Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
A SysOps administrator needs to design a high-traffic static website. The website must be highly available and must provide the lowest possible latency to users across the globe.
Which solution will meet these requirements?
- A . Create an Amazon S3 bucket, and upload the website content to the S3 bucket. Create an Amazon CloudFront distribution in each AWS Region, and set the S3 bucket as the origin. Use Amazon Route 53 to create a DNS record that uses a geolocation routing policy to route traffic to the correct CloudFront distribution based on where the request originates.
- B . Create an Amazon S3 bucket, and upload the website content to the S3 bucket. Create an Amazon CloudFront distribution, and set the S3 bucket as the origin. Use Amazon Route 53 to create an alias record that points to the CloudFront distribution.
- C . Create an Application Load Balancer (ALB) and a target group. Create an Amazon EC2 Auto Scaling group with at least two EC2 instances in the associated target group. Store the website content on the EC2 instances. Use Amazon Route 53 to create an alias record that points to the ALB.
- D . Create an Application Load Balancer (ALB) and a target group in two Regions. Create an Amazon EC2 Auto Scaling group in each Region with at least two EC2 instances in each target group. Store the website content on the EC2 instances. Use Amazon Route 53 to create a DNS record that uses a geolocation routing policy to route traffic to the correct ALB based on where the request originates.
B
Explanation:
To design a high-traffic static website that is highly available and provides low latency globally, you can use Amazon S3, CloudFront, and Route 53. This solution leverages the global edge locations of CloudFront to deliver content with low latency.
Create an Amazon S3 Bucket:
Open the S3 console at Amazon S3 Console.
Create a new bucket and upload your website content.
Configure S3 for Static Website Hosting:
Go to the Properties tab of your bucket.
Enable Static website hosting and set the index document (e.g., index.html).
Create a CloudFront Distribution:
Open the CloudFront console at Amazon CloudFront Console.
Create a new distribution and set the S3 bucket as the origin.
Configure distribution settings, including caching behaviors and SSL/TLS settings.
Create Route 53 Alias Record:
Open the Route 53 console at Amazon Route 53 Console.
Select the hosted zone for your domain.
Create a new record set, choose ALIAS as the record type, and point it to the CloudFront distribution.
Reference: Amazon S3 Static Website Hosting
Creating a CloudFront Distribution
Routing Traffic to a CloudFront Distribution
A company uses an AWS CloudFormation template to provision an Amazon EC2 instance and an Amazon RDS DB instance A SysOps administrator must update the template to ensure that the DB instance is created before the EC2 instance is launched
What should the SysOps administrator do to meet this requirement?
- A . Add a wait condition to the template Update the EC2 instance user data script to send a signal after the EC2 instance is started
- B . Add the DependsOn attribute to the EC2 instance resource, and provide the logical name of the RDS resource
- C . Change the order of the resources in the template so that the RDS resource is listed before the EC2 instance resource
- D . Create multiple templates Use AWS CloudFormation StackSets to wait for one stack to complete before the second stack is created
B
Explanation:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html
Syntax The DependsOn attribute can take a single string or list of strings. "DependsOn" : [ String, … ] Example The following template contains an AWS::EC2::Instance resource with a DependsOn attribute that specifies myDB, an AWS::RDS::DBInstance. When CloudFormation creates this stack, it first creates myDB, then creates Ec2Instance.
Application A runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The EC2 instances are in an Auto Scaling group and are in the same subnet that is associated with the NLB. Other applications from an on-premises environment cannot communicate with Application A on port 8080.
To troubleshoot the issue, a SysOps administrator analyzes the flow logs. The flow logs include the following records:
What is the reason for the rejected traffic?
- A . The security group of the EC2 instances has no Allow rule for the traffic from the NLB.
- B . The security group of the NLB has no Allow rule for the traffic from the on-premises environment.
- C . The ACL of the on-premises environment does not allow traffic to the AWS environment.
- D . The network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range.
D
Explanation:
The rejected traffic in the flow logs is due to the network ACL associated with the subnet not allowing outbound traffic for the ephemeral port range.
Network ACLs:
Network ACLs act as a firewall for controlling traffic in and out of one or more subnets.
By default, NACLs allow all inbound and outbound traffic, but custom NACLs require specific rules to allow traffic.
Ephemeral Ports:
Ephemeral ports are temporary ports used for client-side communication. The default range is 1024-65535.
Ensure that the network ACL allows outbound traffic on these ports.
Steps to Resolve:
Check the network ACL rules for the associated subnet.
Add outbound rules to allow traffic from the ephemeral port range (1024-65535).
Reference: Amazon VPC Network ACLs
A company uses Amazon Route 53 to manage the public DNS records for the domain example.com. The company deploys an Amazon CloudFront distribution to deliver static assets for a new corporate website. The company wants to create a subdomain that is named "static" and must route traffic for the subdomain to the CloudFront distribution.
How should a SysOps administrator create a new record for the subdomain in Route 53?
- A . Create a CNAME record. Enter static.cloudfront.net as the record name. Enter the CloudFront distribution’s public IP address as the value.
- B . Create a CNAME record. Enter static.example.com as the record name. Enter the CloudFront distribution’s private IP address as the value.
- C . Create an A record. Enter static.cloudfront.net as the record name. Enter the CloudFront distribution’s ID as an alias target.
- D . Create an A record. Enter static.example.com as the record name. Enter the CloudFront distribution’s domain name as an alias target.
D
Explanation:
To route traffic for a subdomain to a CloudFront distribution using Amazon Route 53, you should create an A record with the CloudFront distribution’s domain name as the alias target.
Login to AWS Management Console:
Open the Route 53 console at Amazon Route 53 Console.
Select Hosted Zone:
Select the hosted zone for your domain (example.com).
Create Record Set:
Click on Create record.
For Record name, enter static.
Select A – IPv4 address for the record type.
For Alias, choose Yes.
In the Alias Target field, select the CloudFront distribution’s domain name from the dropdown menu.
Save Record Set:
Review the settings and click Create records.
This setup directs traffic for static.example.com to the CloudFront distribution, leveraging the distribution’s caching and delivery capabilities.
Reference: Routing Traffic to a CloudFront Distribution by Using Your Domain Name Creating Records in Route 53
The company needs EC2 instances in the VPC to resolve DNS names for on-premises hosts using Direct Connect.
- A . Create an Amazon Route 53 private hosted zone. Populate the zone with the hostnames and IP addresses of the hosts in the on-premises data center.
- B . Create an Amazon Route 53 Resolver outbound endpoint. Add the IP addresses of an on-premises DNS server for the domain names that need to be forwarded.
- C . Set up a forwarding rule for reverse DNS queries in Amazon Route 53 Resolver. Set the enableDnsHostnames attribute to true for the VPC.
- D . Add the hostnames and IP addresses for the on-premises hosts to the /etc/hosts file of each EC2 instance.
B
Explanation:
Using a Route 53 Resolver outbound endpoint allows DNS queries for on-premises hosts to be forwarded to the on-premises DNS server over the Direct Connect connection, minimizing maintenance and automating name resolution without the need for manual entry or file management.
A company applies user-defined tags to resources that are associated with me company’s AWS workloads Twenty days after applying the tags, the company notices that it cannot use re tags to filter views in the AWS Cost Explorer console.
What is the reason for this issue?
- A . It lakes at least 30 days to be able to use tags to filter views in Cost Explorer.
- B . The company has not activated the user-defined tags for cost allocation.
- C . The company has not created an AWS Cost and Usage Report
- D . The company has not created a usage budget in AWS Budgets
B
Explanation:
To use tags to filter views in the AWS Cost Explorer console, the tags must be activated for cost allocation.
Activate User-Defined Tags for Cost Allocation:
Open the AWS Billing and Cost Management console.
In the navigation pane, choose "Cost Allocation Tags."
Activate the user-defined tags that you want to use for cost allocation.
Reference: Activating User-Defined Cost Allocation Tags
A company has an application that runs behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon Route 53 record set contains an alias record for app.anycompany.com that references the ALB in us-west-2 and uses a simple routing policy. The application is experiencing an increase in users from other locations in the world. These users are experiencing high latency.
Most of the new users are close to the ap-southeast-2 Region. The company deploys a copy of the application to ap-southeast-2. A SysOps administrator must implement a solution that automatically routes requests to the lowest latency endpoint for users without changing the URL.
Which solution will meet these requirements?
- A . Add a new value to the existing alias record for app.anycompany.com with the DNS name of the new ALB in ap-southeast-2.
- B . Change the existing alias record to use a geolocation routing policy. Create two geolocation records, one record that references each ALSelect the location that is closest to each Region.
- C . Change the existing alias record to use a latency routing policy. Create two latency records, one record that references each ALB.
- D . Change the existing alias record to use a multivalue routing policy Add the DNS name of each ALB to the record.
C
Explanation:
To optimize the routing of requests to the application for users in different geographic locations, use Amazon Route 53’s latency-based routing:
Latency Routing Policy: Modify the Route 53 DNS settings for app.anycompany.com by changing the routing policy to latency. This policy routes user requests to the server that has the lowest latency relative to the user’s location.
Configure Latency Records: Create latency records for each ALB―one for the ALB in us-west-2 and another for the new ALB in ap-southeast-2. Route 53 will automatically direct traffic to the endpoint that provides the lowest latency connection to the user.
Seamless User Experience: By using latency routing, the URL remains the same (app.anycompany.com), but the backend service location varies based on which endpoint is likely to respond the fastest. This setup provides a seamless experience for users, reducing latency without requiring any changes to how they access the application.
This method leverages Route 53’s advanced DNS capabilities to ensure optimal performance and user experience by dynamically routing traffic based on geographic latency considerations.
A company has an application that runs only on Amazon EC2 Spot Instances. The instances run in an Amazon EC2 Auto Scaling group with scheduled scaling actions.
However, the capacity does not always increase at the scheduled times, and instances terminate many times a day. A Sysops administrator must ensure that the instances launch on time and have fewer interruptions.
Which action will meet these requirements?
- A . Specify the capacity-optimized allocation strategy for Spot Instances. Add more instance types to the Auto Scaling group.
- B . Specify the capacity-optimized allocation strategy for Spot Instances. Increase the size of the instances in the Auto Scaling group.
- C . Specify the lowest-price allocation strategy for Spot Instances. Add more instance types to the Auto Scaling group.
- D . Specify the lowest-price allocation strategy for Spot Instances. Increase the size of the instances in the Auto Scaling group.
A
Explanation:
Specifying the capacity-optimized allocation strategy for Spot Instances and adding more instance types to the Auto Scaling group is the best action to meet the requirements. Increasing the size of the instances in the Auto Scaling group will not necessarily help with the launch time or reduce interruptions, as the Spot Instances could still be interrupted even with larger instance sizes.
A global company operates out of five AWS Regions. A SysOps administrator wants to identify all the company’s tagged and untagged Amazon EC2 instances.
The company requires the output to display the instance ID and tags.
What is the MOST operationally efficient way for the SysOps administrator to meet these requirements?
- A . Create a tag-based resource group in AWS Resource Groups.
- B . Use AWS Trusted Advisor. Export the EC2 On-Demand Instances check results from Trusted Advisor.
- C . Use Cost Explorer. Choose a service type of EC2-Instances, and group by Resource.
- D . Use Tag Editor in AWS Resource Groups. Select all Regions, and choose a resource type of AWS::EC2::Instance.
D
Explanation:
To identify both tagged and untagged EC2 instances across multiple AWS Regions efficiently:
AWS Tag Editor: Tag Editor allows you to search for resources across your AWS account by tags, including both tagged and untagged resources.
Search Setup: In the Tag Editor, select all the Regions where the company operates. Specify the resource type as AWS::EC2::Instance to focus the search on EC2 instances.
View and Export Data: Execute the search to view all EC2 instances, along with their associated tags and instance IDs. This data can be exported for further analysis or reporting.
Using the Tag Editor is an operationally efficient way to quickly get a comprehensive view of resource tagging across multiple Regions, aiding in compliance and resource management tasks.
A company’s SysOps administrator deploys four new Amazon EC2 instances by using the standard Amazon Linux 2 Amazon Machine Image (AMI). The company needs to be able to use AWS Systems Manager to manage the instances The SysOps administrator notices that the instances do not appear in the Systems Manager console
What must the SysOps administrator do to resolve this issue?
- A . Connect to each instance by using SSH Install Systems Manager Agent on each instance Configure Systems Manager Agent to start automatically when the instances start up
- B . Use AWS Certificate Manager (ACM) to create a TLS certificate Import the certificate into each instance Configure Systems Manager Agent to use the TLS certificate for secure communications
- C . Connect to each instance by using SSH Create an ssm-user account Add the ssm-user account to the /etcsudoers d directory
- D . Attach an IAM instance profile to the instances Ensure that the instance profile contains the AmazonSSMManagedinstanceCore policy
D
Explanation:
To manage Amazon EC2 instances using AWS Systems Manager, you need to ensure that the instances are associated with an IAM instance profile that grants the necessary permissions.
Attach IAM Instance Profile:
Create an IAM role with the AmazonSSMManagedInstanceCore policy. Attach this IAM role to your EC2 instances. Steps to Attach IAM Instance Profile:
Open the EC2 console and select the instances.
Choose "Actions" -> "Instance Settings" -> "Attach/Replace IAM Role."
Select the IAM role with AmazonSSMManagedInstanceCore policy and attach it to the instances.
AmazonSSMManagedInstanceCore Policy:
This policy grants the required permissions for Systems Manager to manage the EC2 instances. It includes permissions for SSM Agent to communicate with the Systems Manager service.
Reference: AWS Systems Manager Prerequisites
AmazonSSMManagedInstanceCore Policy