Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company has a new requirement stating that all resources in AWS must be tagged according to a set policy.
Which AWS service should be used to enforce and continually identify all resources that are not in compliance with the policy?
- A . AWS CloudTrail
- B . Amazon Inspector
- C . AWSConfig
- D . AWS Systems Manager
C
Explanation:
Understand the Problem:
All AWS resources must be tagged according to a company policy.
Continuous identification and enforcement of non-compliant resources are required.
Analyze the Requirements:
Monitor resources for compliance with tagging policies.
Enforce tagging policies and provide ongoing compliance reporting.
Evaluate the Options:
Option A: AWS CloudTrail.
Tracks user activity and API usage but does not enforce tagging policies.
Option B: Amazon Inspector.
Provides security assessments but does not monitor or enforce resource tagging.
Option C: AWS Config.
Monitors and evaluates the configurations of AWS resources.
AWS Config rules can be used to enforce tagging policies and continuously monitor compliance.
Option D: AWS Systems Manager.
Provides operational insights and management but does not specifically enforce tagging compliance.
Select the Best Solution:
Option C: AWS Config is designed for compliance and configuration monitoring, making it the ideal service for enforcing and identifying non-compliant resource tags.
Reference: AWS Config
Managing Resource Tag Compliance with AWS Config
AWS Config provides the necessary tools to enforce and monitor resource tagging compliance, ensuring all resources adhere to the set policy.
A company is running distributed computing software to manage a fleet of 20 Amazon EC2 instances for calculations. The fleet includes 2 control nodes and 18 task nodes to run the calculations. Control nodes can automatically start the task nodes.
Currently, all the nodes run on demand. The control nodes must be available 24 hours a day, 7 days a week. The task nodes run for 4 hours each day. A SysOps administrator needs to optimize the cost of this solution.
Which combination of actions will meet these requirements? (Choose two.)
- A . Purchase EC2 Instance Savings Plans for the control nodes.
- B . Use Dedicated Hosts for the control nodes.
- C . Use Reserved Instances for the task nodes.
- D . Use Spot Instances for the control nodes. Use On-Demand Instances if there is no Spot availability.
- E . Use Spot Instances for the task nodes. Use On-Demand Instances if there is no Spot availability.
AE
Explanation:
To optimize the cost of a computing environment consisting of control nodes that are always on and task nodes that operate for a limited number of hours each day, consider the following strategies:
Purchase EC2 Instance Savings Plans for the Control Nodes: Since the control nodes are required to be operational 24/7, purchasing EC2 Instance Savings Plans is a cost-effective choice. These plans provide a lower price compared to on-demand instances, in exchange for a commitment to a consistent amount of usage (measured in $/hour) for a one or three-year period.
Use Spot Instances for the Task Nodes: Given that task nodes are used for a shorter duration (4 hours a day) and presumably can tolerate interruptions, using Spot Instances can significantly reduce costs. Spot Instances offer unused EC2 capacity at a fraction of the regular price, which can lead to substantial cost savings. Additionally, configure the system to fall back to On-Demand Instances during periods when Spot Instances are not available to ensure availability.
This combination leverages cost savings for continuous use and flexible, lower-cost options for intermittent use, optimizing overall operational costs efficiently.
A SysOps administrator has created an AWS Service Catalog portfolio and has shared the portfolio with a second AWS account in the company. The second account is controlled by a different administrator.
Which action will the administrator of the second account be able to perform?
- A . Add a product from the imported portfolio to a local portfolio.
- B . Add new products to the imported portfolio.
- C . Change the launch role for the products contained in the imported portfolio.
- D . Customize the products in the imported portfolio.
A
Explanation:
When a portfolio is shared between AWS accounts in AWS Service Catalog, the administrator of the second account can import the shared portfolio and add products from the imported portfolio to their local portfolio. However, they cannot modify the imported portfolio directly.
Import the Shared Portfolio:
In the second AWS account, open the AWS Service Catalog console at AWS Service Catalog Console. Navigate to Portfolios and choose Import portfolio. Add Products to a Local Portfolio:
Once the portfolio is imported, the administrator can select products from the imported portfolio and add them to a local portfolio for easier management and deployment.
Reference: Sharing Portfolios Across Accounts
AWS Service Catalog Admin Guide
A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 to route traffic.
The company also has a static website that is configured in an Amazon S3 bucket.
A SysOps administrator must use the static website as a backup to the web application. The failover to the static website must be fully automated.
Which combination of actions will meet these requirements? (Choose two.)
- A . Create a primary failover routing policy record. Configure the value to be the ALB.
- B . Create an AWS Lambda function to switch from the primary website to the secondary website when the health check fails.
- C . Create a primary failover routing policy record. Configure the value to be the ALB. Associate the record with a Route 53 health check.
- D . Create a secondary failover routing policy record. Configure the value to be the static website.
Associate the record with a Route 53 health check. - E . Create a secondary failover routing policy record. Configure the value to be the static website.
A C
Explanation:
To use the static website as a backup to the web application and ensure automated failover, the SysOps administrator should set up failover routing policies in Amazon Route 53.
Failover Routing Policies:
Route 53 failover routing allows you to route traffic to a primary resource when it is healthy and automatically failover to a secondary resource when the primary becomes unhealthy.
Steps to Implement:
Primary Failover Record: Create a primary failover routing policy record and set the value to the ALB.
Associate this record with a Route 53 health check that monitors the ALB.
Secondary Failover Record: Create a secondary failover routing policy record and set the value to the static website.
Reference: Amazon Route 53 Failover Routing
A company is uploading important files as objects to Amazon S3 The company needs to be informed if an object is corrupted during the upload
What should a SysOps administrator do to meet this requirement?
- A . Pass the Content-Disposition value as a request body during the object upload.
- B . Pass the Content-MD5 value as a request header during the object upload.
- C . Pass x-amz-objecWock-mode as a request header during the object upload
- D . Pass x-amz-server-side-encryption-customer-algorithm as a request body during the object upload.
B
Explanation:
Content-MD5 Header:
The Content-MD5 header provides an MD5 checksum of the object being uploaded. Amazon S3 uses this checksum to verify the integrity of the object.
Steps:
When uploading an object to S3, calculate the MD5 checksum of the object.
Include the Content-MD5 header with the base64-encoded MD5 checksum value in the upload request.
This ensures that S3 can detect if the object is corrupted during the upload process.
Reference: PUT Object – Amazon Simple Storage Service
An existing, deployed solution uses Amazon EC2 instances with Amazon EBS General Purpose SSD volumes, an Amazon RDS PostgreSQL database, an Amazon EFS file system, and static objects stored in an Amazon S3 bucket. The Security team now mandates that at-rest encryption be turned on immediately for all aspects of the application, without creating new resources and without any downtime.
To satisfy the requirements, which one of these services can the SysOps administrator enable at-rest encryption on?
- A . EBS General Purpose SSD volumes
- B . RDS PostgreSQL database
- C . Amazon EFS file systems
- D . S3 objects within a bucket
D
Explanation:
To encrypt your existing Amazon S3 objects with a single request, you can use Amazon S3 batch operations. You provide Amazon S3 batch operations with a list of objects to operate on, and Amazon S3 batch operations calls the respective API to perform the specified operation. You can use the copy operation to copy the existing unencrypted objects and write the new encrypted objects to the same bucket. A single Amazon S3 batch operations job can perform the specified operation on billions of objects containing exabytes of data
https://docs.aws.amazon.com/efs/latest/ug/efs-enforce-encryption.html
A company manages its production applications across several AWS accounts. The company hosts the production applications on Amazon EC2 instances that run Amazon Linux 2. The EC2 instances are spread across multiple VPCs. Each VPC uses its own Amazon Route 53 private hosted zone for private DNS.
A VPC from Account A needs to resolve private DNS records from a private hosted zone that is associated with a different VPC in Account B.
What should a SysOps administrator do to meet these requirements?
- A . In Account A, create an AWS Systems Manager document that updates the /etc/resolv.conf file across all EC2 instances to point to the AWS provided default DNS resolver for the VPC in Account B.
- B . In Account A, create an AWS CloudFormation template that associates the private hosted zone from Account B with the private hosted zone in Account A.
- C . In Account A, use the AWS CLI to create a VPC association authorization. When the association is created, use the AWS CLI in Account B to associate the VPC from Account A with the private hosted zone in Account B.
- D . In Account B, use the AWS CLI to create a VPC association authorization. When the association is created, use the AWS CLI in Account A to associate the VPC from Account B with the private hosted zone in Account A.
D
Explanation:
To resolve DNS across VPCs in different accounts, you should:
Authorization: In Account B, initiate a VPC association authorization for the private hosted zone. This action allows another AWS account to associate a VPC with this hosted zone.
Association: In Account A, after receiving the authorization from Account B, associate its VPC with the private hosted zone that exists in Account B. This step will enable EC2 instances within the VPC in Account A to resolve DNS records hosted in Account B.
AWS Documentation
Reference: AWS provides detailed guidance on associating VPCs with private hosted zones across accounts in their documentation: Associating VPCs and Private Hosted Zones Across Accounts.
A company recently its server infrastructure to Amazon EC2 instances. The company wants to use Amazon CloudWatch metrics to track instance memory utilization and available disk space.
What should a SysOps administrator do to meet these requirements?
- A . Configure CloudWatch from the AWS Management Console tor all the instances that require monitoring by CloudWatch. AWS automatically installs and configures the agents far the specified instances.
- B . Install and configure the CloudWatch agent on all the instances. Attach an IAM role to allow the instances to write logs to CloudWatch.
- C . Install and configure the CloudWatch agent on all the instances. Attach an IAM user to allow the instances to write logs to CloudWatch.
- D . Install and configure the CloudWatch agent on all the instances. Attach the necessary security groups to allow the instances to write logs to CloudWatch
B
Explanation:
To track instance memory utilization and available disk space using Amazon CloudWatch, the SysOps administrator should install and configure the CloudWatch agent on all instances.
Install and Configure the CloudWatch Agent:
The CloudWatch agent can collect both system-level metrics (e.g., memory utilization, disk space) and application-level metrics and logs.
Install the CloudWatch agent on each EC2 instance and configure it to collect the necessary metrics.
Attach an IAM Role:
The EC2 instances need permissions to write logs and metrics to CloudWatch.
Attach an IAM role with the necessary permissions (e.g., CloudWatchAgentServerPolicy) to each EC2 instance.
Reference: Installing the CloudWatch Agent
Create IAM Roles to Use with the CloudWatch Agent
A company uses AWS Organizations to manage multiple AWS accounts. The company’s SysOps team has been using a manual process to create and manage 1AM roles. The team requires an automated solution to create and manage the necessary 1AM roles for multiple AWS accounts.
What is the MOST operationally efficient solution that meets these requirements?
- A . Create AWS CloudFormation templates. Reuse the templates to create the necessary 1AM roles in each of the AWS accounts.
- B . Use AWS Directory Service with AWS Organizations to automatically associate the necessary 1AM roles with Microsoft Active Directory users.
- C . Use AWS Resource Access Manager with AWS Organizations to deploy and manage shared
resources across the AWS accounts. - D . Use AWS CloudFormation StackSets with AWS Organizations to deploy and manage 1AM roles for the AWS accounts.
D
Explanation:
To automate the creation and management of IAM roles for multiple AWS accounts in an AWS Organization, using AWS CloudFormation StackSets is the most operationally efficient solution.
AWS CloudFormation StackSets:
AWS CloudFormation StackSets extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple AWS accounts and regions with a single operation.
Using StackSets with AWS Organizations:
Create a CloudFormation template that defines the necessary IAM roles.
Use StackSets to deploy the template across multiple AWS accounts in your organization.
Reference: AWS CloudFormation StackSets
Creating IAM Roles with CloudFormation
A SysOps administrator needs to design a disaster recovery (DR) plan for an application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The application uses an Amazon Aurora PostgreSQL database. The recovery time objective (RTO) and recovery point objective (RPO) are 15 minutes each.
Which combination of steps should the SysOps administrator take to meet these requirements MOST cost-effectively? (Select TWO.)
- A . Configure Aurora backups to be exported to the DR Region.
- B . Configure the Aurora cluster to replicate data to the DR Region by using the Aurora global database option.
- C . Configure the DR Region with an ALB and an Auto Scaling group. Use the same configuration as in the primary Region.
- D . Configure the DR Region with an ALB and an Auto Scaling group. Set the Auto Scaling group’s minimum capacity, maximum capacity, and desired capacity to 1.
- E . Manually launch a new ALB and a new Auto Scaling group by using AWS CloudFormation during a failover activity.
BC
Explanation:
For a disaster recovery (DR) plan with a 15-minute RTO and RPO, the most cost-effective steps include:
B: Configuring the Aurora cluster to replicate data to the DR region using the Aurora global database option. This allows continuous replication with typically low replication lag, meeting the 15-minute RPO requirement efficiently.
C: Pre-configuring the DR region with an ALB and an Auto Scaling group using the same configuration as the primary region. This ensures readiness and quick failover, aligning with the 15-minute RTO target.
These steps provide a robust disaster recovery setup that minimizes downtime and data loss while optimizing costs by using built-in AWS functionalities and avoiding over-provisioning. More information can be found in the AWS documentation on Aurora Global Databases Aurora Global Databases and disaster recovery planning AWS Disaster Recovery.