Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #271
A company uses AWS Organizations to manage its multi-account environment. The organization contains a dedicated account for security and a dedicated account for logging. A SysOps administrator needs to implement a centralized solution that provides alerts when a resource metric in any account crosses a standard defined threshold.
Which solution will meet these requirements?
- A . Deploy an AWS CloudFormation stack set to the accounts in the organization. Use a template that creates the required Amazon CloudWatch alarms and references an Amazon Simple Notification Service (Amazon SNS) topic in the logging account with publish permissions for all the accounts.
- B . Deploy an AWS CloudFormation stack in each account. Use the stack to deploy the required Amazon CloudWalch alarms and the required Amazon Simple Notification Service (Amazon SNS) topic.
- C . Deploy an AWS Lambda function on a cron job in each account. Configure the Lambda function to read resources that are in the account and to invoke an Amazon Simple Notification Service (Amazon SNS) topic if any metrics cross the defined threshold.
- D . Deploy an AWS CloudFormation change set to the organization. Use a template to create the required Amazon CloudWatch alarms and to send alerts to a verified Amazon Simple Email Service (Amazon SES) identity.
Correct Answer: A
A
Explanation:
Using AWS CloudFormation stack sets allows you to manage CloudWatch alarms across multiple accounts efficiently:
Create Stack Set: Use a CloudFormation template that defines the required CloudWatch alarms and configures them to publish alerts to an SNS topic.
Specify SNS Topic: Ensure the SNS topic is located in the logging account and has the necessary permissions set to receive publications from all accounts in the organization.
Deploy Across Organization: Implement the stack set across all accounts, ensuring centralized management and standardized deployment.
AWS Documentation
Reference: Learn more about deploying resources with CloudFormation StackSets: Working with AWS CloudFormation StackSets.
A
Explanation:
Using AWS CloudFormation stack sets allows you to manage CloudWatch alarms across multiple accounts efficiently:
Create Stack Set: Use a CloudFormation template that defines the required CloudWatch alarms and configures them to publish alerts to an SNS topic.
Specify SNS Topic: Ensure the SNS topic is located in the logging account and has the necessary permissions set to receive publications from all accounts in the organization.
Deploy Across Organization: Implement the stack set across all accounts, ensuring centralized management and standardized deployment.
AWS Documentation
Reference: Learn more about deploying resources with CloudFormation StackSets: Working with AWS CloudFormation StackSets.
Question #272
Create a rule named SpotWarning to send a notification to a new standard Amazon SNS topic named TopicEvents whenever an Amazon EC2
Spot Instance is interrupted. Do NOT create any topic subscriptions. The notification must match the following structure:
Input Path:
{“instance” : “$.detail.instance-id”}
Input template:
“ The EC2 Spot Instance <instance> has been on account.
Correct Answer: Here are the steps to configure Amazon EventBridge to meet the above requirements:
Log in to the AWS Management Console by using the AWS Management Console shortcut from the VM desktop. Make sure that you are logged in to the desired AWS account.
Go to the EventBridge service in the us-east-2 Region.
In the EventBridge service, navigate to the "Event buses" page.
Click on the "Create event bus" button.
Give a name to your event bus, and select "default" as the event source type.
Navigate to "Rules" page and create a new rule named "RunFunction"
In the "Event pattern" section, select "Schedule" as the event source and set the schedule to run every 15 minutes.
In the "Actions" section, select "Send to Lambda" and choose the existing AWS Lambda function named "LogEventFunction"
Create another rule named "SpotWarning"
In the "Event pattern" section, select "EC2" as the event source, and filter the events on "EC2 Spot Instance interruption"
In the "Actions" section, select "Send to SNS topic" and create a new standard Amazon SNS topic named "TopicEvents"
In the "Input Transformer" section, set the Input Path to {“instance” : “$.detail.instance-id”} and Input template to “The EC2 Spot Instance <instance> has been interrupted on account.
Now all Amazon EC2 events in the default event bus will be replayable for past 90 days.
Note:
You can use the AWS Management Console, AWS CLI, or SDKs to create and manage EventBridge resources.
You can use CloudTrail event history to replay events from the past 90 days.
You can refer to the AWS EventBridge documentation for more information on how to configure and
use the service: https://aws.amazon.com/eventbridge/
Log in to the AWS Management Console by using the AWS Management Console shortcut from the VM desktop. Make sure that you are logged in to the desired AWS account.
Go to the EventBridge service in the us-east-2 Region.
In the EventBridge service, navigate to the "Event buses" page.
Click on the "Create event bus" button.
Give a name to your event bus, and select "default" as the event source type.
Navigate to "Rules" page and create a new rule named "RunFunction"
In the "Event pattern" section, select "Schedule" as the event source and set the schedule to run every 15 minutes.
In the "Actions" section, select "Send to Lambda" and choose the existing AWS Lambda function named "LogEventFunction"
Create another rule named "SpotWarning"
In the "Event pattern" section, select "EC2" as the event source, and filter the events on "EC2 Spot Instance interruption"
In the "Actions" section, select "Send to SNS topic" and create a new standard Amazon SNS topic named "TopicEvents"
In the "Input Transformer" section, set the Input Path to {“instance” : “$.detail.instance-id”} and Input template to “The EC2 Spot Instance <instance> has been interrupted on account.
Now all Amazon EC2 events in the default event bus will be replayable for past 90 days.
Note:
You can use the AWS Management Console, AWS CLI, or SDKs to create and manage EventBridge resources.
You can use CloudTrail event history to replay events from the past 90 days.
You can refer to the AWS EventBridge documentation for more information on how to configure and
use the service: https://aws.amazon.com/eventbridge/
Question #273
A company needs to create a daily Amazon Machine Image (AMI) of an existing Amazon Linux EC2 instance that hosts the operating system, application, and database on multiple attached Amazon Elastic Block Store (Amazon EBS) volumes. File system integrity must be maintained.
Which solution will meet these requirements?
- A . Create an AWS Lambda function to call the CreateImage API operation with the EC2 instance ID and the no-reboot parameter enabled. Create a daily scheduled Amazon EventBridge (Amazon CloudWatch Events) rule that invokes the function.
- B . Create an AWS Lambda function to call the CreateImage API operation with the EC2 instance ID and the reboot parameter enabled. Create a daily scheduled Amazon EventBridge (Amazon CloudWatch Events) rule that invokes the function.
- C . Use AWS Backup to create a backup plan with a backup rule that runs daily. Assign the resource ID of the EC2 instance with the no-reboot parameter enabled.
- D . Use AWS Backup to create a backup plan with a backup rule that runs daily. Assign the resource ID of the EC2 instance with the reboot parameter enabled.
Correct Answer: B
B
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Creating_EBSbacked_WinAMI.html
"NoReboot By default, Amazon EC2 attempts to shut down and reboot the instance before creating the image. If the No Reboot option is set, Amazon EC2 doesn’t shut down the instance before creating the image. When this option is used, file system integrity on the created image can’t be guaranteed." Besides, we can use AWS EventBridge to invoke Lambda function https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateImage.html
B
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Creating_EBSbacked_WinAMI.html
"NoReboot By default, Amazon EC2 attempts to shut down and reboot the instance before creating the image. If the No Reboot option is set, Amazon EC2 doesn’t shut down the instance before creating the image. When this option is used, file system integrity on the created image can’t be guaranteed." Besides, we can use AWS EventBridge to invoke Lambda function https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateImage.html
Question #274
A large company is using AWS Organizations to manage hundreds of AWS accounts across multiple
AWS Regions. The company has turned on AWS Config throughout the organization.
The company requires all Amazon S3 buckets to block public read access. A SysOps administrator must generate a monthly report that shows all the S3 buckets and whether they comply with this requirement.
Which combination of steps should the SysOps administrator take to collect this data? {Select TWO).
- A . Create an AWS Config aggregator in an aggregator account. Use the organization as the source.
Retrieve the compliance data from the aggregator. - B . Create an AWS Config aggregator in each account. Use an S3 bucket in an aggregator account as the destination. Retrieve the compliance data from the S3 bucket
- C . Edit the AWS Config policy in AWS Organizations. Use the organization’s management account to turn on the s3-bucket-public-read-prohibited rule for the entire organization.
- D . Use the AWS Config compliance report from the organization’s management account. Filter the results by resource, and select Amazon S3.
- E . Use the AWS Config API to apply the s3-bucket-public-read-prohibited rule in all accounts for all available Regions.
Correct Answer: CA
CA
Explanation:
To generate a monthly report showing all S3 buckets and their compliance with the requirement to block public read access, the SysOps administrator can take the following steps:
Create an AWS Config Aggregator:
Create an AWS Config aggregator in an aggregator account. Use the organization as the source to aggregate AWS Config data across all accounts in the organization.
Reference: AWS Config Aggregator
Edit the AWS Config Policy in AWS Organizations:
In the management account, edit the AWS Config policy to enable the s3-bucket-public-read-prohibited rule across the entire organization.
This ensures that the rule is consistently applied in all accounts and regions.
Reference: AWS Config Rules
By aggregating the AWS Config data and applying the rule organization-wide, the SysOps administrator can easily generate the required compliance reports and ensure that all S3 buckets adhere to the policy of blocking public read access.
CA
Explanation:
To generate a monthly report showing all S3 buckets and their compliance with the requirement to block public read access, the SysOps administrator can take the following steps:
Create an AWS Config Aggregator:
Create an AWS Config aggregator in an aggregator account. Use the organization as the source to aggregate AWS Config data across all accounts in the organization.
Reference: AWS Config Aggregator
Edit the AWS Config Policy in AWS Organizations:
In the management account, edit the AWS Config policy to enable the s3-bucket-public-read-prohibited rule across the entire organization.
This ensures that the rule is consistently applied in all accounts and regions.
Reference: AWS Config Rules
By aggregating the AWS Config data and applying the rule organization-wide, the SysOps administrator can easily generate the required compliance reports and ensure that all S3 buckets adhere to the policy of blocking public read access.
Question #275
A SysOps administrator notices a scale-up event for an Amazon EC2 Auto Scaling group Amazon CloudWatch shows a spike in the RequestCount metric for the associated Application Load Balancer The administrator would like to know the IP addresses for the source of the requests
Where can the administrator find this information?
- A . Auto Scaling logs
- B . AWS CloudTrail logs
- C . EC2 instance logs
- D . Elastic Load Balancer access logs
Correct Answer: D
D
Explanation:
Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer. Each log contains information such as the time the request was received, the client’s IP address, latencies, request paths, and server responses. You can use these access logs to analyze traffic patterns and troubleshoot issues.
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
D
Explanation:
Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer. Each log contains information such as the time the request was received, the client’s IP address, latencies, request paths, and server responses. You can use these access logs to analyze traffic patterns and troubleshoot issues.
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
Question #276
A company’s SysOps administrator attempts to restore an Amazon Elastic Block Store (Amazon EBS) snapshot. However, the snapshot is missing because another system administrator accidentally deleted the snapshot. The company needs the ability to recover snapshots for a specified period of time after snapshots are deleted.
Which solution will provide this functionality?
- A . Turn on deletion protection on individual EBS snapshots that need to be kept.
- B . Create an 1AM policy that denies the deletion of EBS snapshots by using a condition statement for
the snapshot age Apply the policy to all users - C . Create a Recycle Bin retention rule for EBS snapshots for the desired retention period.
- D . Use Amazon EventBridge (Amazon CloudWatch Events) to schedule an AWS Lambda function to copy EBS snapshots to Amazon S3 Glacier.
Correct Answer: C
C
Explanation:
To provide the ability to recover deleted EBS snapshots for a specified period, creating a Recycle Bin retention rule for EBS snapshots is the appropriate solution.
Recycle Bin:
The Recycle Bin for Amazon EBS snapshots allows you to recover snapshots that were deleted within a specified retention period.
Creating a Retention Rule:
Open the Amazon Data Lifecycle Manager console.
Create a new Recycle Bin retention rule for EBS snapshots and specify the desired retention period.
Reference: Amazon EBS Recycle Bin
C
Explanation:
To provide the ability to recover deleted EBS snapshots for a specified period, creating a Recycle Bin retention rule for EBS snapshots is the appropriate solution.
Recycle Bin:
The Recycle Bin for Amazon EBS snapshots allows you to recover snapshots that were deleted within a specified retention period.
Creating a Retention Rule:
Open the Amazon Data Lifecycle Manager console.
Create a new Recycle Bin retention rule for EBS snapshots and specify the desired retention period.
Reference: Amazon EBS Recycle Bin
Question #277
A company has an application that collects notifications from thousands of alarm systems. The notifications include alarm notifications and information notifications. The information notifications
include the system arming processes, disarming processes, and sensor status.
All notifications are kept as messages in an Amazon Simple Queue Service (Amazon SQS) queue. Amazon EC2 instances that are in an Auto Scaling group process the messages. A SysOps administrator needs to implement a solution that prioritizes alarm notifications over information notifications.
Which solution will meet these requirements?
- A . Adjust the Auto Scaling group to scale faster when a high number of messages is in the queue.
- B . Use the Amazon Simple Notification Service (Amazon SNS) fanout feature with Amazon SQS to send the notifications in parallel to all the EC2 instances.
- C . Add an Amazon DynamoDB stream to accelerate the message processing.
- D . Create a queue for alarm notifications and a queue for information notifications. Update the application to collect messages from the alarm notifications queue first.
Correct Answer: D
D
Explanation:
To prioritize alarm notifications over information notifications in an Amazon SQS environment, creating separate queues for each type of notification is the best approach. This allows the application processing the queues to prioritize fetching messages from the alarm notifications queue first. Option D directly addresses the need for prioritization without complicating the existing infrastructure. This setup is supported by best practices for using Amazon SQS, where using multiple queues to segregate message types is a recommended strategy Amazon SQS Best Practices.
D
Explanation:
To prioritize alarm notifications over information notifications in an Amazon SQS environment, creating separate queues for each type of notification is the best approach. This allows the application processing the queues to prioritize fetching messages from the alarm notifications queue first. Option D directly addresses the need for prioritization without complicating the existing infrastructure. This setup is supported by best practices for using Amazon SQS, where using multiple queues to segregate message types is a recommended strategy Amazon SQS Best Practices.
Question #278
To manage Auto Scaling group instances that have OS vulnerabilities, the SysOps administrator needs an automated patching solution.
- A . Use AWS Systems Manager Patch Manager to patch the instances during a scheduled maintenance window. In the AWS-RunPatchBaseline document, ensure that the RebootOption parameter is set to RebootIfNeeded.
- B . Use EC2 Image Builder pipelines on a schedule to create new Amazon Machine Images (AMIs) and new launch templates that reference the new AMIs. Use the instance refresh feature for EC2 Auto Scaling to replace instances.
- C . Use AWS Config to scan for operating system vulnerabilities and to patch instances when the instance status changes to NON_COMPLIANT. Send an Amazon Simple Notification Service (Amazon SNS) notification to an operations team to reboot the instances during off-peak hours.
- D . In the Auto Scaling launch template, provide an Amazon Machine Image (AMI) ID for an AWS-provided base image. Update the user data with a shell script to download and install patches.
Correct Answer: A
A
Explanation:
Using AWS Systems Manager Patch Manager with a maintenance window is a best practice for automating OS patch management across instances in an Auto Scaling group.
Patch Manager: Allows for scheduled patching according to maintenance windows, ensuring minimal impact on application uptime.
RebootOption parameter: Setting this to RebootIfNeeded ensures patches are applied fully when a reboot is required.
AWS-RunPatchBaseline: This document automates the patching process and can be customized based on compliance requirements.
A
Explanation:
Using AWS Systems Manager Patch Manager with a maintenance window is a best practice for automating OS patch management across instances in an Auto Scaling group.
Patch Manager: Allows for scheduled patching according to maintenance windows, ensuring minimal impact on application uptime.
RebootOption parameter: Setting this to RebootIfNeeded ensures patches are applied fully when a reboot is required.
AWS-RunPatchBaseline: This document automates the patching process and can be customized based on compliance requirements.
Question #278
To manage Auto Scaling group instances that have OS vulnerabilities, the SysOps administrator needs an automated patching solution.
- A . Use AWS Systems Manager Patch Manager to patch the instances during a scheduled maintenance window. In the AWS-RunPatchBaseline document, ensure that the RebootOption parameter is set to RebootIfNeeded.
- B . Use EC2 Image Builder pipelines on a schedule to create new Amazon Machine Images (AMIs) and new launch templates that reference the new AMIs. Use the instance refresh feature for EC2 Auto Scaling to replace instances.
- C . Use AWS Config to scan for operating system vulnerabilities and to patch instances when the instance status changes to NON_COMPLIANT. Send an Amazon Simple Notification Service (Amazon SNS) notification to an operations team to reboot the instances during off-peak hours.
- D . In the Auto Scaling launch template, provide an Amazon Machine Image (AMI) ID for an AWS-provided base image. Update the user data with a shell script to download and install patches.
Correct Answer: A
A
Explanation:
Using AWS Systems Manager Patch Manager with a maintenance window is a best practice for automating OS patch management across instances in an Auto Scaling group.
Patch Manager: Allows for scheduled patching according to maintenance windows, ensuring minimal impact on application uptime.
RebootOption parameter: Setting this to RebootIfNeeded ensures patches are applied fully when a reboot is required.
AWS-RunPatchBaseline: This document automates the patching process and can be customized based on compliance requirements.
A
Explanation:
Using AWS Systems Manager Patch Manager with a maintenance window is a best practice for automating OS patch management across instances in an Auto Scaling group.
Patch Manager: Allows for scheduled patching according to maintenance windows, ensuring minimal impact on application uptime.
RebootOption parameter: Setting this to RebootIfNeeded ensures patches are applied fully when a reboot is required.
AWS-RunPatchBaseline: This document automates the patching process and can be customized based on compliance requirements.
Question #280
A SysOps administrator must implement a limited rollout of a new version of the website to 20% of customers using Amazon Route 53.
- A . Create a target group in Route 53. Set the routing algorithm to Weighted. Configure a weight of 80 for the original resource. Configure a weight of 20 for the new resource.
- B . Create a weighted routing policy. Configure a weight of 80 for the record that points to the original resource. Configure a weight of 20 for the record that points to the new resource.
- C . Create a multivalue answer routing policy. Configure a weight of 80 for the record that points to the original resource. Configure a weight of 20 for the record that points to the new resource. Enable session affinity (sticky sessions).
- D . Create a failover routing policy. Configure 80% of the website traffic to go to the original resource.
Configure the remaining 20% of traffic as the failover record that points to the new resource.
Correct Answer: B
B
Explanation:
Weighted routing in Route 53 allows you to direct a percentage of traffic to different resources by configuring specific weights.
For this requirement, you can:
Weighted Routing Policy: This is the most suitable approach for gradually rolling out a new version by controlling traffic distribution.
Weight Configuration: Setting a weight of 80 for the original resource and 20 for the new resource ensures that 80% of the traffic continues to go to the existing version, while 20% is directed to the new version.
Other routing policies, such as failover and multivalue answer, are not intended for traffic distribution based on percentage; they serve different use cases.
B
Explanation:
Weighted routing in Route 53 allows you to direct a percentage of traffic to different resources by configuring specific weights.
For this requirement, you can:
Weighted Routing Policy: This is the most suitable approach for gradually rolling out a new version by controlling traffic distribution.
Weight Configuration: Setting a weight of 80 for the original resource and 20 for the new resource ensures that 80% of the traffic continues to go to the existing version, while 20% is directed to the new version.
Other routing policies, such as failover and multivalue answer, are not intended for traffic distribution based on percentage; they serve different use cases.