Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
Question #311
A SysOps Administrator runs a web application that is using a microservices approach whereby different responsibilities of the application have been divided in a separate microservice running on a different Amazon EC2 instance. The administrator has been tasked with reconfiguring the infrastructure to support this approach.
How can the administrator accomplish this with the LEAST administrative overhead?
- A . Use Amazon CloudFront to log the URL and forward the request.
- B . Use Amazon CloudFront to rewrite the header based on the microservice and forward the request.
- C . Use an Application Load Balancer (ALB) and do path-based routing.
- D . Use a Network Load Balancer (NLB) and do path-based routing.
Correct Answer: C
C
Explanation:
To reconfigure the infrastructure to support a microservices approach with the least administrative overhead, using an Application Load Balancer (ALB) with path-based routing is the most suitable solution.
Application Load Balancer (ALB):
ALBs are designed to distribute incoming application traffic across multiple targets, such as EC2
instances, in one or more Availability Zones.
ALBs support path-based routing, which allows you to route requests to different microservices based on the URL path.
Path-Based Routing:
With path-based routing, you can configure your ALB to route requests to specific target groups based on the URL path.
For example, requests to example.com/service1/* can be routed to one microservice, while requests to example.com/service2/* can be routed to another.
Implementation Steps:
Go to the EC2 console and navigate to "Load Balancers."
Create an ALB and configure the listener.
Define rules for path-based routing and create target groups for each microservice.
Register the appropriate EC2 instances with each target group.
Reference: Application Load Balancers
ALB Path-Based Routing
C
Explanation:
To reconfigure the infrastructure to support a microservices approach with the least administrative overhead, using an Application Load Balancer (ALB) with path-based routing is the most suitable solution.
Application Load Balancer (ALB):
ALBs are designed to distribute incoming application traffic across multiple targets, such as EC2
instances, in one or more Availability Zones.
ALBs support path-based routing, which allows you to route requests to different microservices based on the URL path.
Path-Based Routing:
With path-based routing, you can configure your ALB to route requests to specific target groups based on the URL path.
For example, requests to example.com/service1/* can be routed to one microservice, while requests to example.com/service2/* can be routed to another.
Implementation Steps:
Go to the EC2 console and navigate to "Load Balancers."
Create an ALB and configure the listener.
Define rules for path-based routing and create target groups for each microservice.
Register the appropriate EC2 instances with each target group.
Reference: Application Load Balancers
ALB Path-Based Routing
Question #312
A SysOps administrator has successfully deployed a VPC with an AWS Cloud Formation template The SysOps administrator wants to deploy me same template across multiple accounts that are managed through AWS Organizations.
Which solution will meet this requirement with the LEAST operational overhead?
- A . Assume the OrganizationAccountAcccssKolc IAM role from the management account. Deploy the template in each of the accounts
- B . Create an AWS Lambda function to assume a role in each account Deploy the template by using
the AWS CloudFormation CreateStack API call - C . Create an AWS Lambda function to query fc a list of accounts Deploy the template by using the AWS Cloudformation CreateStack API call.
- D . Use AWS CloudFormation StackSets from the management account to deploy the template in each of the accounts
Correct Answer: D
D
Explanation:
AWS CloudFormation StackSets extends the capability of stacks by enabling you to create, update, or delete stacks across multiple accounts and AWS Regions
If a Lambda function is not being invoked by an Amazon EventBridge (formerly CloudWatch Events) rule, the likely issue is a missing permission. The Lambda function needs permission to be invoked by the EventBridge rule.
Steps:
Add Permission to Lambda Function:
Open the AWS Lambda console.
Select your Lambda function.
Choose "Configuration" and then "Permissions".
Under the "Resource-based policy" section, add a policy that grants EventBridge permission to invoke your function.
Example policy:
json
Copy code
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME",
"Condition": {
"ArnLike": {
"AWS:SourceArn": "arn:aws:events:REGION:ACCOUNT_ID:rule/RULE_NAME"
}
}
}
]
}
Verify the EventBridge Rule:
Open the Amazon EventBridge console.
Select the rule that targets your Lambda function.
Ensure that the rule is correctly configured to match events and the target is your Lambda function.
Reference: AWS Lambda Permissions Model
Amazon EventBridge Rules
D
Explanation:
AWS CloudFormation StackSets extends the capability of stacks by enabling you to create, update, or delete stacks across multiple accounts and AWS Regions
If a Lambda function is not being invoked by an Amazon EventBridge (formerly CloudWatch Events) rule, the likely issue is a missing permission. The Lambda function needs permission to be invoked by the EventBridge rule.
Steps:
Add Permission to Lambda Function:
Open the AWS Lambda console.
Select your Lambda function.
Choose "Configuration" and then "Permissions".
Under the "Resource-based policy" section, add a policy that grants EventBridge permission to invoke your function.
Example policy:
json
Copy code
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME",
"Condition": {
"ArnLike": {
"AWS:SourceArn": "arn:aws:events:REGION:ACCOUNT_ID:rule/RULE_NAME"
}
}
}
]
}
Verify the EventBridge Rule:
Open the Amazon EventBridge console.
Select the rule that targets your Lambda function.
Ensure that the rule is correctly configured to match events and the target is your Lambda function.
Reference: AWS Lambda Permissions Model
Amazon EventBridge Rules
Question #313
A company is using Amazon CloudFront to serve static content for its web application to its users.
The CloudFront distribution uses an existing on-premises website as a custom origin.
The company requires the use of TLS between CloudFront and the origin server. This configuration
has worked as expected for several months. However, users are now experiencing HTTP 502 (Bad Gateway) errors when they view webpages that include content from the CloudFront distribution.
What should a SysOps administrator do to resolve this problem?
- A . Examine the expiration date on the certificate on the origin site. Validate that the certificate has not expired. Replace the certificate if necessary.
- B . Examine the hostname on the certificate on the origin site. Validate that the hostname matches one of the hostnames on the CloudFront distribution. Replace the certificate if necessary.
- C . Examine the firewall rules that are associated with the origin server. Validate that port 443 is open for inbound traffic from the internet. Create an inbound rule if necessary.
- D . Examine the network ACL rules that are associated with the CloudFront distribution. Validate that port 443 is open for outbound traffic to the origin server. Create an outbound rule if necessary.
Correct Answer: A
A
Explanation:
HTTP 502 errors from CloudFront can occur because of the following reasons:
There’s an SSL negotiation failure because the origin is using SSL/TLS protocols and ciphers that aren’t supported by CloudFront.
There’s an SSL negotiation failure because the SSL certificate on the origin is expired or invalid, or because the certificate chain is invalid.
There’s a host header mismatch in the SSL negotiation between your CloudFront distribution and the custom origin.
The custom origin isn’t responding on the ports specified in the origin settings of the CloudFront distribution.
The custom origin is ending the connection to CloudFront too quickly.
https://aws.amazon.com/premiumsupport/knowledge-center/resolve-cloudfront-connection-error/
A
Explanation:
HTTP 502 errors from CloudFront can occur because of the following reasons:
There’s an SSL negotiation failure because the origin is using SSL/TLS protocols and ciphers that aren’t supported by CloudFront.
There’s an SSL negotiation failure because the SSL certificate on the origin is expired or invalid, or because the certificate chain is invalid.
There’s a host header mismatch in the SSL negotiation between your CloudFront distribution and the custom origin.
The custom origin isn’t responding on the ports specified in the origin settings of the CloudFront distribution.
The custom origin is ending the connection to CloudFront too quickly.
https://aws.amazon.com/premiumsupport/knowledge-center/resolve-cloudfront-connection-error/
Question #314
A SysOps administrator is unable to launch Amazon EC2 instances into a VPC because there are no available private IPv4 addresses in the VPC.
Which combination of actions must the SysOps administrator take to launch the instances? (Select TWO.)
- A . Associate a secondary IPv4 CIDR block with the VPC
- B . Associate a primary IPv6 CIDR block with the VPC
- C . Create a new subnet for the VPC
- D . Modify the CIDR block of the VPC
- E . Modify the CIDR block of the subnet that is associated with the instances
Correct Answer: A, C
A, C
Explanation:
To launch EC2 instances when there are no available private IPv4 addresses in the VPC, the SysOps administrator should associate a secondary IPv4 CIDR block with the VPC and create a new subnet for the VPC.
Associate a Secondary IPv4 CIDR Block:
Open the VPC console.
Select the VPC and choose "Actions" -> "Edit CIDRs."
Add a secondary IPv4 CIDR block to increase the number of available IP addresses.
Create a New Subnet:
After adding the secondary CIDR block, create a new subnet within this CIDR block.
This new subnet will provide additional private IP addresses for launching new EC2 instances.
Reference: Associating a CIDR Block with Your VPC
Creating a Subnet
A, C
Explanation:
To launch EC2 instances when there are no available private IPv4 addresses in the VPC, the SysOps administrator should associate a secondary IPv4 CIDR block with the VPC and create a new subnet for the VPC.
Associate a Secondary IPv4 CIDR Block:
Open the VPC console.
Select the VPC and choose "Actions" -> "Edit CIDRs."
Add a secondary IPv4 CIDR block to increase the number of available IP addresses.
Create a New Subnet:
After adding the secondary CIDR block, create a new subnet within this CIDR block.
This new subnet will provide additional private IP addresses for launching new EC2 instances.
Reference: Associating a CIDR Block with Your VPC
Creating a Subnet
Question #315
A SysOps administrator uses AWS Systems Manager Session Manager to connect to instances After the SysOps administrator launches a new Amazon EC2 instance the EC2 instance does not appear in the Session Manager list of systems that are available for connection. The SysOps administrator verities that Systems Manager Agent is installed updated and running on the EC2 instance
What is the reason for this issue?
- A . The SysOps administrator does not have access to the key pair that is required for connection
- B . The SysOps administrator has not attached a security group to the EC2 instance to allow SSH on port 22.
- C . The EC2 instance does not have an attached IAM role that allows Session Manager to connect to the EC2 instance.
- D . The EC2 instance ID has not been entered into the Session Manager configuration
Correct Answer: C
C
Explanation:
If an EC2 instance does not appear in the Systems Manager Session Manager list, it is likely because the instance does not have an attached IAM role that allows Session Manager to connect.
Attach IAM Role with Necessary Permissions:
Ensure the EC2 instance has an IAM role attached with the AmazonSSMManagedInstanceCore policy.
Steps to Attach IAM Role:
Open the EC2 console, select the instance, and choose "Actions" -> "Instance Settings" -> "Attach/Replace IAM Role."
Select or create an IAM role with the necessary permissions for Session Manager.
Permissions for Session Manager:
The AmazonSSMManagedInstanceCore policy provides the required permissions for the Systems Manager agent to interact with the Systems Manager service.
Reference: Session Manager Prerequisites
Attach an IAM Role to an Instance
C
Explanation:
If an EC2 instance does not appear in the Systems Manager Session Manager list, it is likely because the instance does not have an attached IAM role that allows Session Manager to connect.
Attach IAM Role with Necessary Permissions:
Ensure the EC2 instance has an IAM role attached with the AmazonSSMManagedInstanceCore policy.
Steps to Attach IAM Role:
Open the EC2 console, select the instance, and choose "Actions" -> "Instance Settings" -> "Attach/Replace IAM Role."
Select or create an IAM role with the necessary permissions for Session Manager.
Permissions for Session Manager:
The AmazonSSMManagedInstanceCore policy provides the required permissions for the Systems Manager agent to interact with the Systems Manager service.
Reference: Session Manager Prerequisites
Attach an IAM Role to an Instance
Question #316
A SysOps administrator is re-architecting an application. The SysOps administrator has moved the database from a public subnet, where the database used a public endpoint. into a private subnet to restrict access from the public network. After this change, an AWS Lambda function that requires read access to the database cannot connect to the database. The SysOps administrator must resolve this issue without compromising security.
Which solution meets these requirements?
- A . Create an AWS PrivateLink interface endpoint for the Lambda function. Connect to the database using its private endpoint.
- B . Connect the Lambda function to the database VPC. Connect to the database using its private endpoint.
- C . Attach an 1AM role to the Lambda function with read permissions to the database.
- D . Move the database to a public subnet. Use security groups for secure access.
Correct Answer: B
B
Explanation:
To resolve the issue of an AWS Lambda function unable to connect to a database that has been moved to a private subnet, the Lambda function needs to be connected to the same VPC as the database. This is done by configuring the Lambda function with VPC access. This involves specifying the VPC, subnets, and security groups for the Lambda function so that it can communicate with the database using its private endpoint. Option B is correct as it directly addresses the issue without compromising security. AWS documentation on configuring VPC access for Lambda provides guidance on this setup Configuring VPC Access for Lambda.
B
Explanation:
To resolve the issue of an AWS Lambda function unable to connect to a database that has been moved to a private subnet, the Lambda function needs to be connected to the same VPC as the database. This is done by configuring the Lambda function with VPC access. This involves specifying the VPC, subnets, and security groups for the Lambda function so that it can communicate with the database using its private endpoint. Option B is correct as it directly addresses the issue without compromising security. AWS documentation on configuring VPC access for Lambda provides guidance on this setup Configuring VPC Access for Lambda.
Question #317
A company uses an Amazon S3 bucket to store data files. The S3 bucket contains hundreds of objects.
The company needs to replace a tag on all the objects in the S3 bucket with another tag.
What is the MOST operationally efficient way to meet this requirement?
- A . Use S3 Batch Operations. Specify the operation to replace all object tags.
- B . Use the AWS CLI to get the tags for each object. Save the tags in a list. Use S3 Batch Operations.
Specify the operation to delete all object tags. Use the AWS CLI and the list to retag the objects. - C . Use the AWS CLI to get the tags for each object. Save the tags in a list. Use the AWS CLI and the list to remove the object tags. Use the AWS CLI and the list to retag the objects.
- D . Use the AWS CLI to copy the objects to another S3 bucket. Add the new tag to the copied objects.
Delete the original objects.
Correct Answer: A
A
Explanation:
Ref. https://aws.amazon.com/es/blogs/storage/adding-and-removing-object-tags-with-s3-batch-operations/
Amazon S3 Batch Operations is a feature that lets you perform large-scale batch operations on S3 objects. It is the most operationally efficient way to replace a tag on all objects in an S3 bucket.
Create an S3 Batch Operations Job:
Open the Amazon S3 console at Amazon S3 Console.
Navigate to Batch Operations and create a new job.
Specify the Operation:
Choose the operation to replace all object tags.
Provide a manifest that lists the objects in the bucket. You can generate this manifest using an S3 inventory report.
Execute the Job:
Review the job configuration and submit it.
Monitor the job execution to ensure all tags are replaced as specified.
Using S3 Batch Operations automates the process and minimizes manual effort.
Reference: Amazon S3 Batch Operations
Tagging Amazon S3 Objects
A
Explanation:
Ref. https://aws.amazon.com/es/blogs/storage/adding-and-removing-object-tags-with-s3-batch-operations/
Amazon S3 Batch Operations is a feature that lets you perform large-scale batch operations on S3 objects. It is the most operationally efficient way to replace a tag on all objects in an S3 bucket.
Create an S3 Batch Operations Job:
Open the Amazon S3 console at Amazon S3 Console.
Navigate to Batch Operations and create a new job.
Specify the Operation:
Choose the operation to replace all object tags.
Provide a manifest that lists the objects in the bucket. You can generate this manifest using an S3 inventory report.
Execute the Job:
Review the job configuration and submit it.
Monitor the job execution to ensure all tags are replaced as specified.
Using S3 Batch Operations automates the process and minimizes manual effort.
Reference: Amazon S3 Batch Operations
Tagging Amazon S3 Objects
Question #318
A SysOps administrator is responsible for a company’s security groups. The company wants to maintain a documented trail of any changes that are made to the security groups. The SysOps administrator must receive notification whenever the security groups change.
Which solution will meet these requirements?
- A . Set up Amazon Detective to record security group changes. Specify an Amazon CloudWatch Logs log group to store configuration history logs. Create an Amazon Simple Queue Service (Amazon SOS) queue for notifications about configuration changes. Subscribe the SysOps administrator’s email address to the SQS queue.
- B . Set up AWS Systems Manager Change Manager to record security group changes. Specify an Amazon CloudWatch Logs log group to store configuration history logs. Create an Amazon Simple Notification Service (Amazon SNS) topic for notifications about configuration changes. Subscribe the SysOps administrator’s email address to the SNS topic.
- C . Set up AWS Config to record security group changes. Specify an Amazon S3 bucket as the location for configuration snapshots and history files. Create an Amazon Simple Notification Service (Amazon SNS) topic for notifications about configuration changes. Subscribe the SysOps administrator’s email address to the SNS topic.
- D . Set up Amazon Detective to record security group changes. Specify an Amazon S3 bucket as the location for configuration snapshots and history files. Create an Amazon Simple Notification Service (Amazon SNS) topic for notifications about configuration changes. Subscribe the SysOps administrator’s email address to the SNS topic.
Correct Answer: C
C
Explanation:
To maintain a documented trail of any changes made to the security groups and receive notifications, AWS Config is the best solution.
AWS Config:
AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.
You can set up AWS Config to record changes to your security groups.
Setting Up AWS Config:
Open the AWS Config console and choose "Set up AWS Config."
Select the resource types you want to record (in this case, security groups).
Specify an Amazon S3 bucket to store configuration snapshots and history files.
Notifications:
Create an Amazon SNS topic for notifications about configuration changes. Subscribe the SysOps administrator’s email address to the SNS topic.
Reference: AWS Config
Setting Up AWS Config
C
Explanation:
To maintain a documented trail of any changes made to the security groups and receive notifications, AWS Config is the best solution.
AWS Config:
AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.
You can set up AWS Config to record changes to your security groups.
Setting Up AWS Config:
Open the AWS Config console and choose "Set up AWS Config."
Select the resource types you want to record (in this case, security groups).
Specify an Amazon S3 bucket to store configuration snapshots and history files.
Notifications:
Create an Amazon SNS topic for notifications about configuration changes. Subscribe the SysOps administrator’s email address to the SNS topic.
Reference: AWS Config
Setting Up AWS Config
Question #319
A company is rolling out a new version of its website. Management wants to deploy the new website in a limited rollout to 20% of the company’s customers. The company uses Amazon Route 53 for its website’s DNS solution.
Which configuration will meet these requirements?
- A . Create a failover routing policy. Within the policy, configure 80% of the website traffic to be sent to the original resource. Configure the remaining 20% of traffic as the failover record that points to the
new resource. - B . Create a multivalue answer routing policy. Within the policy, create 4 records with the name and IP address of the original resource. Configure 1 record with the name and IP address of the new resource.
- C . Create a latency-based routing policy. Within the policy, configure a record pointing to the original resource with a weight of 80. Configure a record pointing to the new resource with a weight of 20.
- D . Create a weighted routing policy. Within the policy, configure a weight of 80 for the record pointing to the original resource. Configure a weight of 20 for the record pointing to the new resource.
Correct Answer: D
D
Explanation:
To achieve a limited rollout of the new website to 20% of the company’s customers using Amazon Route 53, a weighted routing policy is the most appropriate solution.
Weighted Routing Policy:
Weighted routing lets you associate multiple resources with a single domain name and choose how much traffic is routed to each resource.
Configuration:
Open the Route 53 console.
Select the hosted zone and choose "Create Record Set."
Create two records for your domain:
One record for the original resource with a weight of 80.
Another record for the new resource with a weight of 20.
Reference: Amazon Route 53 Weighted Routing
D
Explanation:
To achieve a limited rollout of the new website to 20% of the company’s customers using Amazon Route 53, a weighted routing policy is the most appropriate solution.
Weighted Routing Policy:
Weighted routing lets you associate multiple resources with a single domain name and choose how much traffic is routed to each resource.
Configuration:
Open the Route 53 console.
Select the hosted zone and choose "Create Record Set."
Create two records for your domain:
One record for the original resource with a weight of 80.
Another record for the new resource with a weight of 20.
Reference: Amazon Route 53 Weighted Routing
Question #320
An organization created an Amazon Elastic File System (Amazon EFS) volume with a file system ID of fs-85ba4Kc. and it is actively used by 10 Amazon EC2 hosts. The organization has become concerned that the file system is not encrypted
How can this be resolved?
- A . Enable encryption on each host’s connection to the Amazon EFS volume Each connection must be recreated for encryption to take effect
- B . Enable encryption on the existing EFS volume by using the AWS Command Line Interface
- C . Enable encryption on each host’s local drive Restart each host to encrypt the drive
- D . Enable encryption on a newly created volume and copy all data from the original volume Reconnect each host to the new volume
Correct Answer: D
D
Explanation:
https://docs.aws.amazon.com/efs/latest/ug/encryption.html
Amazon EFS supports two forms of encryption for file systems, encryption of data in transit and encryption at rest. You can enable encryption of data at rest when creating an Amazon EFS file system. You can enable encryption of data in transit when you mount the file system.
D
Explanation:
https://docs.aws.amazon.com/efs/latest/ug/encryption.html
Amazon EFS supports two forms of encryption for file systems, encryption of data in transit and encryption at rest. You can enable encryption of data at rest when creating an Amazon EFS file system. You can enable encryption of data in transit when you mount the file system.