Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company manages an application that uses Amazon ElastiCache for Redis with two extra-large nodes spread across two different Availability Zones. The company’s IT team discovers that the ElastiCache for Redis cluster has 75% freeable memory. The application must maintain high availability.
What is the MOST cost-effective way to resize the cluster?
- A . Decrease the number of nodes in the ElastiCache for Redis cluster from 2 to 1.
- B . Deploy a new ElastiCache for Redis cluster that uses large node types. Migrate the data from the original cluster to the new cluster. After the process is complete, shut down the original duster.
- C . Deploy a new ElastiCache for Redis cluster that uses large node types. Take a backup from the original cluster, and restore the backup in the new cluster. After the process is complete, shut down the original cluster.
- D . Perform an online resizing for the ElastiCache for Redis cluster. Change the node types from extra-large nodes to large nodes.
D
Explanation:
https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/scaling-redis-cluster-mode-enabled.html As demand on your clusters changes, you might decide to improve performance or reduce costs by changing the number of shards in your Redis (cluster mode enabled) cluster. We recommend using online horizontal scaling to do so, because it allows your cluster to continue serving requests during the scaling process.
https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/redis-cluster-vertical-scaling-scaling-down.html
A company is running a flash sale on its website. The website is hosted on burstable performance Amazon EC2 instances in an Auto Scaling group. The Auto Scaling group is configured to launch instances when the CPU utilization is above 70%.
A couple of hours into the sale, users report slow load times and error messages for refused connections. A SysOps administrator reviews Amazon CloudWatch metrics and notices that the CPU utilization is at 20% across the entire fleet of instances.
The SysOps administrator must restore the website’s functionality without making changes to the network infrastructure.
Which solution will meet these requirements?
- A . Activate unlimited mode for the instances in the Auto Scaling group.
- B . Implement an Amazon CloudFront distribution to offload the traffic from the Auto Scaling group.
- C . Move the website to a different AWS Region that is closer to the users.
- D . Reduce the desired size of the Auto Scaling group to artificially increase CPU average utilization.
B
Explanation:
Implement an Amazon CloudFront distribution to offload the traffic from the Auto Scaling group does not breach the requirement of no changes in the network infrastructure. Reason is that cloudfront is a distribution that allows you to distribute content using a worldwide network of edge locations that provide low latency and high data transfer speeds. It plug in to existing setup, not changes to it.
A SysOps administrator is deploying an application on 10 Amazon EC2 instances. The application must be highly available. The instances must be placed on distinct underlying hardware.
What should the SysOps administrator do to meet these requirements?
- A . Launch the instances into a cluster placement group in a single AWS Region.
- B . Launch the instances into a partition placement group in multiple AWS Regions.
- C . Launch the instances into a spread placement group in multiple AWS Regions.
- D . Launch the instances into a spread placement group in single AWS Region
D
Explanation:
To ensure high availability and that instances are placed on distinct underlying hardware, a spread placement group should be used. Spread placement groups place instances on distinct hardware, reducing the risk of simultaneous failures.
Create Spread Placement Group:
Open the EC2 console at Amazon EC2 Console.
Navigate to Placement Groups in the sidebar.
Click Create placement group and select Spread for the strategy.
Launch Instances:
When launching new instances, select the placement group you created.
Ensure the instances are in the same AWS Region but spread across distinct hardware.
Verify Placement:
After launching, verify that the instances are in the spread placement group by checking the instance details in the console.
Reference: Placement Groups
Creating a Spread Placement Group
A SysOps administrator is reviewing AWS Trusted Advisor warnings and encounters a warning for an S3 bucket policy that has open access permissions. While discussing the issue with the bucket owner, the administrator realizes the S3 bucket is an origin for an Amazon CloudFront web distribution.
Which action should the administrator take to ensure that users access objects in Amazon S3 by using only CloudFront URLs?
- A . Encrypt the S3 bucket content with Server-Side Encryption with Amazon S3-Managed Keys (SSE-
S3). - B . Create an origin access identity and grant it permissions to read objects in the S3 bucket.
- C . Assign an 1AM user to the CloudFront distribution and grant the user permissions in the S3 bucket policy.
- D . Assign an 1AM role to the CloudFront distribution and grant the role permissions in the S3 bucket policy.
B
Explanation:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
To ensure that users access objects in Amazon S3 by using only CloudFront URLs, the SysOps administrator should create an origin access identity (OAI) and grant it permissions to read objects in the S3 bucket.
Create an Origin Access Identity (OAI):
OAI is a special CloudFront user that you associate with your distribution to restrict access to the S3 bucket.
This ensures that only CloudFront can access the S3 bucket directly, and users must go through CloudFront to access the content.
Steps to Implement:
Open the CloudFront console.
Select your distribution and go to the "Origins and Origin Groups" tab.
Edit the S3 origin and create a new OAI or use an existing one.
Update the S3 bucket policy to grant the OAI read permissions.
Bucket Policy Example:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity [OAI_ID]"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::your-bucket-name/*"
}
]
}
Reference: Using an Origin Access Identity to Restrict Access to Your S3 Content
A company’s reporting job that used to run in 15 minutes is now taking an hour to run. An application generates the reports. The application runs on Amazon EC2 instances and extracts data from an Amazon RDS for MySQL database.
A SysOps administrator checks the Amazon CloudWatch dashboard for the RDS instance and notices that the Read IOPS metrics are high, even when the reports are not running. The SysOps administrator needs to improve the performance and the availability of the RDS instance.
Which solution will meet these requirements?
- A . Configure an Amazon ElastiCache cluster in front of the RDS instance. Update the reporting job to query the ElastiCache cluster.
- B . Deploy an RDS read replica. Update the reporting job to query the reader endpoint.
- C . Create an Amazon CloudFront distribution. Set the RDS instance as the origin. Update the reporting job to query the CloudFront distribution.
- D . Increase the size of the RDS instance.
B
Explanation:
Using an RDS read replica will improve the performance and availability of the RDS instance by offloading read queries to the replica. This will also ensure that the reporting job completes in a timely manner and does not affect the performance of other queries that might be running on the RDS instance. Additionally, updating the reporting job to query the reader endpoint will ensure that all read queries are directed to the read replica.
Reference: [1] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html
A SysOps administrator needs to update an AWS accoun1 name.
What should the SysOps administrator do to accomplish this goal?
- A . Add the Administrator Access policy to the SysOps administrator’s 1AM user.
- B . Add the AWS_ConfigRole policy to the SysOps administrator’s 1AM user.
- C . Change the AWS account name through the AWS Trusted Advisor interface.
- D . Sign in as the AWS account root user to make the change.
D
Explanation:
Update AWS Account Name:
The AWS account name can only be changed by the root user of the account.
Steps:
Sign in to the AWS Management Console using the root user credentials.
Navigate to the "My Account" page.
Update the account name field and save the changes.
Reference: Updating the AWS Account Name
A company is running a serverless application on AWS Lambda The application stores data in an Amazon RDS for MySQL DB instance Usage has steadily increased and recently there have been numerous "too many connections" errors when the Lambda function attempts to connect to the database The company already has configured the database to use the maximum max_connections value that is possible
What should a SysOps administrator do to resolve these errors’?
- A . Create a read replica of the database Use Amazon Route 53 to create a weighted DNS record that contains both databases
- B . Use Amazon RDS Proxy to create a proxy Update the connection string in the Lambda function
- C . Increase the value in the max_connect_errors parameter in the parameter group that the database uses
- D . Update the Lambda function’s reserved concurrency to a higher value
B
Explanation:
https://aws.amazon.com/blogs/compute/using-amazon-rds-proxy-with-aws-lambda/
RDS Proxy acts as an intermediary between your application and an RDS database. RDS Proxy establishes and manages the necessary connection pools to your database so that your application creates fewer database connections. Your Lambda functions interact with RDS Proxy instead of your database instance. It handles the connection pooling necessary for scaling many simultaneous connections created by concurrent Lambda functions. This allows your Lambda applications to reuse existing connections, rather than creating new connections for every function invocation.
Check "Database proxy for Amazon RDS" section in the link to see how RDS proxy help Lambda handle huge connections to RDS MySQL https://aws.amazon.com/blogs/compute/using-amazon-rds-proxy-with-aws-lambda/
An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS} queues A SysOps administrator must ensure that the application can read, write, and delete messages from the SQS queues
Which solution will meet these requirements in the MOST secure manner?
- A . Create an IAM user with an IAM policy that allows the sqs SendMessage permission, the sqs ReceiveMessage permission, and the sqs DeleteMessage permission to the appropriate queues Embed the IAM user’s credentials in the application’s configuration
- B . Create an IAM user with an IAM policy that allows the sqs SendMessage permission, the sqs ReceiveMessage permission, and the sqs DeleteMessage permission to the appropriate queues Export the IAM user’s access key and secret access key as environment variables on the EC2 instance
- C . Create and associate an IAM role that allows EC2 instances to call AWS services Attach an IAM policy to the role that allows sqs." permissions to the appropriate queues
- D . Create and associate an IAM role that allows EC2 instances to call AWS services Attach an IAM policy to the role that allows the sqs SendMessage permission, the sqs ReceiveMessage permission, and the sqs DeleteMessage permission to the appropriate queues
D
Explanation:
To ensure that the application running on an Amazon EC2 instance can read, write, and delete messages from the SQS queues in the most secure manner, the recommended approach is to use IAM roles for EC2 instances. This approach avoids the need to embed or export long-term AWS credentials, which can be a security risk.
Create an IAM Role for EC2:
Navigate to the IAM console in the AWS Management Console.
Choose "Roles" in the navigation pane, then click "Create role".
Select "AWS service" as the type of trusted entity and choose "EC2" as the use case. Click "Next:
Permissions".
Attach the Required Permissions:
On the "Attach permissions policies" page, you can either select an existing policy or create a custom policy.
For a custom policy, click "Create policy" and use the following JSON policy to allow the required SQS actions:
json
Copy code
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:SendMessage",
"sqs:ReceiveMessage",
"sqs:DeleteMessage"
],
"Resource": "arn:aws:sqs:region:account-id:queue-name"
}
]
}
Replace region, account-id, and queue-name with appropriate values for your SQS queues.
Assign the Role to the EC2 Instance:
After creating the role with the necessary permissions, navigate to the EC2 console.
Select the instance that needs access to the SQS queues.
In the "Actions" menu, choose "Security", then "Modify IAM role".
Attach the newly created IAM role to the instance.
Verify the Permissions:
Ensure that the IAM role is properly attached to the EC2 instance.
Test the application to confirm that it can successfully perform the required actions (read, write, delete) on the SQS queues.
Reference: IAM Roles for Amazon EC2
Amazon SQS Policy Examples
A company stores files on 50 Amazon S3 buckets in the same AWS Region. The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost.
Which solution will meet these requirements?
- A . Create a gateway VPC endpoint for each S3 bucket. Attach the gateway VPC endpoints to each subnet inside the VPC.
- B . Create an interface VPC endpoint for each S3 bucket. Attach the interface VPC endpoints to each subnet inside the VPC.
- C . Create one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table.
- D . Create one interface VPC endpoint for all the S3 buckets. Add the interface VPC endpoint to the VPC route table.
C
Explanation:
To securely connect to the S3 buckets over a private connection from EC2 instances without incurring additional costs, the SysOps administrator can create a gateway VPC endpoint.
Create a Gateway VPC Endpoint:
Navigate to the VPC console.
Create a gateway VPC endpoint for Amazon S3.
Reference: Gateway VPC Endpoints
Add the Gateway VPC Endpoint to the VPC Route Table:
Select the appropriate route table(s) associated with the subnets in the VPC.
Add a route that directs S3 traffic (com.amazonaws.<region>.s3) to the gateway VPC endpoint.
Reference: Creating a Gateway Endpoint
This configuration allows the EC2 instances to access all the S3 buckets securely over the private network without additional costs, as there are no data transfer charges within the same AWS Region for using a gateway VPC endpoint.
The company’s security team needs to consolidate Security Hub findings to reduce duplicate notifications for the same misconfigurations.
- A . Turn on consolidated control findings in the Security Hub delegated administrator account.
- B . Export the Security Hub findings. Consolidate the findings based on control ID. Visualize the findings in Amazon QuickSight.
- C . Set up an AWS Config aggregator instead of Security Hub. Deploy a custom conformance pack by consolidating AWS Config rules.
- D . Launch an Amazon EC2 instance in the organization’s management account. Configure a custom script to assume a role in each linked account to extract and consolidate findings from the accounts.
A
Explanation:
Enabling consolidated control findings in Security Hub reduces duplication by merging findings for similar controls across multiple standards. This reduces the operational burden of prioritizing remediation based on multiple copies of the same findings.
Consolidated Control Findings: Merges findings for controls across standards to avoid duplicates, providing a clearer view of misconfigurations without the need for additional infrastructure or manual processing.
Least Operational Overhead: This solution is managed within Security Hub without the need for external tools or manual exports.
Using AWS Config aggregators, QuickSight visualization, or custom EC2-based solutions would introduce additional complexity and overhead.