Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #251
A company is supposed to receive a data file every hour in an Amazon S3 bucket. An S3 event notification invokes an AWS Lambda function each time a file arrives. The function processes the data for use by an application.
The application team notices that sometimes the file does not arrive. The application team wants to receive a notification whenever the file does not arrive.
What is the MOST operationally efficient solution that meets these requirements?
- A . Add an S3 Lifecycle rule on the S3 bucket with a scope that is limited to objects that were created in the last hour. Configure another S3 event notification to be invoked by the lifecycle transition when the number of objects transitioned is zero. Publish a message to an Amazon Simple Notification Service (Amazon SNS) topic to notify the application team.
- B . Configure another S3 event notification to invoke a Lambda function that posts a message to an Amazon Simple Queue Service (Amazon SQS) queue. Create an Amazon CloudWatch alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic to notify the application team when the ApproximateAgeOfOldestMessage metric of the queue is greater than 1 hour.
- C . Create an Amazon CloudWatch alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic to alert the application team when the Invocations metric of the Lambda function is zero for an hour. Configure the alarm to treat missing data as breaching.
- D . Create a new Lambda function to get the timestamp of the newest file in the S3 bucket. If the timestamp is more than 1 hour ago, publish a message to an Amazon Simple Notification Service (Amazon SNS) topic to notify the application team. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the new function hourly.
Correct Answer: C
C
Explanation:
This solution is operationally efficient and leverages AWS services to provide notifications when the Lambda function is not invoked, indicating that the file did not arrive.
Steps:
Create a CloudWatch Alarm:
Open the Amazon CloudWatch console.
In the navigation pane, choose "Alarms" and then "Create Alarm".
Select Lambda Metrics:
Choose "Select metric" and then navigate to "AWS Lambda" metrics.
Select the Lambda function that processes the S3 files.
Choose the "Invocations" metric.
Configure the Alarm:
Set the period to 1 hour.
Define the threshold condition to trigger when the Invocations metric is zero.
Under "Additional configuration", configure the alarm to treat missing data as "breaching".
Set Alarm Actions:
Configure the alarm action to send a notification to an Amazon SNS topic.
Create an SNS topic if one does not exist, and subscribe the application team to this topic.
Testing and Verification:
Ensure that the alarm triggers correctly by simulating a missing file scenario and confirming that the notification is sent to the SNS topic.
This approach uses CloudWatch to monitor the invocation frequency of the Lambda function, ensuring that the application team is notified whenever the expected file does not arrive within the specified timeframe.
Reference: Amazon CloudWatch Alarms
Monitoring Lambda Functions
Amazon SNS Notifications
C
Explanation:
This solution is operationally efficient and leverages AWS services to provide notifications when the Lambda function is not invoked, indicating that the file did not arrive.
Steps:
Create a CloudWatch Alarm:
Open the Amazon CloudWatch console.
In the navigation pane, choose "Alarms" and then "Create Alarm".
Select Lambda Metrics:
Choose "Select metric" and then navigate to "AWS Lambda" metrics.
Select the Lambda function that processes the S3 files.
Choose the "Invocations" metric.
Configure the Alarm:
Set the period to 1 hour.
Define the threshold condition to trigger when the Invocations metric is zero.
Under "Additional configuration", configure the alarm to treat missing data as "breaching".
Set Alarm Actions:
Configure the alarm action to send a notification to an Amazon SNS topic.
Create an SNS topic if one does not exist, and subscribe the application team to this topic.
Testing and Verification:
Ensure that the alarm triggers correctly by simulating a missing file scenario and confirming that the notification is sent to the SNS topic.
This approach uses CloudWatch to monitor the invocation frequency of the Lambda function, ensuring that the application team is notified whenever the expected file does not arrive within the specified timeframe.
Reference: Amazon CloudWatch Alarms
Monitoring Lambda Functions
Amazon SNS Notifications
Question #252
A SysOps administrator is trying to set up an Amazon Route 53 domain name to route traffic to a website hosted on Amazon S3. The domain name of the website is www.anycompany.com and the S3 bucket name is anycompany-static. After the record set is set up in Route 53, the domain name www.anycompany.com does not seem to work, and the static website is not displayed in the browser.
Which of the following is a cause of this?
- A . The S3 bucket must be configured with Amazon CloudFront first.
- B . The Route 53 record set must have an IAM role that allows access to the S3 bucket.
- C . The Route 53 record set must be in the same region as the S3 bucket.
- D . The S3 bucket name must match the record set name in Route 53.
Correct Answer: C
C
Explanation:
Step-by-Step
Understand the Problem:
The application on a general-purpose EC2 instance experiences performance issues during I/O intensive tasks.
High VolumeQueueLength indicates a bottleneck in I/O operations.
Analyze the Requirements:
Improve disk I/O performance to handle intensive read/write operations.
Evaluate the Options:
Option A: Modify the instance type to be storage optimized.
This could help but may not be necessary if increasing IOPS on the EBS volume resolves the issue.
Option B: Deselect Auto-Enable Volume I/O.
This option is not relevant to addressing high VolumeQueueLength.
Option C: Modify the volume properties to increase the IOPS.
Increasing IOPS directly addresses the I/O performance bottleneck.
Option D: Enable enhanced networking.
Enhanced networking improves network performance but not disk I/O performance.
Select the Best Solution:
Option C: Increasing the IOPS of the EBS volume directly addresses the high VolumeQueueLength and improves I/O performance.
Reference: Amazon EBS Volume Types
Optimizing EBS Performance
Modifying the volume properties to increase the IOPS ensures that the application can handle intensive read/write operations more effectively.
C
Explanation:
Step-by-Step
Understand the Problem:
The application on a general-purpose EC2 instance experiences performance issues during I/O intensive tasks.
High VolumeQueueLength indicates a bottleneck in I/O operations.
Analyze the Requirements:
Improve disk I/O performance to handle intensive read/write operations.
Evaluate the Options:
Option A: Modify the instance type to be storage optimized.
This could help but may not be necessary if increasing IOPS on the EBS volume resolves the issue.
Option B: Deselect Auto-Enable Volume I/O.
This option is not relevant to addressing high VolumeQueueLength.
Option C: Modify the volume properties to increase the IOPS.
Increasing IOPS directly addresses the I/O performance bottleneck.
Option D: Enable enhanced networking.
Enhanced networking improves network performance but not disk I/O performance.
Select the Best Solution:
Option C: Increasing the IOPS of the EBS volume directly addresses the high VolumeQueueLength and improves I/O performance.
Reference: Amazon EBS Volume Types
Optimizing EBS Performance
Modifying the volume properties to increase the IOPS ensures that the application can handle intensive read/write operations more effectively.
Question #253
A company has many accounts in an organization in AWS Organizations The company must automate resource provisioning from the organization’s management account to the member accounts.
Which solution will meet this requirement?
- A . Create an AWS CkHJdFormation change set Deploy the change set to all member accounts
- B . Create an AWS CtoudFormation nested stack Deploy the nested stack to all member accounts.
- C . Create an AWS CtoudFormation stack set Deploy the stack set to all member accounts.
- D . Create an AWS Serverless Application Model (AWS SAM) template. Deploy the template to all member accounts.
Correct Answer: C
C
Explanation:
Using CloudFormation Stack Sets:
CloudFormation stack sets allow you to deploy CloudFormation stacks across multiple AWS accounts and regions.
Steps:
Go to the AWS Management Console.
Navigate to CloudFormation and select "StackSets."
Click on "Create StackSet."
Provide the template URL or upload a template file.
Configure the stack set options and specify the accounts and regions. Deploy the stack set to the specified accounts and regions.
Reference: AWS CloudFormation StackSets
C
Explanation:
Using CloudFormation Stack Sets:
CloudFormation stack sets allow you to deploy CloudFormation stacks across multiple AWS accounts and regions.
Steps:
Go to the AWS Management Console.
Navigate to CloudFormation and select "StackSets."
Click on "Create StackSet."
Provide the template URL or upload a template file.
Configure the stack set options and specify the accounts and regions. Deploy the stack set to the specified accounts and regions.
Reference: AWS CloudFormation StackSets
Question #254
A company’s VPC has connectivity to an on-premises data center through an AWS Site-to-Site VPN. The company needs Amazon EC2 instances in the VPC to send DNS queries for example com to the DNS servers in the data center.
Which solution will meet these requirements?
- A . Create an Amazon Route 53 Resolver inbound endpoint Create a conditional forwarding rule on the on-primes DNS servers to forward DNS requests for example.com to the inbound endpoints.
- B . Create an Amazon Route 53 Resolver inbound endpoint Create a forwarding rule on the resolver that sends all queries for example.com to the on-premises DNS servers. Associate this rule with the VPC.
- C . Create an Amazon Route 53 Resolver outbound endpoint Create a conditional forwarding rule on the on-premises DNS servers to forward DNS requests for example.com to the outbound endpoints
- D . Create an Amazon Route 53 Resolver outbound endpoint. Create a forwarding rule on the resolver that sends all queries for exarrc4e.com to the on-premises DNS servers Associate this rule with the VPC.
Correct Answer: D
D
Explanation:
To ensure that EC2 instances in your VPC can send DNS queries for example.com to the DNS servers in your on-premises data center, follow these steps:
Create a Route 53 Resolver Outbound Endpoint:
Set up an outbound endpoint in Route 53 Resolver in your VPC to forward DNS queries to your on-premises DNS servers.
Reference: Creating an Outbound Endpoint
Create a Resolver Rule:
Create a forwarding rule in Route 53 Resolver that specifies example.com and forwards these queries to the on-premises DNS servers via the outbound endpoint.
Reference: Creating Forwarding Rules
Associate the Rule with Your VPC:
Associate the resolver rule with your VPC so that all DNS queries from your EC2 instances for example.com are sent to the on-premises DNS servers.
Reference: Associating Rules with Your VPC
By setting up an outbound endpoint and a forwarding rule, you enable DNS queries from your VPC to be routed to your on-premises DNS servers, ensuring seamless resolution of example.com.
D
Explanation:
To ensure that EC2 instances in your VPC can send DNS queries for example.com to the DNS servers in your on-premises data center, follow these steps:
Create a Route 53 Resolver Outbound Endpoint:
Set up an outbound endpoint in Route 53 Resolver in your VPC to forward DNS queries to your on-premises DNS servers.
Reference: Creating an Outbound Endpoint
Create a Resolver Rule:
Create a forwarding rule in Route 53 Resolver that specifies example.com and forwards these queries to the on-premises DNS servers via the outbound endpoint.
Reference: Creating Forwarding Rules
Associate the Rule with Your VPC:
Associate the resolver rule with your VPC so that all DNS queries from your EC2 instances for example.com are sent to the on-premises DNS servers.
Reference: Associating Rules with Your VPC
By setting up an outbound endpoint and a forwarding rule, you enable DNS queries from your VPC to be routed to your on-premises DNS servers, ensuring seamless resolution of example.com.
Question #255
A company stores its data in an Amazon S3 bucket. The company is required to classify the data and find any sensitive personal information in its S3 files.
Which solution will meet these requirements?
- A . Create an AWS Config rule to discover sensitive personal information in the S3 files and mark them as noncompliant.
- B . Create an S3 event-driven artificial intelligence/machine learning (AI/ML) pipeline to classify sensitive personal information by using Amazon Recognition.
- C . Enable Amazon GuardDuty. Configure S3 protection to monitor all data inside Amazon S3.
- D . Enable Amazon Macie. Create a discovery job that uses the managed data identifier.
Correct Answer: D
D
Explanation:
Amazon Macie is a security service designed to help organizations find, classify, and protect sensitive data stored in Amazon S3. Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in Amazon S3. Creating a discovery job with the managed data identifier will allow Macie to identify sensitive personal information in the S3 files and classify it accordingly. Enabling AWS Config and Amazon GuardDuty will not help with this requirement as they are not designed to automatically classify and protect data.
D
Explanation:
Amazon Macie is a security service designed to help organizations find, classify, and protect sensitive data stored in Amazon S3. Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in Amazon S3. Creating a discovery job with the managed data identifier will allow Macie to identify sensitive personal information in the S3 files and classify it accordingly. Enabling AWS Config and Amazon GuardDuty will not help with this requirement as they are not designed to automatically classify and protect data.
Question #256
A company is testing Amazon Elasticsearch Service (Amazon ES) as a solution for analyzing system logs from a fleet of Amazon EC2 instances. During the test phase, the domain operates on a single-node cluster. A SysOps administrator needs to transition the test domain into a highly available production-grade deployment.
Which Amazon ES configuration should the SysOps administrator use to meet this requirement?
- A . Use a cluster of four data nodes across two AWS Regions. Deploy four dedicated master nodes in each Region.
- B . Use a cluster of six data nodes across three Availability Zones. Use three dedicated master nodes.
- C . Use a cluster of six data nodes across three Availability Zones. Use six dedicated master nodes.
- D . Use a cluster of eight data nodes across two Availability Zones. Deploy four master nodes in a failover AWS Region.
Correct Answer: B
B
Explanation:
To transition the Amazon Elasticsearch Service (Amazon ES) domain to a highly available, production-grade deployment:
Cluster Configuration:
Use a cluster of six data nodes to handle data ingestion and querying.
Distribute these nodes across three Availability Zones (AZs) for high availability and fault tolerance.
Reference: Amazon Elasticsearch Service Best Practices
Dedicated Master Nodes:
Use three dedicated master nodes to manage the cluster state and perform cluster management tasks.
This separation of master and data nodes helps in maintaining cluster stability and performance.
Reference: Dedicated Master Nodes
This configuration ensures that the Elasticsearch cluster is highly available and can handle production workloads effectively.
B
Explanation:
To transition the Amazon Elasticsearch Service (Amazon ES) domain to a highly available, production-grade deployment:
Cluster Configuration:
Use a cluster of six data nodes to handle data ingestion and querying.
Distribute these nodes across three Availability Zones (AZs) for high availability and fault tolerance.
Reference: Amazon Elasticsearch Service Best Practices
Dedicated Master Nodes:
Use three dedicated master nodes to manage the cluster state and perform cluster management tasks.
This separation of master and data nodes helps in maintaining cluster stability and performance.
Reference: Dedicated Master Nodes
This configuration ensures that the Elasticsearch cluster is highly available and can handle production workloads effectively.
Question #257
A SysOps administrator must configure a resilient tier of Amazon EC2 instances for a high performance computing (HPC) application. The HPC application requires minimum latency between nodes
Which actions should the SysOps administrator take to meet these requirements? (Select TWO.)
- A . Create an Amazon Elastic File System (Amazon EPS) file system Mount the file system to the EC2 instances by using user data
- B . Create a Multi-AZ Network Load Balancer in front of the EC2 instances
- C . Place the EC2 instances in an Auto Scaling group within a single subnet
- D . Launch the EC2 instances into a cluster placement group
- E . Launch the EC2 instances into a partition placement group
Correct Answer: D E
D E
Explanation:
For high-performance computing (HPC) applications requiring minimal latency between nodes, using a placement group strategy is crucial.
Cluster Placement Group:
Provides low-latency network performance within a single Availability Zone by placing instances close together on the network.
Suitable for applications that require high throughput or low latency.
Partition Placement Group:
Helps reduce the impact of hardware failures by dividing instances into partitions, where each partition can be placed on distinct racks in the data center.
Suitable for applications that need high availability and fault tolerance.
Setting Up Placement Groups:
Create a Placement Group:
Open the Amazon EC2 console at Amazon EC2 Console.
In the navigation pane, choose Placement Groups.
Choose Create placement group, specify the name, and choose either Cluster or Partition as the strategy.
Launch Instances:
When launching new instances, specify the placement group name to ensure they are placed accordingly.
Reference: Placement Groups
Creating and Managing Placement Groups
D E
Explanation:
For high-performance computing (HPC) applications requiring minimal latency between nodes, using a placement group strategy is crucial.
Cluster Placement Group:
Provides low-latency network performance within a single Availability Zone by placing instances close together on the network.
Suitable for applications that require high throughput or low latency.
Partition Placement Group:
Helps reduce the impact of hardware failures by dividing instances into partitions, where each partition can be placed on distinct racks in the data center.
Suitable for applications that need high availability and fault tolerance.
Setting Up Placement Groups:
Create a Placement Group:
Open the Amazon EC2 console at Amazon EC2 Console.
In the navigation pane, choose Placement Groups.
Choose Create placement group, specify the name, and choose either Cluster or Partition as the strategy.
Launch Instances:
When launching new instances, specify the placement group name to ensure they are placed accordingly.
Reference: Placement Groups
Creating and Managing Placement Groups
Question #258
A company needs to archive all audit logs for 10 years. The company must protect the logs from any future edits.
Which solution will meet these requirements?
- A . Store the data in an Amazon Elastic Block Store (Amazon EBS) volume. Configure AWS Key Management Service (AWS KMS) encryption.
- B . Store the data in an Amazon S3 Glacier vault. Configure a vault lock policy for write-once, read-many (WORM) access.
- C . Store the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Configure server-side encryption.
- D . Store the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Configure multi-factor authentication (MFA).
Correct Answer: B
B
Explanation:
To meet the requirements of the workload, a company should store the data in an Amazon S3 Glacier vault and configure a vault lock policy for write-once, read-many (WORM) access. This will ensure that the data is stored securely and cannot be edited in the future. The other solutions (storing the data in an Amazon Elastic Block Store (Amazon EBS) volume and configuring AWS Key Management Service (AWS KMS) encryption, storing the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA) and configuring server-side encryption, or storing the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA) and configuring multi-factor authentication (MFA)) will not meet the requirements, as they do not provide a way to protect the audit logs from future edits.
https://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/object-lock.html
B
Explanation:
To meet the requirements of the workload, a company should store the data in an Amazon S3 Glacier vault and configure a vault lock policy for write-once, read-many (WORM) access. This will ensure that the data is stored securely and cannot be edited in the future. The other solutions (storing the data in an Amazon Elastic Block Store (Amazon EBS) volume and configuring AWS Key Management Service (AWS KMS) encryption, storing the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA) and configuring server-side encryption, or storing the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA) and configuring multi-factor authentication (MFA)) will not meet the requirements, as they do not provide a way to protect the audit logs from future edits.
https://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/object-lock.html
Question #258
A company needs to archive all audit logs for 10 years. The company must protect the logs from any future edits.
Which solution will meet these requirements?
- A . Store the data in an Amazon Elastic Block Store (Amazon EBS) volume. Configure AWS Key Management Service (AWS KMS) encryption.
- B . Store the data in an Amazon S3 Glacier vault. Configure a vault lock policy for write-once, read-many (WORM) access.
- C . Store the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Configure server-side encryption.
- D . Store the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Configure multi-factor authentication (MFA).
Correct Answer: B
B
Explanation:
To meet the requirements of the workload, a company should store the data in an Amazon S3 Glacier vault and configure a vault lock policy for write-once, read-many (WORM) access. This will ensure that the data is stored securely and cannot be edited in the future. The other solutions (storing the data in an Amazon Elastic Block Store (Amazon EBS) volume and configuring AWS Key Management Service (AWS KMS) encryption, storing the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA) and configuring server-side encryption, or storing the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA) and configuring multi-factor authentication (MFA)) will not meet the requirements, as they do not provide a way to protect the audit logs from future edits.
https://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/object-lock.html
B
Explanation:
To meet the requirements of the workload, a company should store the data in an Amazon S3 Glacier vault and configure a vault lock policy for write-once, read-many (WORM) access. This will ensure that the data is stored securely and cannot be edited in the future. The other solutions (storing the data in an Amazon Elastic Block Store (Amazon EBS) volume and configuring AWS Key Management Service (AWS KMS) encryption, storing the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA) and configuring server-side encryption, or storing the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA) and configuring multi-factor authentication (MFA)) will not meet the requirements, as they do not provide a way to protect the audit logs from future edits.
https://docs.aws.amazon.com/zh_tw/AmazonS3/latest/userguide/object-lock.html
Question #260
A company’s web application is available through an Amazon CloudFront distribution and directly through an internet-facing Application Load Balancer (ALB) A SysOps administrator must make the application accessible only through the CloudFront distribution and not directly through the ALB. The SysOps administrator must make this change without changing the application code
Which solution will meet these requirements?
- A . Modify the ALB type to internal Set the distribution’s origin to the internal ALB domain name
- B . Create a Lambda@Edge function Configure the function to compare a custom header value in the request with a stored password and to forward the request to the origin in case of a match Associate the function with the distribution.
- C . Replace the ALB with a new internal ALB Set the distribution’s origin to the internal ALB domain name Add a custom HTTP header to the origin settings for the distribution In the ALB listener add a rule to forward requests that contain the matching custom header and the header’s value Add a default rule to return a fixed response code of 403.
- D . Add a custom HTTP header to the origin settings for the distribution in the ALB listener add a rule to forward requests that contain the matching custom header and the header’s value Add a default rule to return a fixed response code of 403.
Correct Answer: D
D
Explanation:
To make the application accessible only through the CloudFront distribution and not directly through the Application Load Balancer (ALB), you can add a custom HTTP header to the origin settings for the CloudFront distribution. You can then create a rule in the ALB listener to forward requests that contain the matching custom header and its value to the origin. You can also add a default rule to the ALB listener to return a fixed response code of 403 for requests that do not contain the matching custom header. This will allow you to redirect all requests to the CloudFront distribution and block direct access to the application through the ALB.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/restrict-access-to-load-balancer.html
D
Explanation:
To make the application accessible only through the CloudFront distribution and not directly through the Application Load Balancer (ALB), you can add a custom HTTP header to the origin settings for the CloudFront distribution. You can then create a rule in the ALB listener to forward requests that contain the matching custom header and its value to the origin. You can also add a default rule to the ALB listener to return a fixed response code of 403 for requests that do not contain the matching custom header. This will allow you to redirect all requests to the CloudFront distribution and block direct access to the application through the ALB.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/restrict-access-to-load-balancer.html