Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
A company has 50 AWS accounts and wants to create an identical Amazon VPC in each account. Any changes the company makes to the VPCs in the future must be implemented on every VPC.
What is the MOST operationally efficient method to deploy and update the VPCs in each account?
- A . Create an AWS Cloud Formation template that defines the VPC. Sign in to the AWS Management Console under each account. Create a stack from the template.
- B . Create a shell script that configures the VPC using the AWS CLI. Provide a list of accounts to the shell script from a text file. Create the VPC in every account in the list.
- C . Create an AWS Lambda function that configures the VPC. Store the account information in Amazon DynamoDB. Grant Lambda access to the DynamoDB table. Create the VPC in every account in the list.
- D . Create an AWS Cloud Formation template that defines the VPC. Create an AWS CloudFormation StackSet based on the template. Deploy the template to all accounts using the stack set.
D
Explanation:
To deploy and manage an identical Amazon VPC configuration across multiple AWS accounts efficiently:
AWS CloudFormation Template: Create a CloudFormation template that defines the VPC configuration. This template should include all necessary resources like subnets, route tables, internet gateways, etc.
Use CloudFormation StackSets: Utilize AWS CloudFormation StackSets to manage the deployment of the VPC template across the 50 AWS accounts. StackSets allow you to specify management and target accounts, automate deployments, and ensure consistency across all accounts.
Updating VPCs: When updates are required, modify the CloudFormation template and update the stack set. This will automatically apply the changes to all VPCs in the target accounts, ensuring uniformity and reducing operational overhead.
This method provides a centralized, consistent, and scalable way to manage resources across multiple AWS accounts, greatly simplifying the administration and ensuring compliance with organizational standards.
A company uses AWS Cloud Formation to deploy its infrastructure. The company recently retired an application. A cloud operations engineer initiates CloudFormation stack deletion, and the stack gets stuck in DELETE FAILED status.
A SysOps administrator discovers that the stack had deployed a security group. The security group is referenced by other security groups in the environment. The SysOps administrator needs to delete the stack without affecting other applications.
Which solution will meet these requirements m the MOST operationally efficient manner?
- A . Create a new security group that has a different name Apply identical rules to the new security group. Replace all other security groups that reference the new security group. Delete the stack.
- B . Create a CloudFormation change set to delete the security group. Deploy the change set.
- C . Delete the stack again. Specify that the security group be retained.
- D . Perform CloudFormation drift detection Delete the stack.
C
Explanation:
Retain the Security Group:
When deleting a CloudFormation stack, you can specify resources to be retained instead of deleted.
Steps:
Go to the AWS Management Console.
Navigate to CloudFormation and select the stack.
Choose to delete the stack.
In the deletion options, specify that the security group should be retained.
This will delete the stack but keep the security group, ensuring no impact on other applications.
Reference: Deleting a Stack
A SysOps administrator must set up notifications for whenever combined billing exceeds a certain threshold for all AWS accounts within a company. The administrator has set up AWS Organizations and enabled Consolidated Billing.
Which additional steps must the administrator perform to set up the billing alerts?
- A . In the payer account: Enable billing alerts in the Billing and Cost Management console; publish an Amazon SNS message when the billing alert triggers.
- B . In each account: Enable billing alerts in the Billing and Cost Management console; set up a billing
alarm in Amazon CloudWatch; publish an SNS message when the alarm triggers. - C . In the payer account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in the Billing and Cost Management console to publish an SNS message when the alarm triggers.
- D . In the payer account: Enable billing alerts in the Billing and Cost Management console; set up a billing alarm in Amazon CloudWatch; publish an SNS message when the alarm triggers.
D
Explanation:
To set up notifications for when combined billing exceeds a certain threshold for all AWS accounts within an organization, follow these steps:
Enable Billing Alerts:
In the payer account, go to the Billing and Cost Management console. Under "Billing preferences", enable the "Receive Billing Alerts" option. Set Up a Billing Alarm in CloudWatch: Navigate to the CloudWatch console.
Create a new billing alarm, specifying the threshold for the combined billing amount.
Set the alarm to publish a notification to an SNS topic when the threshold is breached.
Publish SNS Message:
Create an SNS topic to receive the billing alarm notifications. Configure the billing alarm to send notifications to the SNS topic.
Reference: Setting Up a CloudWatch Billing Alarm
AWS Billing and Cost Management User Guide
A SysOps Administrator is managing a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group. The administrator wants to set an alarm for when all target instances associated with the ALB are unhealthy.
Which condition should be used with the alarm?
- A . AWS/ApplicationELB HealthyHostCount <= 0
- B . AWS/ApplicationELB UnhealthyHostCount >= 1
- C . AWS/EC2 StatusCheckFailed <= 0
- D . AWS/EC2 StatusCheckFailed >= 1
A
Explanation:
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html
A SysOps Administrator is managing a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group. The administrator wants to set an alarm for when all target instances associated with the ALB are unhealthy.
Which condition should be used with the alarm?
- A . AWS/ApplicationELB HealthyHostCount <= 0
- B . AWS/ApplicationELB UnhealthyHostCount >= 1
- C . AWS/EC2 StatusCheckFailed <= 0
- D . AWS/EC2 StatusCheckFailed >= 1
A
Explanation:
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html
Using the output from the stack, enter the value of the Prodlnstanceld in the text box below:
Log in to the AWS Management Console and navigate to the CloudFormation service in the us-east-2 Region.
Find the existing stack named 1700182 and click on it.
Click on the "Update" button.
Choose "Replace current template" and upload the updated CloudFormation template from the Amazon S3 bucket named "cloudformation-bucket"
In the "Parameter" section, update the EC2 instance type to us-east-t2.nano and add the IP address range 192.168.100.0/30 for SSH access.
Replace the instance profile IAM role with IamRoleB.
In the "Capabilities" section, check the checkbox for "IAM Resources"
Choose the role CFServiceR01e and click on "Update Stack"
Wait for the stack to be updated.
Once the update is complete, navigate to the stack and click on the "Stack options" button, and select "Prevent updates to prevent accidental deletion"
To get the value of the Prodlnstanceld , navigate to the "Outputs" tab in the CloudFormation stack
and find the key "Prodlnstanceld". The value corresponding to it is the value that you need to enter in the text box below.
Note:
You can use AWS CloudFormation to update an existing stack.
You can use the AWS CloudFormation service role to deploy updates.
You can refer to the AWS CloudFormation documentation for more information on how to update and manage stacks: https://aws.amazon.com/cloudformation/
A SysOps administrator is maintaining a web application using an Amazon CloudFront web distribution, an Application Load Balancer (ALB), Amazon RDS, and
Amazon EC2 in a VPC. All services have logging enabled. The administrator needs to investigate HTTP Layer 7 status codes from the web application.
Which log sources contain the status codes? (Choose two.)
- A . VPC Flow Logs
- B . AWS CloudTrail logs
- C . ALB access logs
- D . CloudFront access logs
- E . RDS logs
CD
Explanation:
"C" because Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
"D" because "you can configure CloudFront to create log files that contain detailed information about every user request that CloudFront receives"
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
A company uses Amazon S3 to aggregate raw video footage from various media teams across the US. The company recently expanded into new geographies in Europe and Australia. The technical teams located in Europe and Australia reported delays when uploading large video tiles into the destination S3 bucket m toe United States.
What are the MOST cost-effective ways to increase upload speeds into the S3 bucket? (Select TWO.)
- A . Create multiple AWS Direct Connect connections between AWS and branch offices in Europe and Australia tor He uploads into the destination S3 bucket
- B . Create multiple AWS Site-to-Site VPN connections between AWS and branch offices in Europe and Australia for file uploads into the destination S3 bucket.
- C . Use Amazon S3 Transfer Acceleration for file uploads into the destination S3 bucket.
- D . Use AWS Global Accelerator for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.
- E . Use multipart uploads for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.
C, E
Explanation:
To increase upload speeds into the S3 bucket from Europe and Australia, the SysOps administrator should use Amazon S3 Transfer Acceleration and multipart uploads. These methods are cost-effective and efficient.
Amazon S3 Transfer Acceleration:
This feature speeds up uploads by using the globally distributed edge locations of Amazon CloudFront. Data is routed to the closest edge location, which then forwards the data to the S3 bucket in the destination region.
This reduces latency and increases the upload speed for large files.
Multipart Uploads:
Multipart upload allows you to upload a single large object as a set of parts. Each part is independently uploaded and can be uploaded in parallel.
This method improves the upload efficiency and resiliency, especially for large files.
Configuration Steps:
Enable Transfer Acceleration on the S3 bucket through the AWS Management Console or AWS CLI. Implement multipart upload in the application or scripts used for uploading files.
Reference: Amazon S3 Transfer Acceleration
Multipart Upload Overview
A company’s application currently uses an IAM role that allows all access to all AWS services. A SysOps administrator must ensure that the company’s IAM policies allow only the permissions that the application requires.
How can the SysOps administrator create a policy to meet this requirement?
- A . Turn on AWS CloudTrail. Generate a policy by using AWS Security Hub.
- B . Turn on Amazon EventBridge (Amazon CloudWatch Events). Generate a policy by using AWS Identity and Access Management Access Analyzer.
- C . Use the AWS CLI to run the get-generated-policy command in AWS Identity and Access Management Access Analyzer.
- D . Turn on AWS CloudTrail. Generate a policy by using AWS Identity and Access Management Access Analyzer.
D
Explanation:
Generate a policy by using AWS Identity and Access Management Access Analyzer. AWS CloudTrail is a service that records all API calls made on your account. You can use this data to generate a policy with AWS Identity and Access Management Access Analyzer that only allows the permissions that the application requires. This will ensure that the application only has the necessary permissions and will protect the company from any unauthorized access.
https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html#what-is-access-analyzer-policy-generation
A company hosts its website on Amazon EC2 instances behind an Application Load Balancer. The company manages its DNS with Amazon Route 53. and wants to point its domain’s zone apex to the website.
Which type of record should be used to meet these requirements?
- A . A CNAME record for the domain’s zone apex
- B . An A record for the domain’s zone apex
- C . An AAAA record for the domain’s zone apex
- D . An alias record for the domain’s zone apex
D
Explanation:
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer.html