Amazon SOA-C02 Practice Exams
Last updated on Oct 21,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 21,2026
Question #31
The SysOps administrator must dynamically reference the latest AMI ID from Systems Manager Parameter Store in CloudFormation templates for new AMI versions. (Select THREE):
- A . Create a new Systems Manager parameter to store the AMI value in the standard parameter tier.
- B . Create a new Systems Manager parameter to store the AMI value in the advanced parameter tier.
- C . Enable trusted access with Organizations.
- D . Enable resource sharing with Organizations.
- E . Create a resource share by using AWS Resource Access Manager (AWS RAM). Specify the new parameter as the resource. Specify the entire organization as the principal.
- F . Create an Amazon EventBridge rule that invokes an AWS Lambda function when a new AMI is published. Program the Lambda function to assume an IAM role in all linked accounts and to update Parameter Store with the new AMI ID.
Correct Answer: A, D, E
A, D, E
Explanation:
To allow CloudFormation templates in all accounts within the organization to reference the latest
AMI ID:
Parameter Store in Standard Tier: Storing the AMI ID in Systems Manager Parameter Store provides a central and easy-to-update source.
Enable Resource Sharing with Organizations: This allows the parameter to be shared across accounts
in the organization.
Resource Share in AWS RAM: AWS Resource Access Manager (RAM) can be used to share the parameter with the entire organization, allowing other accounts to access the AMI ID.
Using the standard tier in Parameter Store is sufficient, and an EventBridge rule with Lambda for updating AMIs would add unnecessary complexity.
A, D, E
Explanation:
To allow CloudFormation templates in all accounts within the organization to reference the latest
AMI ID:
Parameter Store in Standard Tier: Storing the AMI ID in Systems Manager Parameter Store provides a central and easy-to-update source.
Enable Resource Sharing with Organizations: This allows the parameter to be shared across accounts
in the organization.
Resource Share in AWS RAM: AWS Resource Access Manager (RAM) can be used to share the parameter with the entire organization, allowing other accounts to access the AMI ID.
Using the standard tier in Parameter Store is sufficient, and an EventBridge rule with Lambda for updating AMIs would add unnecessary complexity.
Question #32
A company is running a development application on an Amazon EC2 instance. The application uploads 500.000 files that are 1 GB in size into a large! Amazon S3 bucket that has default encryption enabled The EC2 instance is in the same AWS Region where the S3 bucket is deployed.
The company uses performance logging that is built into the application software. The logs show that the application is constantly waiting for the files to be written to the S3 bucket. A SysOps administrator needs to improve the application’s throughput performance. The SysOps administrator validates that the networking on the EC2 instance is not constrained.
What should the SysOps administrator do to improve the S3 upload performance”
- A . Enable S3 Transfer Acceleration on the S3 bucket.
- B . Split the S3 write operations to use multiple bucket prefixes to write items in parallel.
- C . Configure AWS PrivateLink for Amazon S3 Turn off encryption on the S3 bucket
- D . Configure AWS Global Accelerator in the Region. Turn off encryption on the S3 bucket.
Correct Answer: B
B
Explanation:
Improve S3 Upload Performance:
Using multiple bucket prefixes can improve throughput by allowing parallel upload streams.
Steps:
Modify the application to write files to different prefixes in the S3 bucket.
Example: Instead of writing all files to s3://bucket-name/, write to s3://bucket-name/prefix1/,
s3://bucket-name/prefix2/, etc.
Reference: Best Practices for Amazon S3 Performance
B
Explanation:
Improve S3 Upload Performance:
Using multiple bucket prefixes can improve throughput by allowing parallel upload streams.
Steps:
Modify the application to write files to different prefixes in the S3 bucket.
Example: Instead of writing all files to s3://bucket-name/, write to s3://bucket-name/prefix1/,
s3://bucket-name/prefix2/, etc.
Reference: Best Practices for Amazon S3 Performance
Question #33
The company needs to minimize network latency for a cluster of EC2 instances running custom software for advanced statistical analysis.
- A . Place all the EC2 instances into a cluster placement group.
- B . Configure and assign two Elastic IP addresses for each EC2 instance.
- C . Configure jumbo frames on all the EC2 instances in the cluster.
- D . Place all the EC2 instances into a spread placement group in the same AWS Region.
Correct Answer: A
A
Explanation:
Cluster placement groups are designed to place EC2 instances close together within a single Availability Zone, which reduces latency and maximizes network performance between instances.
Cluster Placement Group: Reduces network latency by keeping instances in close proximity within the same hardware, providing low-latency, high-throughput networking.
High Network Performance: Ideal for latency-sensitive applications, especially those running within a clustered architecture.
Spread placement groups are designed for high availability rather than low latency. Jumbo frames may improve throughput but not significantly reduce latency.
A
Explanation:
Cluster placement groups are designed to place EC2 instances close together within a single Availability Zone, which reduces latency and maximizes network performance between instances.
Cluster Placement Group: Reduces network latency by keeping instances in close proximity within the same hardware, providing low-latency, high-throughput networking.
High Network Performance: Ideal for latency-sensitive applications, especially those running within a clustered architecture.
Spread placement groups are designed for high availability rather than low latency. Jumbo frames may improve throughput but not significantly reduce latency.
Question #34
An environment consists of 100 Amazon EC2 Windows instances The Amazon CloudWatch agent Is deployed and running on at EC2 instances with a baseline configuration file to capture log files There is a new requirement to capture the DHCP tog tiles that exist on 50 of the instances
What is the MOST operational efficient way to meet this new requirement?
- A . Create an additional CloudWatch agent configuration file to capture the DHCP logs Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file
- B . Log in to each EC2 instance with administrator rights Create a PowerShell script to push the needed baseline log files and DHCP log files to CloudWatch
- C . Run the CloudWatch agent configuration file wizard on each EC2 instance Verify that the base the log files are included and add the DHCP tog files during the wizard creation process
- D . Run the CloudWatch agent configuration file wizard on each EC2 instance and select the advanced detail level. This wifi capture the operating system log files.
Correct Answer: A
A
Explanation:
The most operationally efficient way to capture DHCP log files on 50 of the 100 EC2 instances is to create an additional CloudWatch agent configuration file and use AWS Systems Manager Run Command to update the CloudWatch agent configuration.
Create an Additional CloudWatch Agent Configuration File:
Create a new CloudWatch agent configuration file that includes the settings to capture DHCP log files.
Use AWS Systems Manager Run Command:
AWS Systems Manager Run Command allows you to remotely and securely manage the configuration of your managed instances.
Use the Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file.
Steps:
Open the Systems Manager console.
Choose "Run Command."
Create a new command document or use an existing one that restarts the CloudWatch agent with the append-config option.
Target the 50 specific EC2 instances.
Reference: Amazon CloudWatch Agent Configuration
AWS Systems Manager Run Command
A
Explanation:
The most operationally efficient way to capture DHCP log files on 50 of the 100 EC2 instances is to create an additional CloudWatch agent configuration file and use AWS Systems Manager Run Command to update the CloudWatch agent configuration.
Create an Additional CloudWatch Agent Configuration File:
Create a new CloudWatch agent configuration file that includes the settings to capture DHCP log files.
Use AWS Systems Manager Run Command:
AWS Systems Manager Run Command allows you to remotely and securely manage the configuration of your managed instances.
Use the Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file.
Steps:
Open the Systems Manager console.
Choose "Run Command."
Create a new command document or use an existing one that restarts the CloudWatch agent with the append-config option.
Target the 50 specific EC2 instances.
Reference: Amazon CloudWatch Agent Configuration
AWS Systems Manager Run Command
Question #35
A SysOps administrator wants to securely share an object from a private Amazon S3 bucket with a group of users who do not have an AWS account.
What is the MOST operationally efficient solution that will meet this requirement?
- A . Attach an S3 bucket policy that only allows object downloads from the users’ IP addresses.
- B . Create an 1AM role that has access to the object. Instruct the users to assume the role.
- C . Create an 1AM user that has access to the object. Share the credentials with the users.
- D . Generate a presigned URL for the object. Share the URL with the users.
Correct Answer: D
D
Explanation:
The most operationally efficient and secure method to share an object from a private Amazon S3 bucket with users who do not have an AWS account is by generating a presigned URL. This URL grants temporary access to the object and can be limited by time, ensuring that users can only access the S3 object during a specified window. This does not require managing network configurations or sharing credentials, making it a secure and simple solution. Option D is therefore the correct answer. Reference to this method can be found in the AWS S3 documentation on presigned URLs Amazon S3 Presigned URLs.
D
Explanation:
The most operationally efficient and secure method to share an object from a private Amazon S3 bucket with users who do not have an AWS account is by generating a presigned URL. This URL grants temporary access to the object and can be limited by time, ensuring that users can only access the S3 object during a specified window. This does not require managing network configurations or sharing credentials, making it a secure and simple solution. Option D is therefore the correct answer. Reference to this method can be found in the AWS S3 documentation on presigned URLs Amazon S3 Presigned URLs.
Question #36
A company deployed a new web application on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances run in an Auto Scaling group. Users report that they are frequently being prompted to log in.
What should a SysOps administrator do to resolve this issue?
- A . Configure an Amazon CloudFront distribution with the ALB as the origin.
- B . Enable sticky sessions (session affinity) for the target group of EC2 instances.
- C . Redeploy the EC2 instances in a spread placement group.
- D . Replace the ALB with a Network Load Balancer.
Correct Answer: C
C
Explanation:
To resolve the issue of users being frequently prompted to log in, which typically indicates that session persistence is not configured:
Sticky Sessions: Enable sticky sessions (session affinity) on the ALB’s target group. This configuration makes sure that all requests from a single user during a session are directed to the same EC2 instance, rather than being load balanced to different instances which might not share session data.
Configuration: This is done in the ALB settings under the target group attributes. Sticky sessions use a user-specific cookie generated by the ALB to route requests to the designated instance.
Session Cookie: The ALB handles the session cookie automatically, but you may adjust settings like the duration that the session cookie remains valid.
Enabling sticky sessions ensures that user sessions are maintained with the same server, reducing the instances of repeated logins and improving the user experience.
C
Explanation:
To resolve the issue of users being frequently prompted to log in, which typically indicates that session persistence is not configured:
Sticky Sessions: Enable sticky sessions (session affinity) on the ALB’s target group. This configuration makes sure that all requests from a single user during a session are directed to the same EC2 instance, rather than being load balanced to different instances which might not share session data.
Configuration: This is done in the ALB settings under the target group attributes. Sticky sessions use a user-specific cookie generated by the ALB to route requests to the designated instance.
Session Cookie: The ALB handles the session cookie automatically, but you may adjust settings like the duration that the session cookie remains valid.
Enabling sticky sessions ensures that user sessions are maintained with the same server, reducing the instances of repeated logins and improving the user experience.
Question #37
A SysOps administrator is creating an Amazon EC2 Auto Scaling group in a new AWS account. After adding some instances, the SysOps administrator notices that the group has not reached the minimum number of instances.
The SysOps administrator receives the following error message:
Which action will resolve this issue?
- A . Adjust the account spending limits for Amazon EC2 on the AWS Billing and Cost Management console
- B . Modify the EC2 quota for that AWS Region in the EC2 Settings section of the EC2 console.
- C . Request a quota Increase for the Instance type family by using Service Quotas on the AWS Management Console.
- D . Use the Rebalance action In the Auto Scaling group on the AWS Management Console.
Correct Answer: C
C
Explanation:
The error message indicates that the current quota for the number of EC2 instances allowed in the specified region has been reached. To resolve this issue, a quota increase must be requested.
Request Quota Increase:
Open the Service Quotas console at Service Quotas Console.
Navigate to Amazon EC2 service.
Find the specific quota for the instance type family that you need to increase.
Select the quota and choose Request quota increase.
Provide the necessary details and submit the request.
This action will initiate a request to AWS to increase the limit, allowing you to launch additional instances once the request is approved.
Reference: Service Quotas
Requesting a Quota Increase
C
Explanation:
The error message indicates that the current quota for the number of EC2 instances allowed in the specified region has been reached. To resolve this issue, a quota increase must be requested.
Request Quota Increase:
Open the Service Quotas console at Service Quotas Console.
Navigate to Amazon EC2 service.
Find the specific quota for the instance type family that you need to increase.
Select the quota and choose Request quota increase.
Provide the necessary details and submit the request.
This action will initiate a request to AWS to increase the limit, allowing you to launch additional instances once the request is approved.
Reference: Service Quotas
Requesting a Quota Increase
Question #38
The company is experiencing increased message load from the frontend to the backend, causing message loss due to backend capacity limitations.
- A . Redevelop the backend application as a series of AWS Lambda functions.
- B . Implement an Amazon Kinesis data stream to replace the backend application.
- C . Implement an Application Load Balancer to distribute message traffic across the backend application instances.
- D . Implement an Amazon Simple Queue Service (Amazon SQS) queue between the frontend and backend components.
Correct Answer: D
D
Explanation:
To handle the increased message load with minimal operational effort, implementing an Amazon Simple Queue Service (SQS) queue between the frontend and backend is an ideal solution. SQS decouples the frontend and backend by queuing messages, enabling the backend to process messages at its own pace without losing any.
SQS Queue: Acts as a buffer, ensuring messages are not lost if the backend application cannot immediately process them.
Decoupling: With SQS, the frontend can continue sending messages without concern for the backend’s processing speed, providing a scalable solution with minimal management requirements.
Low Operational Overhead: SQS is fully managed, reducing the need for infrastructure management.
D
Explanation:
To handle the increased message load with minimal operational effort, implementing an Amazon Simple Queue Service (SQS) queue between the frontend and backend is an ideal solution. SQS decouples the frontend and backend by queuing messages, enabling the backend to process messages at its own pace without losing any.
SQS Queue: Acts as a buffer, ensuring messages are not lost if the backend application cannot immediately process them.
Decoupling: With SQS, the frontend can continue sending messages without concern for the backend’s processing speed, providing a scalable solution with minimal management requirements.
Low Operational Overhead: SQS is fully managed, reducing the need for infrastructure management.
Question #39
A company creates a new member account by using AWS Organizations. A SysOps administrator needs to add AWS Business Support to the new account
Which combination of steps must the SysOps administrator take to meet this requirement? (Select TWO.)
- A . Sign in to the new account by using 1AM credentials. Change the support plan.
- B . Sign in to the new account by using root user credentials. Change the support plan.
- C . Use the AWS Support API to change the support plan.
- D . Reset the password of the account root user.
- E . Create an IAM user that has administrator privileges in the new account.
Correct Answer: B, E
B, E
Explanation:
The best combination of steps to meet this requirement is to sign in to the new account by using root user credentials and change the support plan, and to create an IAM user that has administrator privileges in the new account.
Signing in to the new account by using root user credentials will allow the SysOps administrator to access the account and change the support plan to AWS Business Support. Additionally, creating an IAM user that has administrator privileges in the new account will ensure that the SysOps administrator has the necessary access to manage the account and make changes to the support plan if necessary.
Reference: [1] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_access_signin-root
B, E
Explanation:
The best combination of steps to meet this requirement is to sign in to the new account by using root user credentials and change the support plan, and to create an IAM user that has administrator privileges in the new account.
Signing in to the new account by using root user credentials will allow the SysOps administrator to access the account and change the support plan to AWS Business Support. Additionally, creating an IAM user that has administrator privileges in the new account will ensure that the SysOps administrator has the necessary access to manage the account and make changes to the support plan if necessary.
Reference: [1] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_access_signin-root
Question #40
A SysOps administrator needs to control access to groups of Amazon EC2 instances using AWS Systems Manager Session Manager. Specific tags on the EC2 instances have already been added.
Which additional actions should the administrator take to control access? (Choose two.)
- A . Attach an IAM policy to the users or groups that require access to the EC2 instances.
- B . Attach an IAM role to control access to the EC2 instances.
- C . Create a placement group for the EC2 instances and add a specific tag.
- D . Create a service account and attach it to the EC2 instances that need to be controlled.
- E . Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element.
Correct Answer: AE
AE
Explanation:
To control access to Amazon EC2 instances using AWS Systems Manager Session Manager based on specific tags:
Attach an IAM Policy to Users or Groups: Create and attach an Identity and Access Management (IAM) policy to the IAM users or groups who need access to the EC2 instances. This policy should specify the permissions required to use Session Manager to start sessions with the instances.
Create an IAM Policy with Tag-Based Conditions: Create an IAM policy that includes a condition element to allow access to EC2 instances based on specific tags. This policy can be designed to grant the ssm:StartSession permission only for instances that match certain tags, as defined in the condition block of the IAM policy. Here is a sample condition block that could be used:
"Condition": {
"StringEquals": {
"ec2:ResourceTag/YourTagName": "YourTagValue"
}
}
This ensures that only authorized users can initiate sessions with instances that have the specified tags, enhancing security and operational management.
By implementing these policies, you ensure that only the appropriate personnel have the controlled access required, based on the specific business needs and security guidelines.
AE
Explanation:
To control access to Amazon EC2 instances using AWS Systems Manager Session Manager based on specific tags:
Attach an IAM Policy to Users or Groups: Create and attach an Identity and Access Management (IAM) policy to the IAM users or groups who need access to the EC2 instances. This policy should specify the permissions required to use Session Manager to start sessions with the instances.
Create an IAM Policy with Tag-Based Conditions: Create an IAM policy that includes a condition element to allow access to EC2 instances based on specific tags. This policy can be designed to grant the ssm:StartSession permission only for instances that match certain tags, as defined in the condition block of the IAM policy. Here is a sample condition block that could be used:
"Condition": {
"StringEquals": {
"ec2:ResourceTag/YourTagName": "YourTagValue"
}
}
This ensures that only authorized users can initiate sessions with instances that have the specified tags, enhancing security and operational management.
By implementing these policies, you ensure that only the appropriate personnel have the controlled access required, based on the specific business needs and security guidelines.