Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
Question #371
A company is storing backups in an Amazon S3 bucket. The backups must not be deleted for at least 3 months after the backups are created.
What should a SysOps administrator do to meet this requirement?
- A . Configure an IAM policy that denies the s3:DeleteObject action for all users. Three months after an object is written, remove the policy.
- B . Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
- C . Enable S3 Versioning on the existing S3 bucket. Configure S3 Lifecycle rules to protect the backups.
- D . Enable S3 Object Lock on a new S3 bucket in governance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
Correct Answer: B
B
Explanation:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html In governance mode, users can’t overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period. In compliance mode, a protected object version can’t be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can’t be changed, and its retention period can’t be shortened. Compliance mode helps ensure that an object version can’t be overwritten or deleted for the duration of the retention period.
B
Explanation:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html In governance mode, users can’t overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period. In compliance mode, a protected object version can’t be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can’t be changed, and its retention period can’t be shortened. Compliance mode helps ensure that an object version can’t be overwritten or deleted for the duration of the retention period.
Question #372
An AWS Lambda function is intermittently failing several times a day A SysOps administrator must find out how often this error has occurred in the last 7 days.
Which action will meet this requirement in the MOST operationally efficient manner?
- A . Use Amazon Athena to query the Amazon CloudWatch logs that are associated with the Lambda function
- B . Use Amazon Athena to query the AWS CloudTrail logs that are associated with the Lambda function
- C . Use Amazon CloudWatch Logs Insights to query the associated Lambda function logs
- D . Use Amazon Elasticsearch Service (Amazon ES) to stream the Amazon CloudWatch logs for the Lambda function
Correct Answer: C
C
Explanation:
To efficiently find out how often the AWS Lambda function has failed in the last 7 days, use Amazon CloudWatch Logs Insights.
Access CloudWatch Logs Insights:
Navigate to the CloudWatch console.
Select "Logs Insights" from the navigation pane.
Reference: Analyzing Log Data with CloudWatch Logs Insights
Select the Log Group:
Select the log group associated with the Lambda function. Specify the time range for the last 7 days. Run the Query:
Use a query to filter and count the occurrences of errors in the logs. For example:
sql
Copy code
fields @timestamp, @message
| filter @message like /ERROR/
| stats count() by bin(1d)
This query will count the number of errors per day in the last 7 days.
Using CloudWatch Logs Insights provides an efficient way to query and analyze log data, helping you quickly identify the frequency of Lambda function failures.
C
Explanation:
To efficiently find out how often the AWS Lambda function has failed in the last 7 days, use Amazon CloudWatch Logs Insights.
Access CloudWatch Logs Insights:
Navigate to the CloudWatch console.
Select "Logs Insights" from the navigation pane.
Reference: Analyzing Log Data with CloudWatch Logs Insights
Select the Log Group:
Select the log group associated with the Lambda function. Specify the time range for the last 7 days. Run the Query:
Use a query to filter and count the occurrences of errors in the logs. For example:
sql
Copy code
fields @timestamp, @message
| filter @message like /ERROR/
| stats count() by bin(1d)
This query will count the number of errors per day in the last 7 days.
Using CloudWatch Logs Insights provides an efficient way to query and analyze log data, helping you quickly identify the frequency of Lambda function failures.
Question #373
A company has a compliance requirement that no security groups can allow SSH ports to be open to all IP addresses. A SysOps administrator must implement a solution that will notify the company’s SysOps team when a security group rule violates this requirement. The solution also must remediate the security group rule automatically.
Which solution will meet these requirements?
- A . Create an Amazon EventBridge (Amazon CloudWatch Events) rule that invokes an AWS Lambda function when a security group changes. Configure the Lambda function to evaluate the security group for compliance, remove all inbound security group rules on all ports, and notify the SysOps team if the security group is noncompliant.
- B . Create an AWS CloudTrail metric filter for security group changes. Create an Amazon CloudWatch alarm to notify the SysOps team through an Amazon Simple Notification Service (Amazon SNS) topic when (he metric is greater than 0. Subscribe an AWS Lambda function to the SNS topic to remediate the security group rule by removing the rule.
- C . Activate the AWS Config restricted-ssh managed rule. Add automatic remediation to the AWS Config rule by using the AWS Systems Manager Automation AWS-
DisablePublicAccessForSecurityGroup runbook. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to notify the SysOps team when the rule is noncompliant. - D . Create an AWS CloudTrail metric filter for security group changes. Create an Amazon CloudWatch alarm for when the metric is greater than 0. Add an AWS Systems Manager action to the CloudWatch
alarm to suspend the security group by using the Systems Manager Automation AWS-DisablePublicAccessForSecurityGroup runbook when the alarm is in ALARM state. Add an Amazon Simple Notification Service (Amazon SNS) topic as a second target to notify the SysOps team.
Correct Answer: C
C
Explanation:
AWS Config can be used to monitor and enforce compliance of AWS resource configurations, including security group rules.
Steps:
Activate AWS Config Rule:
Open the AWS Config console.
Choose "Rules" and then "Add rule".
Search for and select the restricted-ssh managed rule.
Configure the rule to monitor all security groups for compliance.
Set Up Automatic Remediation:
In the AWS Config console, associate the restricted-ssh rule with the AWS-DisablePublicAccessForSecurityGroup Systems Manager Automation runbook.
This runbook will automatically remove any inbound SSH rule that allows traffic from 0.0.0.0/0.
Set Up Notifications:
Open the Amazon EventBridge console.
Create a new rule to monitor AWS Config compliance changes.
Configure the rule to send notifications to an Amazon SNS topic whenever the restricted-ssh rule is noncompliant.
Subscribe the SysOps team to the SNS topic to receive notifications.
C
Explanation:
AWS Config can be used to monitor and enforce compliance of AWS resource configurations, including security group rules.
Steps:
Activate AWS Config Rule:
Open the AWS Config console.
Choose "Rules" and then "Add rule".
Search for and select the restricted-ssh managed rule.
Configure the rule to monitor all security groups for compliance.
Set Up Automatic Remediation:
In the AWS Config console, associate the restricted-ssh rule with the AWS-DisablePublicAccessForSecurityGroup Systems Manager Automation runbook.
This runbook will automatically remove any inbound SSH rule that allows traffic from 0.0.0.0/0.
Set Up Notifications:
Open the Amazon EventBridge console.
Create a new rule to monitor AWS Config compliance changes.
Configure the rule to send notifications to an Amazon SNS topic whenever the restricted-ssh rule is noncompliant.
Subscribe the SysOps team to the SNS topic to receive notifications.
Question #374
With the threat of ransomware viruses encrypting and holding company data hostage, which action should be taken to protect an Amazon S3 bucket?
- A . Deny Post. Put. and Delete on the bucket.
- B . Enable server-side encryption on the bucket.
- C . Enable Amazon S3 versioning on the bucket.
- D . Enable snapshots on the bucket.
Correct Answer: C
C
Explanation:
Step-by-Step
Understand the Problem:
The threat of ransomware encrypting and holding company data hostage.
Need to protect an Amazon S3 bucket.
Analyze the Requirements:
Ensure that data in the S3 bucket is protected against unauthorized encryption or deletion.
Evaluate the Options:
Option A: Deny Post, Put, and Delete on the bucket.
Denying these actions would prevent any uploads or modifications to the bucket, making it unusable.
Option B: Enable server-side encryption on the bucket.
Server-side encryption protects data at rest but does not prevent the encryption of data by ransomware.
Option C: Enable Amazon S3 versioning on the bucket.
S3 versioning keeps multiple versions of an object in the bucket. If a file is overwritten or encrypted by ransomware, previous versions of the file can still be accessed.
Option D: Enable snapshots on the bucket.
Amazon S3 does not have a snapshot feature; this option is not applicable.
Select the Best Solution:
Option C: Enabling Amazon S3 versioning is the best solution as it allows access to previous versions
of objects, providing protection against ransomware encryption by retaining prior, unencrypted versions.
Reference: Amazon S3 Versioning
Best Practices for Protecting Data with Amazon S3
Enabling S3 versioning ensures that previous versions of objects are preserved, providing a safeguard against ransomware by allowing recovery of unencrypted versions of data.
C
Explanation:
Step-by-Step
Understand the Problem:
The threat of ransomware encrypting and holding company data hostage.
Need to protect an Amazon S3 bucket.
Analyze the Requirements:
Ensure that data in the S3 bucket is protected against unauthorized encryption or deletion.
Evaluate the Options:
Option A: Deny Post, Put, and Delete on the bucket.
Denying these actions would prevent any uploads or modifications to the bucket, making it unusable.
Option B: Enable server-side encryption on the bucket.
Server-side encryption protects data at rest but does not prevent the encryption of data by ransomware.
Option C: Enable Amazon S3 versioning on the bucket.
S3 versioning keeps multiple versions of an object in the bucket. If a file is overwritten or encrypted by ransomware, previous versions of the file can still be accessed.
Option D: Enable snapshots on the bucket.
Amazon S3 does not have a snapshot feature; this option is not applicable.
Select the Best Solution:
Option C: Enabling Amazon S3 versioning is the best solution as it allows access to previous versions
of objects, providing protection against ransomware encryption by retaining prior, unencrypted versions.
Reference: Amazon S3 Versioning
Best Practices for Protecting Data with Amazon S3
Enabling S3 versioning ensures that previous versions of objects are preserved, providing a safeguard against ransomware by allowing recovery of unencrypted versions of data.
Question #375
A company has an AWS Lambda function in Account A. The Lambda function needs to read the objects in an Amazon S3 bucket in Account B. A SysOps administrator must create corresponding 1AM roles in both accounts.
Which solution will meet these requirements?
- A . In Account A, create a Lambda execution role to assume the role in Account B. In Account B. create a role that the function can assume to gain access to the S3 bucket.
- B . In Account A, create a Lambda execution role that provides access to the S3 bucket. In Account B. create a role that the function can assume.
- C . In Account A. create a role that the function can assume. In Account B, create a Lambda execution role that provides access to the S3 bucket.
- D . In Account A. create a role that the function can assume to gain access to the S3 bucket. In Account B. create a Lambda execution role to assume the role in Account A.
Correct Answer: A
A
Explanation:
For a Lambda function in Account A to access an S3 bucket in Account B, the correct IAM roles setup includes:
A: In Account A, create a Lambda execution role that has permissions to assume another role in Account
B. In Account B, create a role with permissions to access the S3 bucket and trust the Lambda execution role from Account A to assume it. This configuration allows the Lambda function to assume the cross-account role and access the S3 bucket as needed, maintaining security and proper access control. AWS documentation provides more details on setting up cross-account roles for Lambda access AWS Lambda Permissions.
A
Explanation:
For a Lambda function in Account A to access an S3 bucket in Account B, the correct IAM roles setup includes:
A: In Account A, create a Lambda execution role that has permissions to assume another role in Account
B. In Account B, create a role with permissions to access the S3 bucket and trust the Lambda execution role from Account A to assume it. This configuration allows the Lambda function to assume the cross-account role and access the S3 bucket as needed, maintaining security and proper access control. AWS documentation provides more details on setting up cross-account roles for Lambda access AWS Lambda Permissions.
Question #376
A company uses AWS CloudFormation to manage a stack of Amazon EC2 instances on AWS. A SysOps administrator needs to keep the instances and all of the instances’ data, even if someone deletes the stack.
Which solution will meet these requirements?
- A . Set the DeletionPolicy attribute to Snapshot for the EC2 instance resource in the CloudFormation template.
- B . Automate backups by using Amazon Data Lifecycle Manager (Amazon DLM).
- C . Create a backup plan in AWS Backup.
- D . Set the DeletionPolicy attribute to Retain for the EC2 instance resource in the CloudFormation template.
Correct Answer: D
D
Explanation:
To prevent the EC2 instances and their data from being deleted when a CloudFormation stack is deleted:
DeletionPolicy Attribute: In the CloudFormation template that defines the EC2 instances, set the DeletionPolicy attribute to Retain for each EC2 instance resource. This setting ensures that when the CloudFormation stack is deleted, the EC2 instances are not terminated.
Impact of the Retain Policy: With this policy, all data on the instance, such as data on its attached EBS volumes, remains intact even after the stack deletion. The resources will remain in your AWS account and will need to be managed or deleted manually thereafter.
This approach is directly supported by AWS CloudFormation and provides a simple and effective way to protect EC2 instances and their data during stack deletions.
D
Explanation:
To prevent the EC2 instances and their data from being deleted when a CloudFormation stack is deleted:
DeletionPolicy Attribute: In the CloudFormation template that defines the EC2 instances, set the DeletionPolicy attribute to Retain for each EC2 instance resource. This setting ensures that when the CloudFormation stack is deleted, the EC2 instances are not terminated.
Impact of the Retain Policy: With this policy, all data on the instance, such as data on its attached EBS volumes, remains intact even after the stack deletion. The resources will remain in your AWS account and will need to be managed or deleted manually thereafter.
This approach is directly supported by AWS CloudFormation and provides a simple and effective way to protect EC2 instances and their data during stack deletions.
Question #377
A company uses AWS Organizations to host several applications across multiple AWS accounts.
Several teams are responsible for building and maintaining the infrastructure of the applications across the AWS accounts.
A SysOps administrator must implement a solution to ensure that user accounts and permissions are centrally managed. The solution must be integrated with the company’s existing on-premises Active Directory environment. The SysOps administrator already has enabled AWS 1AM Identity Center (AWS Single Sign-On) and has set up an AWS Direct Connect connection.
What is the MOST operationally efficient solution that meets these requirements?
- A . Create a Simple AD domain, and establish a forest trust relationship with the on-premises Active Directory domain. Set the Simple AD domain as the identity source for 1AM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
- B . Create an Active Directory domain controller on an Amazon EC2 instance that is joined to the on-premises Active Directory domain. Set the Active Directory domain controller as the identity source for 1AM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
- C . Create an AD Connector that is associated with the on-premises Active Directory domain. Set the AD Connector as the identity source for 1AM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
- D . Use the built-in SSO directory as the identity source for 1AM Identity Center. Copy the users and groups from the on-premises Active Directory domain. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
Correct Answer: C
C
Explanation:
To manage user accounts and permissions across multiple AWS accounts and integrate with an on-premises Active Directory, using AD Connector is the most operationally efficient solution. AD Connector serves as a directory gateway with which you can redirect directory requests to your on-premises Microsoft Active Directory without storing any directory data in the cloud. This setup allows IAM Identity Center to use the existing corporate credentials, ensuring centralized management and seamless user access control. Option C perfectly meets these requirements by leveraging existing infrastructure with minimal changes. AWS documentation on AD Connector offers guidance AWS Directory Service AD Connector.
C
Explanation:
To manage user accounts and permissions across multiple AWS accounts and integrate with an on-premises Active Directory, using AD Connector is the most operationally efficient solution. AD Connector serves as a directory gateway with which you can redirect directory requests to your on-premises Microsoft Active Directory without storing any directory data in the cloud. This setup allows IAM Identity Center to use the existing corporate credentials, ensuring centralized management and seamless user access control. Option C perfectly meets these requirements by leveraging existing infrastructure with minimal changes. AWS documentation on AD Connector offers guidance AWS Directory Service AD Connector.
Question #378
A company has an organization in AWS Organizations. The company uses shared VPCs to provide networking resources across accounts A SysOps administrator has been able to successfully launch and manage Amazon EC2 instances in a participant account However the SysOps administrator is now receiving an InstanceLimitExceeded error when the SysOps administrator tries to launch a new EC2 instance
What should the SysOps administrator do to resolve this error’)
- A . Request an instance quota increase from the account that owns the VPC
- B . Launch additional EC2 instances in a different AWS Region
- C . Request an instance quota increase from the parte pant account
- D . Launch additional EC2 instances by using a different Amazon Machine image (AMI)
Correct Answer: C
C
Explanation:
When receiving an InstanceLimitExceeded error in a participant account of a shared VPC, you need to request an instance quota increase from the participant account.
Requesting a Quota Increase:
Open the AWS Service Quotas console in the participant account.
In the navigation pane, choose "AWS services" and select "Amazon EC2."
Select the quota you need to increase, such as "Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances."
Click "Request quota increase" and specify the desired limit.
Quota Management in AWS Organizations:
While shared VPCs allow resources to be used across accounts, quota limits are still managed per account.
Each participant account must manage its own quotas independently.
Reference: Service Quotas
Requesting a Quota Increase
C
Explanation:
When receiving an InstanceLimitExceeded error in a participant account of a shared VPC, you need to request an instance quota increase from the participant account.
Requesting a Quota Increase:
Open the AWS Service Quotas console in the participant account.
In the navigation pane, choose "AWS services" and select "Amazon EC2."
Select the quota you need to increase, such as "Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances."
Click "Request quota increase" and specify the desired limit.
Quota Management in AWS Organizations:
While shared VPCs allow resources to be used across accounts, quota limits are still managed per account.
Each participant account must manage its own quotas independently.
Reference: Service Quotas
Requesting a Quota Increase
Question #379
A SysOps administrator needs to automate the invocation of an AWS Lambda function. The Lambda function must run at the end of each day to generate a report on data that is stored in an Amazon S3 bucket.
What is the MOST operationally efficient solution that meets these requirements?
- A . Create an Amazon EventBridge {Amazon CloudWatch Events) rule that has an event pattern for Amazon S3 and the Lambda function as a target.
- B . Create an Amazon EventBridge (Amazon CloudWatch Events) rule that has a schedule and the Lambda function as a target.
- C . Create an S3 event notification to invoke the Lambda function whenever objects change in the S3 bucket.
- D . Deploy an Amazon EC2 instance with a cron job to invoke the Lambda function.
Correct Answer: B
B
Explanation:
To automate the invocation of an AWS Lambda function at the end of each day, you can use Amazon EventBridge (formerly known as CloudWatch Events) to create a scheduled rule.
Create a Scheduled EventBridge Rule:
Open the Amazon EventBridge console at Amazon EventBridge Console.
Choose Create rule.
Provide a name and description for the rule.
For Rule type, choose Schedule.
Define a cron expression that runs the rule at the end of each day. For example, cron(0 0 * * ? *) runs the function at midnight UTC.
Set the Target:
In the Targets section, choose Add target.
For Target type, select Lambda function.
Choose the Lambda function you want to invoke.
Create the Rule:
Review the settings and choose Create rule.
This setup ensures that the Lambda function runs automatically at the specified time every day.
Reference: Amazon EventBridge Scheduler
Managing EventBridge Rules
B
Explanation:
To automate the invocation of an AWS Lambda function at the end of each day, you can use Amazon EventBridge (formerly known as CloudWatch Events) to create a scheduled rule.
Create a Scheduled EventBridge Rule:
Open the Amazon EventBridge console at Amazon EventBridge Console.
Choose Create rule.
Provide a name and description for the rule.
For Rule type, choose Schedule.
Define a cron expression that runs the rule at the end of each day. For example, cron(0 0 * * ? *) runs the function at midnight UTC.
Set the Target:
In the Targets section, choose Add target.
For Target type, select Lambda function.
Choose the Lambda function you want to invoke.
Create the Rule:
Review the settings and choose Create rule.
This setup ensures that the Lambda function runs automatically at the specified time every day.
Reference: Amazon EventBridge Scheduler
Managing EventBridge Rules
Question #380
A company runs an application on an Amazon EC2 instance A SysOps administrator creates an Auto Scaling group and an Application Load Balancer (ALB) to handle an increase in demand However, the EC2 instances are failing tie health check.
What should the SysOps administrator do to troubleshoot this issue?
- A . Verity that the Auto Scaling group is configured to use all AWS Regions.
- B . Verily that the application is running on the protocol and the port that the listens is expecting.
- C . Verify the listener priority in the ALB Change the priority if necessary.
- D . Verify the maximum number of instances in the Auto Scaling group Change the number if necessary
Correct Answer: B
B
Explanation:
When EC2 instances fail health checks from the Application Load Balancer (ALB), it’s often due to a mismatch between what the ALB is checking for and what the application is providing. Ensuring that the application is correctly configured to respond on the expected protocol and port is crucial.
Steps:
Check ALB Health Check Configuration:
Open the Amazon EC2 console.
Navigate to the Load Balancers section.
Select your ALB and go to the "Health Checks" tab.
Verify the protocol (HTTP/HTTPS) and port specified in the health check configuration.
Verify Application Configuration:
Ensure that the application on the EC2 instances is running and listening on the same protocol and port configured in the ALB health check.
Check firewall settings, security groups, and network ACLs to ensure that traffic is allowed on the specified port.
Test Connectivity:
Use tools like curl or telnet from another instance or from within the same instance to ensure the application responds correctly to health check requests.
Review Health Check Logs:
Look at the logs for the application and the ALB to identify any errors or misconfigurations.
Reference: ALB Health Check Configuration
Troubleshooting ALB Health Checks
B
Explanation:
When EC2 instances fail health checks from the Application Load Balancer (ALB), it’s often due to a mismatch between what the ALB is checking for and what the application is providing. Ensuring that the application is correctly configured to respond on the expected protocol and port is crucial.
Steps:
Check ALB Health Check Configuration:
Open the Amazon EC2 console.
Navigate to the Load Balancers section.
Select your ALB and go to the "Health Checks" tab.
Verify the protocol (HTTP/HTTPS) and port specified in the health check configuration.
Verify Application Configuration:
Ensure that the application on the EC2 instances is running and listening on the same protocol and port configured in the ALB health check.
Check firewall settings, security groups, and network ACLs to ensure that traffic is allowed on the specified port.
Test Connectivity:
Use tools like curl or telnet from another instance or from within the same instance to ensure the application responds correctly to health check requests.
Review Health Check Logs:
Look at the logs for the application and the ALB to identify any errors or misconfigurations.
Reference: ALB Health Check Configuration
Troubleshooting ALB Health Checks