Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
Question #401
A company plans to run a public web application on Amazon EC2 instances behind an Elastic Load Balancer (ELB). The company’s security team wants to protect the website by using AWS Certificate Manager (ACM) certificates The ELB must automatically redirect any HTTP requests to HTTPS
Which solution will meet these requirements?
- A . Create an Application Load Balancer that has one HTTPS listener on port 80 Attach an SSLTLS certificate to listener port 80 Create a rule to redirect requests from HTTP to HTTPS
- B . Create an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443 Attach an SSL TLS certificate to listener port 443 Create a rule to redirect requests from port 80 to port 443
- C . Create an Application Load Balancer that has two TCP listeners on port 80 and port 443 Attach an SSLTLS certificate to listener port 443 Create a rule to redirect requests from port 80 to port 443
- D . Create a Network Load Balancer that has two TCP listeners on port 80 and port 443 Attach an SSLTLS certificate to listener port 443 Create a rule to redirect requests from port 80 to port 443
Correct Answer: B
Question #402
A company is running an application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are launched by an Auto Scaling group and are automatically registered in a target group. A SysOps administrator must set up a notification to alert application owners when targets fail health checks.
What should the SysOps administrator do to meet these requirements?
- A . Create an Amazon CloudWatch alarm on the UnHealthyHostCount metric. Configure an action to send an Amazon Simple Notification Service (Amazon SNS) notification when the metric is greater than 0.
- B . Configure an Amazon EC2 Auto Scaling custom lifecycle action to send an Amazon Simple Notification Service (Amazon SNS) notification when an instance is in the Pending:Wait state.
- C . Update the Auto Scaling group. Configure an activity notification to send an Amazon Simple Notification Service (Amazon SNS) notification for the Unhealthy event type.
- D . Update the ALB health check to send an Amazon Simple Notification Service (Amazon SNS) notification when an instance is unhealthy.
Correct Answer: A
A
Explanation:
To set up a notification for failed health checks of targets in the ALB, follow these steps:
Create a CloudWatch Alarm:
Navigate to CloudWatch and create a new alarm based on the UnHealthyHostCount metric of the target group.
Reference: Creating Alarms
Configure the Alarm Action:
Configure the alarm to send an Amazon SNS notification when the UnHealthyHostCount metric is greater than 0.
Reference: Using Amazon SNS for CloudWatch Alarms
This setup will notify application owners whenever a target fails health checks.
A
Explanation:
To set up a notification for failed health checks of targets in the ALB, follow these steps:
Create a CloudWatch Alarm:
Navigate to CloudWatch and create a new alarm based on the UnHealthyHostCount metric of the target group.
Reference: Creating Alarms
Configure the Alarm Action:
Configure the alarm to send an Amazon SNS notification when the UnHealthyHostCount metric is greater than 0.
Reference: Using Amazon SNS for CloudWatch Alarms
This setup will notify application owners whenever a target fails health checks.
Question #403
A company’s financial department needs to view the cost details of each project in an AWS account A SysOps administrator must perform the initial configuration that is required to view cost for each project in Cost Explorer
Which solution will meet this requirement?
- A . Activate cost allocation tags Add a project tag to the appropriate resources
- B . Configure consolidated billing Create AWS Cost and Usage Reports
- C . Use AWS Budgets Create AWS Budgets reports
- D . Use cost categories to define custom groups that are based on AWS cost and usage dimensions
Correct Answer: A
A
Explanation:
To view the cost details of each project in an AWS account using Cost Explorer, you need to activate cost allocation tags and tag the resources with a project identifier.
Activate Cost Allocation Tags:
Navigate to the AWS Billing and Cost Management console.
In the navigation pane, choose "Cost allocation tags".
Select the tags you want to activate (e.g., "Project") and click "Activate".
Tag Resources with Project Identifier:
Go to the AWS Management Console for each service where resources are deployed (e.g., EC2, S3, RDS).
For each resource, add a tag with the key "Project" and a value that identifies the project (e.g., "ProjectA").
Ensure that all relevant resources are tagged appropriately.
View Cost Allocation in Cost Explorer:
Navigate to the Cost Explorer console.
Use the "Group by" option to group costs by the "Project" tag.
Review the cost details for each project based on the tags applied to the resources.
Reference: Using Cost Allocation Tags
Analyzing Your Costs with Cost Explorer
A
Explanation:
To view the cost details of each project in an AWS account using Cost Explorer, you need to activate cost allocation tags and tag the resources with a project identifier.
Activate Cost Allocation Tags:
Navigate to the AWS Billing and Cost Management console.
In the navigation pane, choose "Cost allocation tags".
Select the tags you want to activate (e.g., "Project") and click "Activate".
Tag Resources with Project Identifier:
Go to the AWS Management Console for each service where resources are deployed (e.g., EC2, S3, RDS).
For each resource, add a tag with the key "Project" and a value that identifies the project (e.g., "ProjectA").
Ensure that all relevant resources are tagged appropriately.
View Cost Allocation in Cost Explorer:
Navigate to the Cost Explorer console.
Use the "Group by" option to group costs by the "Project" tag.
Review the cost details for each project based on the tags applied to the resources.
Reference: Using Cost Allocation Tags
Analyzing Your Costs with Cost Explorer
Question #404
A SysOps administrator Is troubleshooting an AWS Cloud Formation template whereby multiple Amazon EC2 instances are being created
The template is working In us-east-1. but it is failing In us-west-2 with the error code:
How should the administrator ensure that the AWS Cloud Formation template is working in every region?
- A . Copy the source region’s Amazon Machine Image (AMI) to the destination region and assign it the same ID.
- B . Edit the AWS CloudFormatton template to specify the region code as part of the fully qualified AMI ID.
- C . Edit the AWS CloudFormatton template to offer a drop-down list of all AMIs to the user by using the aws :: EC2:: ami :: imageiD control.
- D . Modify the AWS CloudFormation template by including the AMI IDs in the "Mappings" section. Refer to the proper mapping within the template for the proper AMI ID.
Correct Answer: D
D
Explanation:
To ensure that the AWS CloudFormation template works in every region, you should use the Mappings section to specify region-specific AMI IDs. This allows the template to dynamically reference the correct AMI ID based on the region where the stack is being deployed.
Steps:
Add Mappings to the Template:
Define the AMI IDs for each region in the Mappings section of the CloudFormation template.
json
Copy code
{
"Mappings": {
"RegionMap": {
"us-east-1": { "AMI": "ami-0123456789abcdef0" },
"us-west-2": { "AMI": "ami-abcdef0123456789" }
}
}
}
Reference the Mapping in the Template:
Use the Fn::FindInMap function to reference the correct AMI ID based on the region.
json
Copy code
{
"Resources": {
"MyEC2Instance": {
"Type": "AWS::EC2::Instance",
"Properties": {
"ImageId": { "Fn::FindInMap": [ "RegionMap", { "Ref": "AWS::Region" }, "AMI" ] },
…
}
}
}
}
Deploy the Template:
Deploy the CloudFormation stack in any region, and it will use the correct AMI ID.
Reference: AWS CloudFormation Mappings
D
Explanation:
To ensure that the AWS CloudFormation template works in every region, you should use the Mappings section to specify region-specific AMI IDs. This allows the template to dynamically reference the correct AMI ID based on the region where the stack is being deployed.
Steps:
Add Mappings to the Template:
Define the AMI IDs for each region in the Mappings section of the CloudFormation template.
json
Copy code
{
"Mappings": {
"RegionMap": {
"us-east-1": { "AMI": "ami-0123456789abcdef0" },
"us-west-2": { "AMI": "ami-abcdef0123456789" }
}
}
}
Reference the Mapping in the Template:
Use the Fn::FindInMap function to reference the correct AMI ID based on the region.
json
Copy code
{
"Resources": {
"MyEC2Instance": {
"Type": "AWS::EC2::Instance",
"Properties": {
"ImageId": { "Fn::FindInMap": [ "RegionMap", { "Ref": "AWS::Region" }, "AMI" ] },
…
}
}
}
}
Deploy the Template:
Deploy the CloudFormation stack in any region, and it will use the correct AMI ID.
Reference: AWS CloudFormation Mappings
Question #405
A company has a secure website running on Amazon EC2 instances behind an Application Load Balancer (ALB). An SSL certificate from AWS Certificate Manager (ACM) is used on the ALB. Users with legacy web browsers are experiencing issues with the website.
How should the SysOps administrator resolve these issues in the MOST operationally efficient manner?
- A . Create a new SSL certificate in ACM and install the new certificate on the ALB to support legacy web browsers.
- B . Create a second ALB and install a custom SSL certificate with a different domain name on the second ALB to support legacy web browsers.
- C . Remove the ALB from the configuration and install a custom SSL certificate on each web server.
- D . Update the SSL negotiation configuration of the ALB with a security policy that contains ciphers for legacy web browsers.
Correct Answer: D
D
Explanation:
The issues experienced by users with legacy browsers typically stem from the SSL/TLS ciphers that are supported or enforced by the ALB. Modern security policies may exclude older ciphers that are necessary for compatibility with older browsers. Here’s how to resolve it:
Access the ALB Settings: Go to the AWS Management Console, navigate to the ALB settings, and locate the SSL negotiation configurations.
Modify Security Policy: Update the SSL/TLS security policy on the ALB to include ciphers that are compatible with legacy browsers. AWS provides predefined security policies, and some of these policies are designed to support older ciphers while still maintaining a level of security that complies with general best practices.
Apply Changes: Once the security policy is updated, the ALB will start using this new configuration, which should resolve compatibility issues with legacy browsers without needing to replace the SSL certificate or alter the infrastructure.
This solution maintains the operational efficiency of the setup and avoids the need for additional resources like a second ALB or new certificates.
D
Explanation:
The issues experienced by users with legacy browsers typically stem from the SSL/TLS ciphers that are supported or enforced by the ALB. Modern security policies may exclude older ciphers that are necessary for compatibility with older browsers. Here’s how to resolve it:
Access the ALB Settings: Go to the AWS Management Console, navigate to the ALB settings, and locate the SSL negotiation configurations.
Modify Security Policy: Update the SSL/TLS security policy on the ALB to include ciphers that are compatible with legacy browsers. AWS provides predefined security policies, and some of these policies are designed to support older ciphers while still maintaining a level of security that complies with general best practices.
Apply Changes: Once the security policy is updated, the ALB will start using this new configuration, which should resolve compatibility issues with legacy browsers without needing to replace the SSL certificate or alter the infrastructure.
This solution maintains the operational efficiency of the setup and avoids the need for additional resources like a second ALB or new certificates.
Question #406
A SysOps administrator is reviewing VPC Flow Logs to troubleshoot connectivity issues in a VPC.
While reviewing the togs the SysOps administrator notices that rejected traffic is not listed.
What should the SysOps administrator do to ensure that all traffic is logged?
- A . Create a new flow tog that has a titter setting to capture all traffic
- B . Create a new flow log set the tog record format to a custom format Select the proper fields to include in the tog
- C . Edit the existing flow log Change the fitter setting to capture all traffic
- D . Edit the existing flow log. Set the log record format to a custom format Select the proper fields to include in the tog
Correct Answer: A
A
Explanation:
To ensure that all traffic, including rejected traffic, is logged in VPC Flow Logs, you need to create a new flow log with a filter setting to capture all traffic.
Create a New Flow Log:
Open the VPC console.
Select the VPC for which you want to create the flow log.
Choose "Create flow log."
In the filter setting, select "All" to capture all traffic (accepted and rejected).
Flow Log Configuration:
Ensure that the destination for the flow logs (e.g., CloudWatch Logs or S3) is properly configured. Specify the appropriate IAM role to allow VPC Flow Logs to publish logs to the destination.
Reference: VPC Flow Logs
Creating a Flow Log
A
Explanation:
To ensure that all traffic, including rejected traffic, is logged in VPC Flow Logs, you need to create a new flow log with a filter setting to capture all traffic.
Create a New Flow Log:
Open the VPC console.
Select the VPC for which you want to create the flow log.
Choose "Create flow log."
In the filter setting, select "All" to capture all traffic (accepted and rejected).
Flow Log Configuration:
Ensure that the destination for the flow logs (e.g., CloudWatch Logs or S3) is properly configured. Specify the appropriate IAM role to allow VPC Flow Logs to publish logs to the destination.
Reference: VPC Flow Logs
Creating a Flow Log
Question #407
After creating a presigned URL for an S3 object, users can no longer access the file after a few days. (Select TWO):
- A . The presigned URL’s expiration date and time have passed.
- B . The SysOps administrator’s access key is no longer valid.
- C . The S3 bucket’s Block Public Access settings are enabled.
- D . The S3 object’s ACL does not include READ access for the All Users group.
- E . The S3 object’s ACL does not include READ_ACP access for the All Users group.
Correct Answer: A, B
A, B
Explanation:
The presigned URL expiration is the most common reason for access issues after some time. Additionally, if the SysOps administrator’s access key (used to generate the presigned URL) is invalid, the URL will no longer be usable. Block Public Access or ACL settings are irrelevant to presigned URLs.
A, B
Explanation:
The presigned URL expiration is the most common reason for access issues after some time. Additionally, if the SysOps administrator’s access key (used to generate the presigned URL) is invalid, the URL will no longer be usable. Block Public Access or ACL settings are irrelevant to presigned URLs.
Question #408
A database is running on an Amazon RDS Mufti-AZ DB instance. A recent security audit found the database to be out of compliance because it was not encrypted.
Which approach will resolve the encryption requirement?
- A . Log in to the RDS console and select the encryption box to encrypt the database
- B . Create a new encrypted Amazon EBS volume and attach it to the instance
- C . Encrypt the standby replica in the secondary Availability Zone and promote it to the primary instance.
- D . Take a snapshot of the RDS instance, copy and encrypt the snapshot and then restore to the new RDS instance
Correct Answer: D
D
Explanation:
Amazon RDS does not support enabling encryption for an existing unencrypted DB instance directly.
However, you can achieve encryption by following these steps:
Take a Snapshot of the RDS Instance:
Open the Amazon RDS console at Amazon RDS Console.
Select the DB instance, then choose Actions and Take snapshot.
Enter a name for the snapshot and take the snapshot.
Copy and Encrypt the Snapshot:
After the snapshot is complete, select the snapshot, choose Actions, and then Copy snapshot.
In the copy snapshot dialog, select the Enable encryption checkbox and choose a customer-managed CMK (Customer Master Key) or the default AWS managed key.
Restore the Encrypted Snapshot to a New RDS Instance:
Once the snapshot copy is complete, select the copied (encrypted) snapshot.
Choose Actions and Restore snapshot.
Provide the required details to launch a new DB instance from the encrypted snapshot.
Update Connections:
Update your application or endpoints to point to the new encrypted RDS instance.
Reference: Encrypting Amazon RDS Resources
Copying an Amazon RDS DB Snapshot
D
Explanation:
Amazon RDS does not support enabling encryption for an existing unencrypted DB instance directly.
However, you can achieve encryption by following these steps:
Take a Snapshot of the RDS Instance:
Open the Amazon RDS console at Amazon RDS Console.
Select the DB instance, then choose Actions and Take snapshot.
Enter a name for the snapshot and take the snapshot.
Copy and Encrypt the Snapshot:
After the snapshot is complete, select the snapshot, choose Actions, and then Copy snapshot.
In the copy snapshot dialog, select the Enable encryption checkbox and choose a customer-managed CMK (Customer Master Key) or the default AWS managed key.
Restore the Encrypted Snapshot to a New RDS Instance:
Once the snapshot copy is complete, select the copied (encrypted) snapshot.
Choose Actions and Restore snapshot.
Provide the required details to launch a new DB instance from the encrypted snapshot.
Update Connections:
Update your application or endpoints to point to the new encrypted RDS instance.
Reference: Encrypting Amazon RDS Resources
Copying an Amazon RDS DB Snapshot
Question #409
A company is using Amazon Elastic Container Sen/ice (Amazon ECS) to run a containerized application on Amazon EC2 instances. A SysOps administrator needs to monitor only traffic flows between the ECS tasks.
Which combination of steps should the SysOps administrator take to meet this requirement? (Select TWO.)
- A . Configure Amazon CloudWatch Logs on the elastic network interface of each task.
- B . Configure VPC Flow Logs on the elastic network interface of each task.
- C . Specify the awsvpc network mode in the task definition.
- D . Specify the bridge network mode in the task definition.
- E . Specify the host network mode in the task definition.
Correct Answer: BC
BC
Explanation:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking-awsvpc.html
To monitor traffic flows between ECS tasks, you need to use VPC Flow Logs and specify the awsvpc network mode in the task definition.
VPC Flow Logs:
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC.
Enable VPC Flow Logs on the elastic network interfaces (ENIs) used by the ECS tasks.
awsvpc Network Mode:
The awsvpc network mode gives each task its own ENI, allowing for more granular network monitoring and security controls.
This mode is required to capture detailed traffic flow information for each ECS task.
Reference: VPC Flow Logs
Amazon ECS Task Networking
BC
Explanation:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking-awsvpc.html
To monitor traffic flows between ECS tasks, you need to use VPC Flow Logs and specify the awsvpc network mode in the task definition.
VPC Flow Logs:
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC.
Enable VPC Flow Logs on the elastic network interfaces (ENIs) used by the ECS tasks.
awsvpc Network Mode:
The awsvpc network mode gives each task its own ENI, allowing for more granular network monitoring and security controls.
This mode is required to capture detailed traffic flow information for each ECS task.
Reference: VPC Flow Logs
Amazon ECS Task Networking
Question #410
A SysOps administrator launches an Amazon EC2 Linux instance in a public subnet. When the instance is running, the SysOps administrator obtains the public IP address and attempts to remotely connect to the instance multiple times. However, the SysOps administrator always receives a timeout error.
Which action will allow the SysOps administrator to remotely connect to the instance?
- A . Add a route table entry in the public subnet for the SysOps administrator’s IP address.
- B . Add an outbound network ACL rule to allow TCP port 22 for the SysOps administrator’s IP address.
- C . Modify the instance security group to allow inbound SSH traffic from the SysOps administrator’s IP address.
- D . Modify the instance security group to allow outbound SSH traffic to the SysOps administrator’s IP address.
Correct Answer: C
C
Explanation:
To remotely connect to the EC2 instance, the SysOps administrator must ensure that the security group allows inbound SSH traffic.
Modify the Security Group:
Navigate to the EC2 console.
Select the security group associated with the EC2 instance.
Add an inbound rule to allow SSH traffic (TCP port 22) from the SysOps administrator’s IP address.
Example rule:
Type: SSH
Protocol: TCP
Port Range: 22
Source: <SysOps Administrator’s IP Address>
Reference: Amazon EC2 Security Groups for Linux Instances
By modifying the security group to allow inbound SSH traffic from the administrator’s IP address, the SysOps administrator will be able to connect to the instance remotely.
C
Explanation:
To remotely connect to the EC2 instance, the SysOps administrator must ensure that the security group allows inbound SSH traffic.
Modify the Security Group:
Navigate to the EC2 console.
Select the security group associated with the EC2 instance.
Add an inbound rule to allow SSH traffic (TCP port 22) from the SysOps administrator’s IP address.
Example rule:
Type: SSH
Protocol: TCP
Port Range: 22
Source: <SysOps Administrator’s IP Address>
Reference: Amazon EC2 Security Groups for Linux Instances
By modifying the security group to allow inbound SSH traffic from the administrator’s IP address, the SysOps administrator will be able to connect to the instance remotely.