Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
A company’s SysOps administrator maintains a highly available environment. The environment includes Amazon EC2 instances and an Amazon RDS Multi-AZ database. The EC2 instances are in an Auto Scaling group behind an Application Load Balancer.
Recently, the company conducted a failover test. The SysOps administrator needs to decrease the failover time of the RDS database by at least 10%.
Which solution will meet this requirement?
- A . Increase the RDS instance size.
- B . Modify the RDS cluster to run in a single Availability Zone.
- C . Create a read replica in another AWS Region. Promote the read replica in case of failure.
- D . Create an RDS proxy. Point the application to the proxy endpoint.
A
Explanation:
https://aws.amazon.com/blogs/database/improving-application-availability-with-amazon-rds-proxy/
A company must ensure that any objects uploaded to an S3 bucket are encrypted.
Which of the following actions will meet this requirement? (Choose two.)
- A . Implement AWS Shield to protect against unencrypted objects stored in S3 buckets.
- B . Implement Object access control list (ACL) to deny unencrypted objects from being uploaded to the S3 bucket.
- C . Implement Amazon S3 default encryption to make sure that any object being uploaded is encrypted before it is stored.
- D . Implement Amazon Inspector to inspect objects uploaded to the S3 bucket to make sure that they are encrypted.
- E . Implement S3 bucket policies to deny unencrypted objects from being uploaded to the buckets.
CE
Explanation:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html
You can set the default encryption behavior on an Amazon S3 bucket so that all objects are encrypted when they are stored in the bucket. The objects are encrypted using server-side encryption with either Amazon S3-managed keys (SSE-S3) or AWS Key Management Service (AWS KMS) customer master keys (CMKs).
https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/
How to Prevent Uploads of Unencrypted Objects to Amazon S3#
By using an S3 bucket policy, you can enforce the encryption requirement when users upload objects, instead of assigning a restrictive IAM policy to all users.
A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company’s risk team must receive immediate notification about any delete events.
Which solution will meet these requirements?
- A . Enable S3 server access logging for audit logs. Set up an Amazon Simple Notification Service (Amazon SNSJ notification for the S3 bucket. Select DeleteObject tor the event type for the alert system.
- B . Enable S3 server access logging for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance to download the access logs each day and to scan for a DeleteObject event.
- C . Use Amazon CloudWatch Logs for audit logs. Use Amazon CloudWatch alarms with an Amazon Simple Notification Service (Amazon SNS) notification for the alert system.
- D . Use Amazon CloudWatch Logs for audit logs. Launch an Amazon EC2 instance for The alert system. Run a cron job on the EC2 Instance each day to compare the list of the items with the list from the previous day. Configure the cron job to send a notification if an item is missing.
A
Explanation:
To meet the requirements of logging all access attempts to the S3 bucket and receiving immediate notification about any delete events, the company can enable S3 server access logging and set up an Amazon Simple Notification Service (Amazon SNS) notification for the S3 bucket. The S3 server access logs will record all access attempts to the bucket, including delete events, and the SNS notification can be configured to send an alert when a DeleteObject event occurs.
An application accesses data through a file system interface. The application runs on Amazon EC2 instances in multiple Availability Zones, all of which must share the same data. While the amount of data is currently small, the company anticipates that it will grow to tens of terabytes over the lifetime of the application.
What is the MOST scalable storage solution to fulfill this requirement?
- A . Connect a large Amazon EBS volume to multiple instances and schedule snapshots.
- B . Deploy Amazon EFS in the VPC and create mount targets in multiple subnets.
- C . Launch an EC2 instance and share data using SMB/CIFS or NFS.
- D . Deploy an AWS Storage Gateway cached volume on Amazon EC2.
B
Explanation:
To fulfill the requirement of sharing the same data across multiple EC2 instances in multiple Availability Zones with scalability, the most appropriate solution is Amazon Elastic File System (EFS).
Deploy Amazon EFS:
Amazon EFS provides a scalable and fully managed NFS file system for use with AWS Cloud services and on-premises resources.
It is designed to grow and shrink automatically as you add and remove files, so your applications have the storage they need, when they need it.
Create Mount Targets:
Go to the EFS console and create a new file system.
Create mount targets in each subnet within your VPC across the multiple Availability Zones.
Attach the EFS file system to your EC2 instances by mounting the EFS file system using the mount target IP addresses or DNS names.
Scalability:
EFS can scale to petabytes without the need to provision storage in advance.
It provides high availability and durability, automatically replicating data across multiple Availability Zones.
Reference: Amazon EFS Documentation
Creating EFS File Systems
A company is running an application on premises and wants to use AWS for data backup All of the data must be available locally. The backup application can write only to block-based storage that is compatible with the Portable Operating System Interface (POSIX)
Which backup solution will meet these requirements?
- A . Configure the backup software to use Amazon S3 as the target for the data backups
- B . Configure the backup software to use Amazon S3 Glacier as the target for the data backups
- C . Use AWS Storage Gateway, and configure it to use gateway-cached volumes
- D . Use AWS Storage Gateway, and configure it to use gateway-stored volumes
D
Explanation:
AWS Storage Gateway provides a hybrid cloud storage service that enables on-premises applications to seamlessly use AWS cloud storage. The gateway-stored volumes configuration is suitable for scenarios where all data must be available locally and the backup application can write only to block-based storage that is POSIX-compliant.
Deploy AWS Storage Gateway:
Launch the AWS Storage Gateway service from the AWS Management Console. Download and deploy the Storage Gateway VM on your on-premises infrastructure.
Activate the Gateway:
Activate the Storage Gateway by connecting it to your AWS account. Follow the setup wizard to complete the activation process. Configure Gateway-Stored Volumes:
Create a gateway-stored volume where the primary data is stored locally, and an asynchronous copy is stored in AWS.
Specify the size of the volume and configure it to match your backup application’s requirements.
Connect the Backup Application:
Present the created volume to your on-premises backup application as an iSCSI target.
Configure the backup application to write data to the iSCSI target provided by the Storage Gateway.
Monitor and Manage:
Use the AWS Management Console to monitor the gateway and the volumes.
Ensure that the data is being backed up to AWS correctly and that local copies are maintained as required.
Reference: AWS Storage Gateway User Guide
Gateway-Stored Volumes
The company needs to increase IOPS for two EC2 instances with gp2 volumes to support an upcoming promotion with higher I/O requirements.
- A . Migrate the attached EBS volumes to Throughput Optimized HDD (st1) EBS volumes.
- B . Configure Amazon ElastiCache integration on the EC2 instances.
- C . Migrate the workload to two storage optimized EC2 instances.
- D . Migrate the attached EBS volumes to General Purpose SSD (gp3) EBS volumes. Provision the appropriate IOPS.
D
Explanation:
Migrating to gp3 volumes allows for customizable IOPS at a lower cost than gp2, meeting the requirement for higher IOPS during the promotion. Throughput Optimized HDD (st1) volumes do not support high IOPS, and ElastiCache does not address I/O for EBS volumes.
A company runs us Infrastructure on Amazon EC2 Instances that run In an Auto Scaling group. Recently, the company promoted faulty code to the entire EC2 fleet. This faulty code caused the Auto Scaling group to scale the instances before any of the application logs could be retrieved.
What should a SysOps administrator do to retain the application logs after instances are terminated?
- A . Configure an Auto Scaling lifecycle hook to create a snapshot of the ephemeral storage upon termination of the instances.
- B . Create a new Amazon Machine Image (AMI) that has the Amazon CloudWatch agent installed and configured to send logs to Amazon CloudWatch Logs. Update the launch template to use the new AMI.
- C . Create a new Amazon Machine Image (AMI) that has a custom script configured to send logs to AWS CloudTrail. Update the launch template to use the new AMI.
- D . Install the Amazon CloudWatch agent on the Amazon Machine Image (AMI) that is defined in the launch template. Configure the CloudWatch agent to back up the logs to ephemeral storage.
B
Explanation:
To retain application logs after instances are terminated, configure the EC2 instances to send logs to Amazon CloudWatch Logs.
Steps:
Create a New AMI:
Create a new AMI that includes the Amazon CloudWatch agent.
Install and configure the CloudWatch agent to send logs to CloudWatch Logs.
Reference: Installing the CloudWatch Agent
Update the Launch Template:
Update the Auto Scaling group’s launch template or launch configuration to use the new AMI.
Reference: Launch Templates
Configure Log Group and Retention:
Ensure that the CloudWatch Logs group is properly configured with the desired retention policies.
Reference: CloudWatch Logs Retention
Test the Configuration:
Test the setup to ensure logs are properly being sent to CloudWatch Logs upon instance termination.
Reference: Using CloudWatch Logs
A company has a cluster of Linux Amazon EC2 Spot Instances that read many files from and write many files to attached Amazon Elastic Block Store (Amazon EBS) volumes. The EC2 instances are frequently started and stopped. As part of the process when an EC2 instance starts, an EBS volume is restored from a snapshot.
EBS volumes that are restored from snapshots are experiencing initial performance that is lower than expected. The company’s workload needs almost all the provisioned IOPS on the attached EBS volumes. The EC2 instances are unable to support the workload when the performance of the EBS volumes is too low. A SysOps administrator must implement a solution to ensure that the EBS volumes provide the expected performance when they are restored from snapshots.
Which solution will meet these requirements?
- A . Configure fast snapshot restore (FSR) on the snapshots that are used.
- B . Restore each snapshot onto an unencrypted EBS volume. Encrypt the EBS volume when the performance stabilizes.
- C . Format the EBS volumes as XFS file systems before restoring the snapshots.
- D . Increase the Linux read-ahead buffer to 1 MiB.
A
Explanation:
For EBS volumes restored from snapshots to immediately achieve the required IOPS performance,
Fast Snapshot Restore (FSR) can be utilized:
Enable FSR: Fast Snapshot Restore can be enabled on specific snapshots. This feature pre-warms the EBS volume created from a snapshot to its full performance level immediately after it is provisioned.
Operational Impact: By enabling FSR, any EBS volume created from these enabled snapshots will provide the provisioned IOPS performance right from the start, eliminating the performance lag that typically occurs as the data is lazily loaded from S3.
Cost Considerations: While FSR increases costs due to the pre-warming of data, it is justified by the need for immediate high performance, especially in environments where EBS volume responsiveness is critical to application performance.
This solution directly addresses the challenge of initial performance degradation and ensures that the EBS volumes can handle the required workload immediately upon restoration from a snapshot.
A global gaming company is preparing to launch a new game on AWS. The game runs in multiple AWS Regions on a fleet of Amazon EC2 instances. The instances are in an Auto Scaling group behind an Application Load Balancer (ALB) in each Region. The company plans to use Amazon Route 53 tor
DNS services. The DNS configuration must direct users to the Region that is closest to mem and must provide automated failover.
Which combination of steps should a SysOps administrator take to configure Route 53 to meet these requirements9 {Select TWO.)
- A . Create Amazon CloudWatch alarms that monitor the health of the ALB m each Region Configure Route 53 DNS failover by using a health check that monitors the alarms.
- B . Create Amazon CloudWatch alarms that monitor the hearth of the EC2 instances in each Region.
Configure Route 53 DNS failover by using a health check that monitors the alarms. - C . Configure Route 53 DNS failover by using a health check that monitors the private
address of an EC2 instance in each Region. - D . Configure Route 53 geoproximity routing Specify the Regions that are used for the infrastructure
- E . Configure Route 53 simple routing Specify the continent, country, and state or province that are used for the infrastructure.
A D
Explanation:
To meet the requirement of directing users to the Region closest to them and providing automated failover, the SysOps administrator should perform the following steps:
Create Amazon CloudWatch Alarms:
Create CloudWatch alarms that monitor the health of the ALB in each Region. This ensures that the system can detect unhealthy endpoints and trigger the failover mechanism.
Reference: Creating Amazon CloudWatch Alarms
Configure Route 53 DNS Failover:
Use Route 53’s health check to monitor the CloudWatch alarms created in the previous step. This setup ensures that if an ALB is unhealthy in a Region, Route 53 will failover to another healthy Region.
Reference: Route 53 Health Checks and DNS Failover
Configure Route 53 Geoproximity Routing:
Configure Route 53 geoproximity routing to direct traffic to the Region that is closest to the users. This routing policy is ideal for directing traffic based on the geographic location of the users and can be adjusted to redirect traffic to other Regions as needed.
Reference: Geoproximity Routing
A company has 50 AWS accounts and wants to create an identical Amazon VPC in each account. Any changes the company makes to the VPCs in the future must be implemented on every VPC.
What is the MOST operationally efficient method to deploy and update the VPCs in each account?
- A . Create an AWS Cloud Formation template that defines the VPC. Sign in to the AWS Management Console under each account. Create a stack from the template.
- B . Create a shell script that configures the VPC using the AWS CLI. Provide a list of accounts to the shell script from a text file. Create the VPC in every account in the list.
- C . Create an AWS Lambda function that configures the VPC. Store the account information in Amazon DynamoDB. Grant Lambda access to the DynamoDB table. Create the VPC in every account in the list.
- D . Create an AWS Cloud Formation template that defines the VPC. Create an AWS CloudFormation StackSet based on the template. Deploy the template to all accounts using the stack set.
D
Explanation:
To deploy and manage an identical Amazon VPC configuration across multiple AWS accounts efficiently:
AWS CloudFormation Template: Create a CloudFormation template that defines the VPC configuration. This template should include all necessary resources like subnets, route tables, internet gateways, etc.
Use CloudFormation StackSets: Utilize AWS CloudFormation StackSets to manage the deployment of the VPC template across the 50 AWS accounts. StackSets allow you to specify management and target accounts, automate deployments, and ensure consistency across all accounts.
Updating VPCs: When updates are required, modify the CloudFormation template and update the stack set. This will automatically apply the changes to all VPCs in the target accounts, ensuring uniformity and reducing operational overhead.
This method provides a centralized, consistent, and scalable way to manage resources across multiple AWS accounts, greatly simplifying the administration and ensuring compliance with organizational standards.