Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
Question #411
A SysOps administrator must create a solution that automatically shuts down any Amazon EC2 instances that have less than 10% average CPU utilization for 60 minutes or more.
Which solution will meet this requirement In the MOST operationally efficient manner?
- A . Implement a cron job on each EC2 instance to run once every 60 minutes and calculate the current CPU utilization. Initiate an instance shutdown If CPU utilization is less than 10%.
- B . Implement an Amazon CloudWatch alarm for each EC2 instance to monitor average CPU utilization. Set the period at 1 hour, and set the threshold at 10%. Configure an EC2 action on the alarm to stop the instance.
- C . Install the unified Amazon CloudWatch agent on each EC2 instance, and enable the Basic level predefined metric set. Log CPU utilization every 60 minutes, and initiate an instance shutdown if CPU utilization is less than 10%.
- D . Use AWS Systems Manager Run Command to get CPU utilization from each EC2 instance every 60 minutes. Initiate an instance shutdown if CPU utilization is less than 10%.
Correct Answer: B
B
Explanation:
To automatically shut down EC2 instances with low CPU utilization:
Create CloudWatch Alarms:
Go to the CloudWatch console and create an alarm for each EC2 instance.
Set the alarm to monitor the CPUUtilization metric with a period of 1 hour and a threshold of 10%.
Reference: Creating Amazon CloudWatch Alarms
Configure EC2 Action:
Configure the alarm to trigger an EC2 action that stops the instance when the alarm state is ALARM.
Reference: Stop EC2 Instances Using CloudWatch Alarms
This method is operationally efficient as it automates the monitoring and action without requiring manual intervention or additional infrastructure.
B
Explanation:
To automatically shut down EC2 instances with low CPU utilization:
Create CloudWatch Alarms:
Go to the CloudWatch console and create an alarm for each EC2 instance.
Set the alarm to monitor the CPUUtilization metric with a period of 1 hour and a threshold of 10%.
Reference: Creating Amazon CloudWatch Alarms
Configure EC2 Action:
Configure the alarm to trigger an EC2 action that stops the instance when the alarm state is ALARM.
Reference: Stop EC2 Instances Using CloudWatch Alarms
This method is operationally efficient as it automates the monitoring and action without requiring manual intervention or additional infrastructure.
Question #412
While setting up an AWS managed VPN connection, a SysOps administrator creates a customer gateway resource in AWS. The customer gateway device resides in a data center with a NAT gateway in front of it.
What address should be used to create the customer gateway resource?
- A . The private IP address of the customer gateway device
- B . The MAC address of the NAT device in front of the customer gateway device
- C . The public IP address of the customer gateway device
- D . The public IP address of the NAT device in front of the customer gateway device
Correct Answer: D
D
Explanation:
Step-by-Step
Understand the Problem:
Setting up an AWS managed VPN connection requires creating a customer gateway resource.
The customer gateway device is behind a NAT gateway in the data center.
Analyze the Requirements:
The customer gateway resource needs to be created using an IP address that can be reached by AWS.
Evaluate the Options:
Option A: The private IP address of the customer gateway device.
A private IP address is not reachable by AWS over the internet.
Option B: The MAC address of the NAT device.
MAC addresses are not used for identifying gateways in AWS.
Option C: The public IP address of the customer gateway device.
This would be correct if the device were directly connected to the internet, but it is behind a NAT.
Option D: The public IP address of the NAT device in front of the customer gateway device.
The NAT device’s public IP address is reachable by AWS and will route traffic to the customer gateway device.
Select the Best Solution:
Option D: Using the public IP address of the NAT device ensures that AWS can establish a VPN connection with the customer gateway device behind the NAT.
Reference: AWS Site-to-Site VPN Documentation
Customer Gateway Devices Behind a NAT
Specifying the public IP address of the NAT device ensures proper routing of VPN traffic to the customer gateway device.
D
Explanation:
Step-by-Step
Understand the Problem:
Setting up an AWS managed VPN connection requires creating a customer gateway resource.
The customer gateway device is behind a NAT gateway in the data center.
Analyze the Requirements:
The customer gateway resource needs to be created using an IP address that can be reached by AWS.
Evaluate the Options:
Option A: The private IP address of the customer gateway device.
A private IP address is not reachable by AWS over the internet.
Option B: The MAC address of the NAT device.
MAC addresses are not used for identifying gateways in AWS.
Option C: The public IP address of the customer gateway device.
This would be correct if the device were directly connected to the internet, but it is behind a NAT.
Option D: The public IP address of the NAT device in front of the customer gateway device.
The NAT device’s public IP address is reachable by AWS and will route traffic to the customer gateway device.
Select the Best Solution:
Option D: Using the public IP address of the NAT device ensures that AWS can establish a VPN connection with the customer gateway device behind the NAT.
Reference: AWS Site-to-Site VPN Documentation
Customer Gateway Devices Behind a NAT
Specifying the public IP address of the NAT device ensures proper routing of VPN traffic to the customer gateway device.
Question #413
A company has multiple AWS Site-to-Site VPN connections between a VPC and its branch offices. The company manages an Amazon Elasticsearch Service (Amazon ES) domain that is configured with public access. The Amazon ES domain has an open domain access policy. A SysOps administrator needs to ensure that Amazon ES can be accessed only from the branch offices while preserving existing data.
Which solution will meet these requirements?
- A . Configure an identity-based access policy on Amazon ES. Add an allow statement to the policy that includes the Amazon Resource Name (ARN) for each branch office VPN connection.
- B . Configure an IP-based domain access policy on Amazon ES. Add an allow statement to the policy that includes the private IP CIDR blocks from each branch office network.
- C . Deploy a new Amazon ES domain in private subnets in a VPC, and import a snapshot from the old domain. Create a security group that allows inbound traffic from the branch office CIDR blocks.
- D . Reconfigure the Amazon ES domain in private subnets in a VPC. Create a security group that allows inbound traffic from the branch office CIDR blocks.
Correct Answer: B
B
Explanation:
To ensure that Amazon Elasticsearch Service (Amazon ES) can be accessed only from the branch offices while preserving existing data, an IP-based domain access policy is the best approach. This allows you to restrict access to specific IP ranges.
Configure an IP-Based Domain Access Policy:
Navigate to the Amazon ES console.
Select the domain and go to the "Access policies" tab.
Update the Access Policy:
Edit the access policy to include an allow statement for the private IP CIDR blocks of each branch office.
Example policy:
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "es:*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"branch-office-cidr-1",
"branch-office-cidr-2"
]
}
}
}
]
}
Verify the Configuration:
Ensure that the policy correctly restricts access to the specified IP ranges. Test access from the branch offices to confirm connectivity.
Reference: Amazon Elasticsearch Service Access Control
Configuring Access Policies
B
Explanation:
To ensure that Amazon Elasticsearch Service (Amazon ES) can be accessed only from the branch offices while preserving existing data, an IP-based domain access policy is the best approach. This allows you to restrict access to specific IP ranges.
Configure an IP-Based Domain Access Policy:
Navigate to the Amazon ES console.
Select the domain and go to the "Access policies" tab.
Update the Access Policy:
Edit the access policy to include an allow statement for the private IP CIDR blocks of each branch office.
Example policy:
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "es:*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"branch-office-cidr-1",
"branch-office-cidr-2"
]
}
}
}
]
}
Verify the Configuration:
Ensure that the policy correctly restricts access to the specified IP ranges. Test access from the branch offices to confirm connectivity.
Reference: Amazon Elasticsearch Service Access Control
Configuring Access Policies
Question #414
A company hosts an online shopping portal in the AWS Cloud. The portal provides HTTPS security by using a TLS certificate on an Elastic Load Balancer (ELB). Recently, the portal suffered an outage because the TLS certificate expired. A SysOps administrator must create a solution to automatically renew certificates to avoid this issue in the future.
What is the MOST operationally efficient solution that meets these requirements?
- A . Request a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. Write a scheduled AWS Lambda function to renew the certificate every 18 months.
- B . Request a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
- C . Register a certificate with a third-party certificate authority (CA). Import this certificate into AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
- D . Register a certificate with a third-party certificate authority (CA). Configure the ELB to import the certificate directly from the CA. Set the certificate refresh cycle on the ELB to refresh when the certificate is within 3 months of the expiration date.
Correct Answer: B
B
Explanation:
"A certificate is eligible for automatic renewal subject to the following considerations: ELIGIBLE if associated with another AWS service, such as Elastic Load Balancing or CloudFront. ELIGIBLE if exported since being issued or last renewed. ELIGIBLE if it is a private certificate issued by calling the ACM RequestCertificate API and then exported or associated with another AWS service. ELIGIBLE if it is a private certificate issued through the management console and then exported or associated with another AWS service." https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html
B
Explanation:
"A certificate is eligible for automatic renewal subject to the following considerations: ELIGIBLE if associated with another AWS service, such as Elastic Load Balancing or CloudFront. ELIGIBLE if exported since being issued or last renewed. ELIGIBLE if it is a private certificate issued by calling the ACM RequestCertificate API and then exported or associated with another AWS service. ELIGIBLE if it is a private certificate issued through the management console and then exported or associated with another AWS service." https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html
Question #415
A company wants to build a solution for its business-critical Amazon RDS for MySQL database. The database requires high availability across different geographic locations. A SysOps administrator must build a solution to handle a disaster recovery (DR) scenario with the lowest recovery time objective (RTO) and recovery point objective (RPO).
Which solution meets these requirements?
- A . Create automated snapshots of the database on a schedule. Copy the snapshots to the DR Region.
- B . Create a cross-Region read replica for the database.
- C . Create a Multi-AZ read replica for the database.
- D . Schedule AWS Lambda functions to create snapshots of the source database and to copy the snapshots to a DR Region.
Correct Answer: B
B
Explanation:
To ensure high availability and disaster recovery for the RDS for MySQL database, follow these steps:
Create a Cross-Region Read Replica:
In the RDS console, create a cross-Region read replica of the primary database instance. This read replica will provide high availability and the lowest RTO and RPO in case of a disaster.
Reference: Creating a Read Replica in a Different AWS Region
This solution ensures that your database is replicated across regions, providing robust disaster recovery capabilities with minimal recovery time and data loss.
B
Explanation:
To ensure high availability and disaster recovery for the RDS for MySQL database, follow these steps:
Create a Cross-Region Read Replica:
In the RDS console, create a cross-Region read replica of the primary database instance. This read replica will provide high availability and the lowest RTO and RPO in case of a disaster.
Reference: Creating a Read Replica in a Different AWS Region
This solution ensures that your database is replicated across regions, providing robust disaster recovery capabilities with minimal recovery time and data loss.
Question #416
A company uses an Amazon CloudFront distribution to deliver its website Traffic togs for the website must be centrally stored and all data must be encrypted at rest
Which solution will meet these requirements?
- A . Create an Amazon OpenSearch Service (Amazon Elasttcsearch Service) domain with internet access and server-side encryption that uses the default AWS managed key Configure CloudFront to
use the Amazon OpenSearch Service (Amazon Elasticsearch Service) domain as a log destination - B . Create an Amazon OpenSearch Service (Amazon Elasticsearch Service) domain with VPC access and server-side encryption that uses AES-256 Configure CloudFront to use the Amazon OpenSearch Service (Amazon Elastcsearch Service) domain as a log destination
- C . Create an Amazon S3 bucket that is configured with default server side encryption that uses AES-256 Configure CloudFront to use the S3 bucket as a log destination
- D . Create an Amazon S3 bucket that is configured with no default encryption Enable encryption in the CloudFront dtstnbubon and use the S3 bucket as a log destination
Correct Answer: C
C
Explanation:
To centrally store traffic logs for the website and ensure all data is encrypted at rest, using an Amazon S3 bucket with default server-side encryption is the best solution.
Create an Amazon S3 Bucket with Server-Side Encryption:
Open the S3 console and create a new bucket.
In the bucket properties, enable default server-side encryption using AES-256.
Configure CloudFront to Use the S3 Bucket as a Log Destination:
Open the CloudFront console.
Select the CloudFront distribution and configure the logging settings.
Specify the S3 bucket as the log destination.
Server-Side Encryption:
Ensure that the S3 bucket is configured to use server-side encryption with AES-256 by default, ensuring that all logs stored are encrypted at rest.
Reference: Amazon S3 Server-Side Encryption
CloudFront Access Logs
C
Explanation:
To centrally store traffic logs for the website and ensure all data is encrypted at rest, using an Amazon S3 bucket with default server-side encryption is the best solution.
Create an Amazon S3 Bucket with Server-Side Encryption:
Open the S3 console and create a new bucket.
In the bucket properties, enable default server-side encryption using AES-256.
Configure CloudFront to Use the S3 Bucket as a Log Destination:
Open the CloudFront console.
Select the CloudFront distribution and configure the logging settings.
Specify the S3 bucket as the log destination.
Server-Side Encryption:
Ensure that the S3 bucket is configured to use server-side encryption with AES-256 by default, ensuring that all logs stored are encrypted at rest.
Reference: Amazon S3 Server-Side Encryption
CloudFront Access Logs
Question #417
A SysOps administrator is configuring an application on Amazon EC2 instances for a company Teams in other countries will use the application over the internet. The company requires the application endpoint to have a static pubic IP address.
How should the SysOps administrator deploy the application to meet this requirement?
- A . Behind an Amazon API Gateway API
- B . Behind an Application Load Balancer
- C . Behind an internet-facing Network Load Balancer
- D . In an Amazon CloudFront distribution
Correct Answer: C
C
Explanation:
To ensure that the application endpoint has a static public IP address, the SysOps administrator should deploy the application behind an internet-facing Network Load Balancer (NLB):
Network Load Balancer:
An NLB automatically provides a static IP address that can be associated with the load balancer. It supports static IP addresses for each Availability Zone and can handle a high number of requests per second.
Reference: Network Load Balancer Documentation
Configuration Steps:
Create an internet-facing NLB and configure the target groups to point to the EC2 instances running the application.
Assign Elastic IP addresses to the NLB for a static public IP.
Reference: Create an NLB
C
Explanation:
To ensure that the application endpoint has a static public IP address, the SysOps administrator should deploy the application behind an internet-facing Network Load Balancer (NLB):
Network Load Balancer:
An NLB automatically provides a static IP address that can be associated with the load balancer. It supports static IP addresses for each Availability Zone and can handle a high number of requests per second.
Reference: Network Load Balancer Documentation
Configuration Steps:
Create an internet-facing NLB and configure the target groups to point to the EC2 instances running the application.
Assign Elastic IP addresses to the NLB for a static public IP.
Reference: Create an NLB
Question #418
A SysOps administrator needs to secure the credentials for an Amazon RDS database that is created by an AWS CloudFormation template. The solution must encrypt the credentials and must support automatic rotation.
Which solution will meet these requirements?
- A . Create an AWS::SecretsManager::Secret resource in the CloudFormation template. Reference the credentials in the AWS::RDS::DBInstance resource by using the resolve:secretsmanager dynamic reference.
- B . Create an AWS::SecretsManager::Secret resource in the CloudFormation template. Reference the credentials in the AWS::RDS::DBInstance resource by using the resolve:ssm-secure dynamic reference.
- C . Create an AWS::SSM::Parameter resource in the CloudFormation template. Reference the credentials in the AWS::RDS::DBInstance resource by using the resolve:ssm dynamic reference.
- D . Create parameters for the database credentials in the CloudFormation template. Use the Ref intrinsic function to provide the credentials to the AWS::RDS::DBInstance resource.
Correct Answer: A
A
Explanation:
To securely manage and rotate the credentials for an Amazon RDS database created by a CloudFormation template, you should use AWS Secrets Manager. The AWS::SecretsManager::Secret resource can be used to create a secret, and the resolve:secretsmanager dynamic reference can be used to retrieve the secret.
Define Secrets Manager Resource in CloudFormation Template:
Add an AWS::SecretsManager::Secret resource to the CloudFormation template to store the database credentials.
Reference the Secret in RDS Resource:
Use the resolve:secretsmanager dynamic reference to retrieve the secret when creating the AWS::RDS::DBInstance resource.
Example CloudFormation Template:
MyDatabaseSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: MyDatabaseSecret
GenerateSecretString:
SecretStringTemplate: ‘{"username": "admin"}’
GenerateStringKey: "password"
PasswordLength: 16
ExcludeCharacters: ‘"@/\’
MyRDSInstance:
Type: AWS::RDS::DBInstance
Properties:
DBInstanceIdentifier: MyRDSInstance
Engine: mysql
MasterUsername: !Sub ‘{{resolve:secretsmanager:MyDatabaseSecret:SecretString:username}}’
MasterUserPassword: !Sub
‘{{resolve:secretsmanager:MyDatabaseSecret:SecretString:password}}’
DBInstanceClass: db.t2.micro
AllocatedStorage: 20
Reference: AWS::SecretsManager::Secret
Dynamic Reference
A
Explanation:
To securely manage and rotate the credentials for an Amazon RDS database created by a CloudFormation template, you should use AWS Secrets Manager. The AWS::SecretsManager::Secret resource can be used to create a secret, and the resolve:secretsmanager dynamic reference can be used to retrieve the secret.
Define Secrets Manager Resource in CloudFormation Template:
Add an AWS::SecretsManager::Secret resource to the CloudFormation template to store the database credentials.
Reference the Secret in RDS Resource:
Use the resolve:secretsmanager dynamic reference to retrieve the secret when creating the AWS::RDS::DBInstance resource.
Example CloudFormation Template:
MyDatabaseSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: MyDatabaseSecret
GenerateSecretString:
SecretStringTemplate: ‘{"username": "admin"}’
GenerateStringKey: "password"
PasswordLength: 16
ExcludeCharacters: ‘"@/\’
MyRDSInstance:
Type: AWS::RDS::DBInstance
Properties:
DBInstanceIdentifier: MyRDSInstance
Engine: mysql
MasterUsername: !Sub ‘{{resolve:secretsmanager:MyDatabaseSecret:SecretString:username}}’
MasterUserPassword: !Sub
‘{{resolve:secretsmanager:MyDatabaseSecret:SecretString:password}}’
DBInstanceClass: db.t2.micro
AllocatedStorage: 20
Reference: AWS::SecretsManager::Secret
Dynamic Reference
Question #419
A SysOps administrator is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units within the same company. All data must be encrypted at rest.
How should the administrator implement this process?
- A . Write a script to download the encrypted snapshot, decrypt it using the AWS KMS encryption key used to encrypt the snapshot, then create a new volume in each account.
- B . Update the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.
- C . Create an Amazon EC2 instance based on the snapshot, then save the instance’s Amazon EBS volume as a snapshot and share it with the other accounts. Require each account owner to create a new volume from that snapshot and encrypt it.
- D . Create a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RDP. export the database contents into a file, then share this file with the other accounts.
Correct Answer: B
B
Explanation:
To share Amazon RDS database snapshots between different accounts while ensuring all data is encrypted at rest, follow these steps:
Update the KMS Key Policy:
Navigate to the AWS KMS console.
Select the KMS key used to encrypt the RDS snapshots.
Update the key policy to grant the relevant AWS accounts permission to use the key.
Reference: Key policies in AWS KMS
Share the RDS Snapshot:
Navigate to the RDS console.
Select the snapshot you want to share and choose the "Share Snapshot" option.
Specify the AWS account IDs with which you want to share the snapshot.
Reference: Sharing a DB Snapshot
Access the Shared Snapshot in Target Accounts:
In the target AWS accounts, navigate to the RDS console.
Locate the shared snapshot under the "Snapshots" section.
Use the snapshot to create a new encrypted RDS instance in the target accounts.
By updating the key policy and sharing the snapshot, you ensure the encrypted data is securely accessible across different accounts within the organization.
B
Explanation:
To share Amazon RDS database snapshots between different accounts while ensuring all data is encrypted at rest, follow these steps:
Update the KMS Key Policy:
Navigate to the AWS KMS console.
Select the KMS key used to encrypt the RDS snapshots.
Update the key policy to grant the relevant AWS accounts permission to use the key.
Reference: Key policies in AWS KMS
Share the RDS Snapshot:
Navigate to the RDS console.
Select the snapshot you want to share and choose the "Share Snapshot" option.
Specify the AWS account IDs with which you want to share the snapshot.
Reference: Sharing a DB Snapshot
Access the Shared Snapshot in Target Accounts:
In the target AWS accounts, navigate to the RDS console.
Locate the shared snapshot under the "Snapshots" section.
Use the snapshot to create a new encrypted RDS instance in the target accounts.
By updating the key policy and sharing the snapshot, you ensure the encrypted data is securely accessible across different accounts within the organization.
Question #420
A software company runs a workload on Amazon EC2 instances behind an Application Load Balancer (ALB) A SysOcs administrator needs to define a custom health check for the EC2 instances.
What is the MOST operationally efficient solution?
- A . Set up each EC2 Instance so that it writes its healthy/unhealthy status into a shared Amazon S3 bucket for the ALB to read
- B . Configure the health check on the ALB and ensure that the HeathCheckPath setting is correct
- C . Set up Amazon ElasticCache to track the EC2 instances as they scale in and out
- D . Configure an Amazon API Gateway health check to ensure custom checks on aw of the EC2 instances
Correct Answer: B
B
Explanation:
To define a custom health check for EC2 instances behind an Application Load Balancer (ALB), follow these steps:
Configure Health Checks on ALB:
In the AWS Management Console, navigate to the EC2 dashboard, then to Load Balancers.
Select your ALB and go to the "Health Checks" tab.
Set the HealthCheckPath to the specific path that your application uses to determine if an instance is healthy. This could be a specific URL or endpoint on your application.
Reference: Health Checks for Your Target Groups
HealthCheckPath Setting:
Ensure that the endpoint specified in the HealthCheckPath is configured on each EC2 instance to respond with a status code that indicates health (typically 200 OK).
This involves setting up your application to handle health check requests properly.
Testing and Monitoring:
Test the health check configuration by simulating healthy and unhealthy states for your instances and verifying that the ALB responds correctly.
Monitor the health check status in the ALB dashboard to ensure it correctly reflects the health of your
instances.
By configuring the health check on the ALB and ensuring the HealthCheckPath setting is correct, you achieve an efficient and automated way to monitor the health of your EC2 instances, ensuring high availability and reliability of your application.
B
Explanation:
To define a custom health check for EC2 instances behind an Application Load Balancer (ALB), follow these steps:
Configure Health Checks on ALB:
In the AWS Management Console, navigate to the EC2 dashboard, then to Load Balancers.
Select your ALB and go to the "Health Checks" tab.
Set the HealthCheckPath to the specific path that your application uses to determine if an instance is healthy. This could be a specific URL or endpoint on your application.
Reference: Health Checks for Your Target Groups
HealthCheckPath Setting:
Ensure that the endpoint specified in the HealthCheckPath is configured on each EC2 instance to respond with a status code that indicates health (typically 200 OK).
This involves setting up your application to handle health check requests properly.
Testing and Monitoring:
Test the health check configuration by simulating healthy and unhealthy states for your instances and verifying that the ALB responds correctly.
Monitor the health check status in the ALB dashboard to ensure it correctly reflects the health of your
instances.
By configuring the health check on the ALB and ensuring the HealthCheckPath setting is correct, you achieve an efficient and automated way to monitor the health of your EC2 instances, ensuring high availability and reliability of your application.