Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
Question #351
A SysOps administrator is creating two AWS CloudFormation templates. The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway. The second template will deploy application resources within the VPC that was created by the first template. The second template should refer to the resources created by the first template.
How can this be accomplished with the LEAST amount of administrative effort?
- A . Add an export field to the outputs of the first template and import the values in the second template.
- B . Create a custom resource that queries the stack created by the first template and retrieves the required values.
- C . Create a mapping in the first template that is referenced by the second template.
- D . Input the names of resources in the first template and refer to those names in the second template as a parameter.
Correct Answer: A
A
Explanation:
To refer to resources created by the first CloudFormation template in the second template with minimal administrative effort, using the export and import functionality is the most efficient approach.
Exporting Outputs in the First Template:
In the first CloudFormation template, add an Outputs section to export the required values.
Use the Export field to specify the name of the exported value.
Example:
Outputs:
VPCID:
Description: The VPC ID
Value: !Ref MyVPC
Export:
Name: VPCID
Importing Values in the Second Template:
In the second CloudFormation template, use the Fn::ImportValue function to import the exported values from the first template.
Example:
Resources:
MySubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !ImportValue VPCID
Efficiency and Best Practices:
This method ensures a clean separation of resources and allows easy reference to outputs from other stacks.
It simplifies the management and deployment process by leveraging CloudFormation’s built-in export and import mechanisms.
Reference: AWS CloudFormation Exporting Stack Output Values
AWS CloudFormation Importing Values
A
Explanation:
To refer to resources created by the first CloudFormation template in the second template with minimal administrative effort, using the export and import functionality is the most efficient approach.
Exporting Outputs in the First Template:
In the first CloudFormation template, add an Outputs section to export the required values.
Use the Export field to specify the name of the exported value.
Example:
Outputs:
VPCID:
Description: The VPC ID
Value: !Ref MyVPC
Export:
Name: VPCID
Importing Values in the Second Template:
In the second CloudFormation template, use the Fn::ImportValue function to import the exported values from the first template.
Example:
Resources:
MySubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !ImportValue VPCID
Efficiency and Best Practices:
This method ensures a clean separation of resources and allows easy reference to outputs from other stacks.
It simplifies the management and deployment process by leveraging CloudFormation’s built-in export and import mechanisms.
Reference: AWS CloudFormation Exporting Stack Output Values
AWS CloudFormation Importing Values
Question #352
A company’s social media application has strict data residency requirements. The company wants to use Amazon Route 53 to provide the application with DNS services. A SysOps administrator must implement a solution that routes requests to a defined list of AWS Regions. The routing must be based on the user’s location.
Which solution will meet these requirements?
- A . Configure a Route 53 latency routing policy.
- B . Configure a Route 53 multivalue answer routing policy.
- C . Configure a Route 53 geolocation routing policy.
- D . Configure a Route 53 IP-based routing policy.
Correct Answer: C
C
Explanation:
For routing based on the user’s geographic location to comply with data residency requirements, the best solution is to use Amazon Route 53 geolocation routing policy. This policy allows you to configure DNS responses based on the geographic location of the user, ensuring that requests are directed to specific AWS Regions that align with the company’s data residency requirements. Option C is correct. The AWS Route 53 documentation provides details on implementing geolocation routing policies Amazon Route 53 Geolocation Routing.
C
Explanation:
For routing based on the user’s geographic location to comply with data residency requirements, the best solution is to use Amazon Route 53 geolocation routing policy. This policy allows you to configure DNS responses based on the geographic location of the user, ensuring that requests are directed to specific AWS Regions that align with the company’s data residency requirements. Option C is correct. The AWS Route 53 documentation provides details on implementing geolocation routing policies Amazon Route 53 Geolocation Routing.
Question #353
A company hosts an internal application on Amazon EC2 instances. All application data and requests route through an AWS Site-to-Site VPN connection between the on-premises network and AWS. The company must monitor the application for changes that allow network access outside of the corporate network. Any change that exposes the application externally must be restricted automatically.
Which solution meets these requirements in the MOST operationally efficient manner?
- A . Create an AWS Lambda function that updates security groups that are associated with the elastic network interface to remove inbound rules with noncorporate CIDR ranges. Turn on VPC Flow Logs, and send the logs to Amazon CloudWatch Logs. Create an Amazon CloudWatch alarm that matches traffic from noncorporate CIDR ranges, and publish a message to an Amazon Simple Notification Service (Amazon SNS) topic with the Lambda function as a target.
- B . Create a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule that targets an AWS Systems Manager Automation document to check for public IP addresses on the EC2 instances. If public IP addresses are found on the EC2 instances, initiate another Systems Manager Automation
document to terminate the instances. - C . Configure AWS Config and a custom rule to monitor whether a security group allows inbound requests from noncorporate CIDR ranges. Create an AWS Systems Manager Automation document to remove any noncorporate CIDR ranges from the application security groups.
- D . Configure AWS Config and the managed rule for monitoring public IP associations with the EC2 instances by tag. Tag the EC2 instances with an identifier. Create an AWS Systems Manager Automation document to remove the public IP association from the EC2 instances.
Correct Answer: C
C
Explanation:
CloudWatch provides metrics for EBS volumes that can be used to create alarms. The correct metrics to monitor EBS volume read and write activity are VolumeReadBytes and VolumeWriteBytes.
Identify the Correct Metrics:
VolumeReadBytes: The number of bytes read from the EBS volume.
VolumeWriteBytes: The number of bytes written to the EBS volume.
Reconfigure CloudWatch Alarms:
Navigate to the CloudWatch console.
Select the existing alarms and update the metric to VolumeReadBytes and VolumeWriteBytes for the specific EBS volumes attached to your EC2 instance.
Set the Desired Thresholds:
Configure the threshold for the alarms based on your monitoring requirements (e.g., trigger an alarm if read/write bytes exceed a certain value).
Verify Alarm Configuration:
Ensure that the alarms are correctly configured and monitoring the appropriate EBS volume metrics. Test the configuration by generating traffic to the volumes and observing the alarm state changes.
Reference: Amazon CloudWatch Metrics for Amazon EBS
Creating Amazon CloudWatch Alarms
C
Explanation:
CloudWatch provides metrics for EBS volumes that can be used to create alarms. The correct metrics to monitor EBS volume read and write activity are VolumeReadBytes and VolumeWriteBytes.
Identify the Correct Metrics:
VolumeReadBytes: The number of bytes read from the EBS volume.
VolumeWriteBytes: The number of bytes written to the EBS volume.
Reconfigure CloudWatch Alarms:
Navigate to the CloudWatch console.
Select the existing alarms and update the metric to VolumeReadBytes and VolumeWriteBytes for the specific EBS volumes attached to your EC2 instance.
Set the Desired Thresholds:
Configure the threshold for the alarms based on your monitoring requirements (e.g., trigger an alarm if read/write bytes exceed a certain value).
Verify Alarm Configuration:
Ensure that the alarms are correctly configured and monitoring the appropriate EBS volume metrics. Test the configuration by generating traffic to the volumes and observing the alarm state changes.
Reference: Amazon CloudWatch Metrics for Amazon EBS
Creating Amazon CloudWatch Alarms
Question #354
A company runs a web application on three Amazon EC2 instances behind an Application Load Balancer (ALB). Web traffic increases significantly during the same 9-hour period every day and causes a decrease in the application’s performance. A SysOps administrator must scale the application ahead of the changes in demand to accommodate the increased traffic.
Which solution will meet these requirements?
- A . Create an Amazon CloudWatch alarm to monitor application latency. Configure an alarm action to increase the size of each EC2 instance if the latency threshold is reached.
- B . Create an Amazon EventBridge rule to monitor application latency. Configure the rule to add an EC2 instance to the ALB if the latency threshold is reached
- C . Deploy the application to an EC2 Auto Scaling group that uses a target tracking scaling policy. Attach the ALB to the Auto Scaling group.
- D . Deploy the application to an EC2 Auto Scaling group that uses a scheduled scaling policy. Attach the ALB to the Auto Scaling group.
Correct Answer: D
D
Explanation:
For predictable, significant traffic increases during a specific time period every day:
EC2 Auto Scaling Group: Set up an Auto Scaling group for the EC2 instances running the web application. This group automatically adjusts the number of instances based on policies defined.
Scheduled Scaling Policy: Use a scheduled scaling policy to pre-emptively increase the number of instances before the expected increase in traffic each day. Scheduled scaling allows you to specify the scaling actions to occur at specific times, based on known or expected demand patterns.
Attach to ALB: Ensure the Auto Scaling group is attached to the Application Load Balancer, which will distribute incoming traffic across the dynamically adjusted pool of EC2 instances.
This approach ensures that the application scales up resources ahead of the expected load, maintaining performance and user experience without manual intervention.
D
Explanation:
For predictable, significant traffic increases during a specific time period every day:
EC2 Auto Scaling Group: Set up an Auto Scaling group for the EC2 instances running the web application. This group automatically adjusts the number of instances based on policies defined.
Scheduled Scaling Policy: Use a scheduled scaling policy to pre-emptively increase the number of instances before the expected increase in traffic each day. Scheduled scaling allows you to specify the scaling actions to occur at specific times, based on known or expected demand patterns.
Attach to ALB: Ensure the Auto Scaling group is attached to the Application Load Balancer, which will distribute incoming traffic across the dynamically adjusted pool of EC2 instances.
This approach ensures that the application scales up resources ahead of the expected load, maintaining performance and user experience without manual intervention.
Question #355
A SysOps administrator needs to configure an Amazon S3 bucket to host a web application. The SysOps administrator has created the S3 bucket and has copied the static files for the web application to the S3 bucket.
The company has a policy that all S3 buckets must not be public.
What should the SysOps administrator do to meet these requirements?
- A . Create an Amazon CloudFront distribution. Configure the S3 bucket as an origin with an origin access identity (OAI). Give the OAI the s3:GetObject permission in the S3 bucket policy.
- B . Configure static website hosting in the S3 bucket. Use Amazon Route 53 to create a DNS CNAME to
point to the S3 website endpomt. - C . Create an Application Load Balancer (ALB). Change the protocol to HTTPS in the ALB listener configuration. Forward the traffic to the S3 bucket.
- D . Create an accelerator in AWS Global Accelerator. Set up a listener configuration for port 443. Set the endpoint type to forward the traffic to the S3 bucket.
Correct Answer: A
A
Explanation:
To host a web application in an S3 bucket while adhering to the policy that prohibits public S3 buckets:
Amazon CloudFront: Set up a CloudFront distribution and designate the S3 bucket as its origin. This allows the web application to be served via CloudFront, which can handle web traffic at scale and provide additional features such as HTTPS delivery.
Origin Access Identity (OAI): Create an OAI for the CloudFront distribution and configure the S3 bucket policy to grant the s3:GetObject permission to the OAI. This allows only CloudFront to access the content in the S3 bucket, keeping the bucket private from direct public access.
Security and Performance: This configuration ensures that the web application is only accessible through CloudFront, enhancing security and performance. It also complies with the company’s policy against public S3 buckets by controlling access strictly through CloudFront.
This method leverages CloudFront’s capabilities to securely serve web applications from S3, maintaining privacy and compliance with organizational policies.
A
Explanation:
To host a web application in an S3 bucket while adhering to the policy that prohibits public S3 buckets:
Amazon CloudFront: Set up a CloudFront distribution and designate the S3 bucket as its origin. This allows the web application to be served via CloudFront, which can handle web traffic at scale and provide additional features such as HTTPS delivery.
Origin Access Identity (OAI): Create an OAI for the CloudFront distribution and configure the S3 bucket policy to grant the s3:GetObject permission to the OAI. This allows only CloudFront to access the content in the S3 bucket, keeping the bucket private from direct public access.
Security and Performance: This configuration ensures that the web application is only accessible through CloudFront, enhancing security and performance. It also complies with the company’s policy against public S3 buckets by controlling access strictly through CloudFront.
This method leverages CloudFront’s capabilities to securely serve web applications from S3, maintaining privacy and compliance with organizational policies.
Question #356
A compliance team requires all administrator passwords tor Amazon RDS DB instances to be changed at toast annually
Which solution meets this requirement in the MOST operationally efficient manned
- A . Store the database credentials in AWS Secrets Manager Configure automate rotation for the secret every 365 days
- B . Store the database credentials as a parameter in the RDS parameter group Create a database trigger to rotate the password every 365 days
- C . Store the database credentials in a private Amazon S3 bucket Schedule an AWS Lambda function to generate a new set of credentials every 365 days
- D . Store the database credentials in AWS Systems Manager Parameter Store as a secure string parameter Configure automatic rotation for the parameter every 365 days
Correct Answer: A
A
Explanation:
AWS Secrets Manager allows you to store, manage, and automatically rotate database credentials.
This service is designed to be used for such requirements efficiently.
Store Database Credentials in AWS Secrets Manager:
Open the AWS Secrets Manager console at AWS Secrets Manager Console.
Choose Store a new secret.
Select Credentials for RDS database and provide the database connection details and credentials.
Choose Next to configure the secret.
Configure Rotation:
Enable automatic rotation for the secret.
Set the rotation interval to 365 days.
Select or create a Lambda function that will be used to rotate the secret. AWS Secrets Manager provides a template for this function which can be customized if necessary.
Apply and Monitor:
Apply the changes and ensure that your application retrieves credentials from AWS Secrets Manager.
Monitor the rotation activity in Secrets Manager to ensure that the credentials are being rotated as expected.
Reference: AWS Secrets Manager
Rotating Your AWS Secrets Manager Secrets
A
Explanation:
AWS Secrets Manager allows you to store, manage, and automatically rotate database credentials.
This service is designed to be used for such requirements efficiently.
Store Database Credentials in AWS Secrets Manager:
Open the AWS Secrets Manager console at AWS Secrets Manager Console.
Choose Store a new secret.
Select Credentials for RDS database and provide the database connection details and credentials.
Choose Next to configure the secret.
Configure Rotation:
Enable automatic rotation for the secret.
Set the rotation interval to 365 days.
Select or create a Lambda function that will be used to rotate the secret. AWS Secrets Manager provides a template for this function which can be customized if necessary.
Apply and Monitor:
Apply the changes and ensure that your application retrieves credentials from AWS Secrets Manager.
Monitor the rotation activity in Secrets Manager to ensure that the credentials are being rotated as expected.
Reference: AWS Secrets Manager
Rotating Your AWS Secrets Manager Secrets
Question #357
A company monitors its account activity using AWS CloudTrail. and is concerned that some log files are being tampered with after the logs have been delivered to the account’s Amazon S3 bucket.
Moving forward, how can the SysOps administrator confirm that the log files have not been modified after being delivered to the S3 bucket?
- A . Stream the CloudTrail logs to Amazon CloudWatch Logs to store logs at a secondary location.
- B . Enable log file integrity validation and use digest files to verify the hash value of the log file.
- C . Replicate the S3 log bucket across regions, and encrypt log files with S3 managed keys.
- D . Enable S3 server access logging to track requests made to the log bucket for security audits.
Correct Answer: B
B
Explanation:
When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file. CloudTrail signs each digest file using the private key of a public and private key pair. After delivery, you can use the public key to validate the digest file. CloudTrail uses different key pairs for each AWS region
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
B
Explanation:
When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file. CloudTrail signs each digest file using the private key of a public and private key pair. After delivery, you can use the public key to validate the digest file. CloudTrail uses different key pairs for each AWS region
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html
Question #358
To address recurring application crashes due to a memory leak, the SysOps administrator needs to implement a temporary reboot solution outside of business hours.
- A . Create an Amazon EventBridge rule that is scheduled to run outside of business hours. Configure the rule to invoke the StartInstances operation on the EC2 instances.
- B . Use AWS Systems Manager to create a daily maintenance window that is outside of business hours. Register the EC2 instances as a target. Assign the AWS-RestartEC2Instance runbook to the maintenance window.
- C . Configure an additional CloudWatch alarm to monitor the StatusCheckFailed_System metric for the EC2 instances. Configure an EC2 action on the additional alarm to reboot the instances.
- D . Configure an additional CloudWatch alarm that is triggered every time the application crashes.
Configure an EC2 action on the additional alarm to restart the application on the EC2 instances.
Correct Answer: B
B
Explanation:
Using AWS Systems Manager to schedule a maintenance window for restarting EC2 instances outside business hours provides a straightforward and automated approach.
AWS Systems Manager Maintenance Window: Allows for daily scheduling, ensuring that restarts occur consistently outside of business hours.
AWS-RestartEC2Instance Runbook: This runbook can be assigned to the maintenance window, automating the reboot process and minimizing manual intervention.
Reduced Disruption: The scheduled restart ensures the application remains operational during business hours.
B
Explanation:
Using AWS Systems Manager to schedule a maintenance window for restarting EC2 instances outside business hours provides a straightforward and automated approach.
AWS Systems Manager Maintenance Window: Allows for daily scheduling, ensuring that restarts occur consistently outside of business hours.
AWS-RestartEC2Instance Runbook: This runbook can be assigned to the maintenance window, automating the reboot process and minimizing manual intervention.
Reduced Disruption: The scheduled restart ensures the application remains operational during business hours.
Question #359
A SysOps administrator is responsible for managing a fleet of Amazon EC2 instances. These EC2 instances upload build artifacts to a third-party service. The third-party service recently implemented a strict IP allow list that requires all build uploads to come from a single IP address.
What change should the systems administrator make to the existing build fleet to comply with this new requirement?
- A . Move all of the EC2 instances behind a NAT gateway and provide the gateway IP address to the service.
- B . Move all of the EC2 instances behind an internet gateway and provide the gateway IP address to the service.
- C . Move all of the EC2 instances into a single Availability Zone and provide the Availability Zone IP address to the service.
- D . Move all of the EC2 instances to a peered VPC and provide the VPC IP address to the service.
Correct Answer: A
A
Explanation:
To ensure all EC2 instances upload build artifacts through a single IP address:
A: Move all of the EC2 instances behind a NAT gateway. Provide the IP address of the NAT gateway to the third-party service for the allow list. A NAT gateway enables instances in a private subnet to connect to services outside AWS (such as a third-party service) but prevents the internet from initiating connections with those instances. Using a NAT gateway standardizes all outgoing traffic to use a single IP address. More information on NAT gateways can be found in AWS documentation NAT Gateways.
A
Explanation:
To ensure all EC2 instances upload build artifacts through a single IP address:
A: Move all of the EC2 instances behind a NAT gateway. Provide the IP address of the NAT gateway to the third-party service for the allow list. A NAT gateway enables instances in a private subnet to connect to services outside AWS (such as a third-party service) but prevents the internet from initiating connections with those instances. Using a NAT gateway standardizes all outgoing traffic to use a single IP address. More information on NAT gateways can be found in AWS documentation NAT Gateways.
Question #360
A company runs a worker process on three Amazon EC2 instances. The instances are in an Auto Scaling group that is configured to use a simple scaling policy. The instances process messages from an Amazon Simple Queue Service (Amazon SOS) queue.
Random periods of increased messages are causing a decrease in the performance of the worker process. A SysOps administrator must scale the instances to accommodate the increased number of messages.
Which solution will meet these requirements?
- A . Use CloudWatch to create a metric math expression to calculate the approximate age of the oldest message in the SQS queue. Create a target tracking scaling policy for the metric math expression to modify the Auto Scaling group.
- B . Use CloudWatch to create a metric math expression to calculate the approximate number of messages visible in the SQS queue for each instance. Create a target tracking scaling policy for the metric math expression to modify the Auto Scaling group.
- C . Create an Application Load Balancer (ALB). Attach the ALB to the Auto Scaling group. Create a target tracking scaling policy for the ALBRequestCountPerTarget metric to modify the Auto Scaling group.
- D . Create an Application Load Balancer (ALB). Attach the ALB to the Auto Scaling group. Create a scheduled scaling policy for the Auto Scaling group.
Correct Answer: B
B
Explanation:
To manage scaling of EC2 instances in response to variable SQS message loads effectively:
Monitor SQS Queue Size: Utilize Amazon CloudWatch to monitor the number of visible messages in the SQS queue. This metric gives an indication of the workload that needs to be processed by the worker instances.
Metric Math Expression: Create a CloudWatch metric math expression that calculates the approximate number of messages visible per instance. This provides a more precise scaling metric, ensuring that each instance in the Auto Scaling group has a manageable load.
Target Tracking Scaling Policy: Implement a target tracking scaling policy based on this metric math expression. Configure the Auto Scaling group to automatically adjust its size to maintain a target value for the average number of SQS messages per instance. This approach ensures that the EC2 instances scale up during high traffic periods and scale down when the message load decreases.
This solution optimizes resource utilization and cost while maintaining performance by ensuring that the worker processes are neither overwhelmed nor idle.
B
Explanation:
To manage scaling of EC2 instances in response to variable SQS message loads effectively:
Monitor SQS Queue Size: Utilize Amazon CloudWatch to monitor the number of visible messages in the SQS queue. This metric gives an indication of the workload that needs to be processed by the worker instances.
Metric Math Expression: Create a CloudWatch metric math expression that calculates the approximate number of messages visible per instance. This provides a more precise scaling metric, ensuring that each instance in the Auto Scaling group has a manageable load.
Target Tracking Scaling Policy: Implement a target tracking scaling policy based on this metric math expression. Configure the Auto Scaling group to automatically adjust its size to maintain a target value for the average number of SQS messages per instance. This approach ensures that the EC2 instances scale up during high traffic periods and scale down when the message load decreases.
This solution optimizes resource utilization and cost while maintaining performance by ensuring that the worker processes are neither overwhelmed nor idle.