B
B
Explanation:
To deliver digital content to authorized users through CloudFront while restricting unauthorized access, you can use an origin access identity (OAI) with signed URLs.
Store Content in S3 with Public Access Blocked:
Ensure the S3 bucket has public access blocked.
Navigate to the S3 console, select the bucket, and configure the "Block Public Access" settings.
Reference: Blocking public access to your Amazon S3 storage Create an OAI for CloudFront:
In the CloudFront console, create an OAI to securely access the S3 bucket.
Associate the OAI with the CloudFront distribution.
Reference: Using an OAI
Restrict S3 Bucket Access to the OAI:
Update the S3 bucket policy to grant access to the OAI.
Example bucket policy:
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity <OAI-ID>"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::bucket-name/*"
}
]
}
Use Signed URLs for Restricted Access:
Configure CloudFront to use signed URLs to control access to the content.
Reference: Serving private content with signed URLs and signed cookies
This setup ensures that only authorized users can access the content through CloudFront using signed URLs, while the S3 bucket remains private and secure.
B
Explanation:
To deliver digital content to authorized users through CloudFront while restricting unauthorized access, you can use an origin access identity (OAI) with signed URLs.
Store Content in S3 with Public Access Blocked:
Ensure the S3 bucket has public access blocked.
Navigate to the S3 console, select the bucket, and configure the "Block Public Access" settings.
Reference: Blocking public access to your Amazon S3 storage Create an OAI for CloudFront:
In the CloudFront console, create an OAI to securely access the S3 bucket.
Associate the OAI with the CloudFront distribution.
Reference: Using an OAI
Restrict S3 Bucket Access to the OAI:
Update the S3 bucket policy to grant access to the OAI.
Example bucket policy:
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity <OAI-ID>"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::bucket-name/*"
}
]
}
Use Signed URLs for Restricted Access:
Configure CloudFront to use signed URLs to control access to the content.
Reference: Serving private content with signed URLs and signed cookies
This setup ensures that only authorized users can access the content through CloudFront using signed URLs, while the S3 bucket remains private and secure.
Question #246
A user working in the Amazon EC2 console increased the size of an Amazon Elastic Block Store (Amazon EBS) volume attached to an Amazon EC2 Windows instance. The change is not reflected in the file system.
What should a SysOps administrator do to resolve this issue?
- A . Extend the file system with operating system-level tools to use the new storage capacity.
- B . Reattach the EBS volume to the EC2 instance.
- C . Reboot the EC2 instance that is attached to the EBS volume.
- D . Take a snapshot of the EBS volume. Replace the original volume with a volume that is created from the snapshot.
Correct Answer: A
A
Explanation:
After increasing the size of an Amazon EBS volume, the operating system must be configured to use the additional space. For a Windows instance, you need to extend the file system using disk management tools.
Open Disk Management:
Connect to your Windows EC2 instance using RDP.
Open the Disk Management tool by right-clicking the Start button and selecting Disk Management.
Extend the Volume:
Locate the EBS volume that was resized.
Right-click on the volume and select Extend Volume.
Follow the Extend Volume Wizard to allocate the newly available space to the file system.
Verify the New Size:
After extending the volume, verify that the file system reflects the increased storage capacity.
Reference: Modifying the Size, IOPS, or Throughput of an EBS Volume
Extending a Windows File System After Resizing a Volume
A
Explanation:
After increasing the size of an Amazon EBS volume, the operating system must be configured to use the additional space. For a Windows instance, you need to extend the file system using disk management tools.
Open Disk Management:
Connect to your Windows EC2 instance using RDP.
Open the Disk Management tool by right-clicking the Start button and selecting Disk Management.
Extend the Volume:
Locate the EBS volume that was resized.
Right-click on the volume and select Extend Volume.
Follow the Extend Volume Wizard to allocate the newly available space to the file system.
Verify the New Size:
After extending the volume, verify that the file system reflects the increased storage capacity.
Reference: Modifying the Size, IOPS, or Throughput of an EBS Volume
Extending a Windows File System After Resizing a Volume
Question #247
A team of developers is using several Amazon S3 buckets as centralized repositories. Users across the world upload large sets of files to these repositories. The development team’s applications later process these files.
A SysOps administrator sets up a new S3 bucket. DOC-EXAMPLE-BUCKET, to support a new workload. The new S3 bucket also receives regular uploads of large sets of files from users worldwide. When the new S3 bucket is put into production, the upload performance from certain geographic areas is lower than the upload performance that the existing S3 buckets provide.
What should the SysOps administrator do to remediate this issue?
- A . Provision an Amazon ElasliCache for Redis cluster for the new S3 bucket. Provide the developers with the configuration endpoint of the cluster for use in their API calls.
- B . Add the new S3 bucket to a new Amazon CloudFront distribution. Provide the developers with the domain name of the new distribution for use in their API calls.
- C . Enable S3 Transfer Acceleration for the new S3 bucket. Verify that the developers are using the DOC-EXAMPLE-BUCKET.s3-accelerate.amazonaws.com endpoint name in their API calls.
- D . Use S3 multipart upload for the new S3 bucket. Verify that the developers are using Region-specific S3 endpoint names such as D0C-EXAMPLE-BUCKET.s3. [RegionJ.amazonaws.com in their API calls.
Correct Answer: C
C
Explanation:
For improving upload performance globally for an Amazon S3 bucket, enabling S3 Transfer Acceleration is the best solution. This service optimizes file transfers to S3 using Amazon CloudFront’s globally distributed edge locations. After enabling this feature, uploads to the S3 bucket are first routed to an AWS edge location and then transferred to S3 over an optimized network path. Option C is correct, and the developers should use the provided accelerate endpoint in their API calls. For more details, consult the AWS documentation on S3 Transfer Acceleration Amazon S3 Transfer Acceleration.
C
Explanation:
For improving upload performance globally for an Amazon S3 bucket, enabling S3 Transfer Acceleration is the best solution. This service optimizes file transfers to S3 using Amazon CloudFront’s globally distributed edge locations. After enabling this feature, uploads to the S3 bucket are first routed to an AWS edge location and then transferred to S3 over an optimized network path. Option C is correct, and the developers should use the provided accelerate endpoint in their API calls. For more details, consult the AWS documentation on S3 Transfer Acceleration Amazon S3 Transfer Acceleration.
Question #248
A company is implementing a monitoring solution that is based on machine learning. The monitoring solution consumes Amazon EventBridge (Amazon CloudWatch Events) events that are generated by Amazon EC2 Auto Scaling. The monitoring solution provides detection of anomalous behavior such as unanticipated scaling events and is configured as an EventBridge (CloudWatch Events) API destination.
During initial testing, the company discovers that the monitoring solution is not receiving events. However, Amazon CloudWatch is showing that the EventBridge (CloudWatch Events) rule is being invoked. A SysOps administrator must implement a solution to retrieve client error details to help resolve this issue.
Which solution will meet these requirements with the LEAST operational effort?
- A . Create an EventBridge (CloudWatch Events) archive for the event pattern to replay the events.
Increase the logging on the monitoring solution. Use replay to invoke the monitoring solution.
Examine the error details. - B . Add an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue for the target. Process the messages in the dead-letter queue to retrieve error details.
- C . Create a second EventBridge (CloudWatch Events) rule for the same event pattern to target an AWS Lambda function. Configure the Lambda function to invoke the monitoring solution and to record the results to Amazon CloudWatch Logs. Examine the errors in the logs.
- D . Configure the EventBridge (CloudWatch Events) rule to send error messages to an Amazon Simple Notification Service (Amazon SNS) topic.
Correct Answer: A
A
Explanation:
"In EventBridge, you can create an archive of events so that you can easily replay them at a later time. For example, you might want to replay events to recover from errors or to validate new functionality in your application." https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-
archive.html
A
Explanation:
"In EventBridge, you can create an archive of events so that you can easily replay them at a later time. For example, you might want to replay events to recover from errors or to validate new functionality in your application." https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-
archive.html
Question #249
The SysOps administrator needs to address high disk I/O issues during EC2 instance bootstrap in an Auto Scaling group. (Select TWO):
- A . Increase the EC2 instance size.
- B . Increase the EBS volume capacity.
- C . Increase the EBS volume IOPS.
- D . Increase the EBS volume throughput.
- E . Change the instance type to an instance that is not Nitro-based.
Correct Answer: C, D
C, D
Explanation:
To resolve issues with high disk I/O during the bootstrap process:
Increase EBS Volume IOPS: Higher IOPS allows the EBS volume to handle more input/output operations per second, which is critical for high I/O demands like downloading large Docker images.
Increase EBS Volume Throughput: Boosting throughput allows for faster data transfer rates, which is useful when the workload requires sustained high data throughput during initialization.
Increasing the instance size or changing the instance type is not necessary if the root cause is related specifically to EBS performance. Nitro instances generally provide higher performance and are well-suited for high I/O tasks.
C, D
Explanation:
To resolve issues with high disk I/O during the bootstrap process:
Increase EBS Volume IOPS: Higher IOPS allows the EBS volume to handle more input/output operations per second, which is critical for high I/O demands like downloading large Docker images.
Increase EBS Volume Throughput: Boosting throughput allows for faster data transfer rates, which is useful when the workload requires sustained high data throughput during initialization.
Increasing the instance size or changing the instance type is not necessary if the root cause is related specifically to EBS performance. Nitro instances generally provide higher performance and are well-suited for high I/O tasks.
Question #250
A company has an AWS Config rule that identifies open SSH ports in security groups. The rule has an automatic remediation action to delete the SSH inbound rule for noncompliant security groups. However, business units require SSH access and can provide a list of trusted IPs to restrict access.
- A . Create a new AWS Systems Manager Automation runbook that adds an IP set to the security group’s inbound rule. Update the AWS Config rule to change the automatic remediation action to use the new runbook.
- B . Create a new AWS Systems Manager Automation runbook that updates the security group’s inbound rule with the IP addresses from the business units. Update the AWS Config rule to change the automatic remediation action to use the new runbook.
- C . Create an AWS Lambda function that adds an IP set to the security group’s inbound rule. Update the AWS Config rule to change the automatic remediation action to use the Lambda function.
- D . Create an AWS Lambda function that updates the security group’s inbound rule with the IP addresses from the business units. Update the AWS Config rule to change the automatic remediation action to use the Lambda function.
Correct Answer: B
B
Explanation:
The problem requires modifying the inbound SSH rule to restrict access to a list of trusted IPs instead of deleting it entirely. AWS Config rules can be configured with automatic remediation actions using either Systems Manager Automation runbooks or Lambda functions. However, AWS Systems Manager Automation runbooks are often more appropriate for managing infrastructure changes like security group modifications because they are reusable, parameterized, and easier to audit.
Create a Systems Manager Automation runbook: This runbook will contain steps to add or modify the existing security group rule, allowing SSH access only from the specified IP addresses.
Update the AWS Config rule: Modify the Config rule to call this new runbook for its automatic remediation. This will prevent deletion of the SSH rule and instead update it based on the IP list.
B
Explanation:
The problem requires modifying the inbound SSH rule to restrict access to a list of trusted IPs instead of deleting it entirely. AWS Config rules can be configured with automatic remediation actions using either Systems Manager Automation runbooks or Lambda functions. However, AWS Systems Manager Automation runbooks are often more appropriate for managing infrastructure changes like security group modifications because they are reusable, parameterized, and easier to audit.
Create a Systems Manager Automation runbook: This runbook will contain steps to add or modify the existing security group rule, allowing SSH access only from the specified IP addresses.
Update the AWS Config rule: Modify the Config rule to call this new runbook for its automatic remediation. This will prevent deletion of the SSH rule and instead update it based on the IP list.