Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
A company has a public website that recently experienced problems. Some links led to missing webpages, and other links rendered incorrect webpages. The application infrastructure was running properly, and all the provisioned resources were healthy. Application logs and dashboards did not show any errors, and no monitoring alarms were raised. Systems administrators were not aware of any problems until end users reported the issues.
The company needs to proactively monitor the website for such issues in the future and must implement a solution as soon as possible.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Rewrite the application to surface a custom error to the application log when issues occur. Automatically parse logs for errors. Create an Amazon CloudWatch alarm to provide alerts when issues are detected.
- B . Create an AWS Lambda function to test the website. Configure the Lambda function to emit an Amazon CloudWatch custom metric when errors are detected. Configure a CloudWatch alarm to provide alerts when issues are detected.
- C . Create an Amazon CloudWatch Synthetics canary. Use the CloudWatch Synthetics Recorder plugin to generate the script for the canary run. Configure the canary in line with requirements. Create an alarm to provide alerts when issues are detected.
C
Explanation:
Amazon CloudWatch Synthetics allows you to create canaries that monitor your endpoints and APIs. Canaries are scripts that run on a schedule to check your application’s availability and performance, and can detect issues before your customers do.
Create a CloudWatch Synthetics Canary:
Open the Amazon CloudWatch console at Amazon CloudWatch Console.
Navigate to Synthetics and choose Create Canary.
Use the CloudWatch Synthetics Recorder plugin to generate the script for the canary run.
Configure the Canary:
Define the schedule for the canary to run (e.g., every minute).
Specify the endpoint URL of the website.
Configure the canary to check for specific errors or issues based on your requirements.
Create Alarms:
Set up CloudWatch alarms to notify you when the canary detects issues. You can configure the alarm to send notifications via Amazon SNS.
Reference: Creating and Managing Canaries
CloudWatch Synthetics
A company website contains a web tier and a database tier on AWS. The web tier consists of Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones. The database tier runs on an Amazon ROS for MySQL Multi-AZ DB instance. The database subnet network ACLs are restricted to only the web subnets that need access to the database. The web subnets use the default network ACL with the default rules.
The company’s operations team has added a third subnet to the Auto Scaling group configuration. After an Auto Scaling event occurs, some users report that they intermittently receive an error
message. The error message states that the server cannot connect to the database. The operations team has confirmed that the route tables are correct and that the required ports are open on all security groups.
Which combination of actions should a SysOps administrator take so that the web servers can communicate with the DB instance? (Select TWO.)
- A . On the default ACL. create inbound Allow rules of type TCP with the ephemeral port range and the source as the database subnets.
- B . On the default ACL, create outbound Allow rules of type MySQL/Aurora (3306). Specify the destinations as the database subnets.
- C . On the network ACLs for the database subnets, create an inbound Allow rule of type MySQL/Aurora (3306). Specify the source as the third web subnet.
- D . On the network ACLs for the database subnets, create an outbound Allow rule of type TCP with the ephemeral port range and the destination as the third web subnet.
- E . On the network ACLs for the database subnets, create an outbound Allow rule of type MySQL/Aurora (3306). Specify the destination as the third web subnet.
CD
Explanation:
To ensure that the new web subnet can communicate with the database instance, follow these steps:
Create an Inbound Allow Rule for MySQL/Aurora (3306):
On the network ACL for the database subnets, add an inbound allow rule to permit traffic from the third web subnet on port 3306 (MySQL/Aurora).
Reference: Network ACLs
Create an Outbound Allow Rule for Ephemeral Ports:
On the network ACL for the database subnets, add an outbound allow rule to permit traffic to the third web subnet on the ephemeral port range (1024-65535).
Reference: Ephemeral Ports
These changes will ensure that the new subnet can communicate with the database, resolving the connectivity issues.
A company’s SysOps administrator needs to change the AWS Support plan for one of the company’s AWS accounts. The account has multi-factor authentication (MFA) activated, and the MFA device is lost.
What should the SysOps administrator do to sign in?
- A . Sign in as a root user by using email and phone verification. Set up a new MFA device. Change the root user password.
- B . Sign in as an 1AM user with administrator permissions. Resynchronize the MFA token by using the 1AM console.
- C . Sign in as an 1AM user with administrator permissions. Reset the MFA device for the root user by adding a new device.
- D . Use the forgot-password process to verify the email address. Set up a new password and MFA device.
A
Explanation:
If the MFA device for the root user is lost, you can regain access to the AWS account by using email and phone verification. AWS Support provides a process to recover root account access.
Recover Root Account Access:
Go to the AWS sign-in page and choose Root user.
Enter the root user email address.
On the MFA prompt page, choose Troubleshoot MFA.
Follow the prompts for email and phone verification to verify your identity.
Set Up a New MFA Device:
Once you regain access, navigate to the IAM console at IAM Console.
Go to the Users section and select the root user.
Set up a new MFA device.
Change the Root User Password:
It is recommended to change the root user password after recovering access for security reasons.
Reference: Enabling and Managing Virtual MFA Devices (AWS Management Console)
Troubleshooting Multi-Factor Authentication
A company is expanding globally and needs to back up data on Amazon Elastic Block Store (Amazon EBS) volumes to a different AWS Region. Most of the EBS volumes that store the data are encrypted, but some of the EBS volumes are unencrypted. The company needs the backup data from all the EBS volumes to be encrypted.
Which solution will meet these requirements with the LEAST management overhead?
- A . Configure a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM) to create the EBS volume snapshots with cross-Region backups enabled. Encrypt the snapshot copies by using AWS Key Management Service (AWS KMS).
- B . Create a point-in-time snapshot of the EBS volumes. When the snapshot status is COMPLETED, copy the snapshots to another Region and set the Encrypted parameter to False.
- C . Create a point-in-time snapshot of the EBS volumes. Copy the snapshots to an Amazon S3 bucket that uses server-side encryption. Turn on S3 Cross-Region Replication on the S3 bucket.
- D . Schedule an AWS Lambda function with the Python runtime. Configure the Lambda function to create the EBS volume snapshots, encrypt the unencrypted snapshots, and copy the snapshots to another Region.
A
Explanation:
Encrypt the snapshot copies by using AWS Key Management Service (AWS KMS). This solution will allow the company to automatically create encrypted snapshots of the EBS volumes and copy them to different AWS Regions with minimal effort.
A company updates its security policy to prohibit the public exposure of any data in Amazon S3 buckets in the company’s account.
What should a SysOps administrator do to meet this requirement?
- A . Turn on S3 Block Public Access from the account level.
- B . Create an Amazon EventBridge (Amazon CloudWatch Events) rule to enforce that all S3 objects are private.
- C . Use Amazon Inspector to search for S3 buckets and to automatically reset S3 ACLs if any public S3 buckets are found.
- D . Use S3 Object Lambda to examine S3 ACLs and to change any public S3 ACLs to private.
A
Explanation:
Using Amazon S3 Block Public Access as a centralized way to limit public access. Block Public Access settings override bucket policies and object permissions. Be sure to enable Block Public Access for all accounts and buckets that you don’t want publicly accessible.
https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/#:~:text=Using%20Amazon%20S3%20Block%20Public,don’t%20want%20publicly%20acces sible.
A SysOps administrator is investigating why a user has been unable to use RDP to connect over the internet from their home computer to a bastion server running on an Amazon EC2 Windows instance.
Which of the following are possible causes of this issue? (Choose two.)
- A . A network ACL associated with the bastion’s subnet is blocking the network traffic.
- B . The instance does not have a private IP address.
- C . The route table associated with the bastion’s subnet does not have a route to the internet gateway.
- D . The security group for the instance does not have an inbound rule on port 22.
- E . The security group for the instance does not have an outbound rule on port 3389.
AC
Explanation:
If a user is unable to connect to an EC2 instance via RDP, the issue could be related to network ACLs or route table configurations.
Network ACL Blocking Traffic:
A network ACL (NACL) associated with the bastion’s subnet might be blocking traffic on port 3389 (RDP).
Open the Amazon VPC console and navigate to Network ACLs.
Check the inbound and outbound rules for the NACL associated with the subnet. Ensure that port 3389 is allowed.
Route Table Missing Route to Internet Gateway:
The subnet’s route table may not have a route to the internet gateway, which is necessary for internet connectivity.
Open the Amazon VPC console and navigate to Route Tables.
Check the route table associated with the subnet. Ensure there is a route with destination 0.0.0.0/0 pointing to the internet gateway (igw-xxxxxxxx).
Ensuring proper configuration of network ACLs and route tables will enable the required internet connectivity for RDP access.
Reference: Network ACLs
Route Tables
A SysOps administrator is using AWS Systems Manager Patch Manager to patch a fleet of Amazon EC2 instances. The SysOps administrator has configured a patch baseline and a maintenance window. The SysOps administrator also has used an instance tag to identify which instances to patch.
The SysOps administrator must give Systems Manager the ability to access the EC2 instances.
Which additional action must the SysOps administrator perform to meet this requirement?
- A . Add an inbound rule to the instances’ security group.
- B . Attach an 1AM instance profile with access to Systems Manager to the instances.
- C . Create a Systems Manager activation Then activate the fleet of instances.
- D . Manually specify the instances to patch Instead of using tag-based selection.
B
Explanation:
To allow AWS Systems Manager Patch Manager to access your EC2 instances, you need to attach an IAM instance profile with the necessary permissions to the instances.
Create IAM Role for Systems Manager:
Open the IAM console at IAM Console.
Create a new role and choose EC2 as the trusted entity.
Attach the AmazonEC2RoleforSSM managed policy to the role.
Attach IAM Role to Instances:
Open the Amazon EC2 console at Amazon EC2 Console.
Select the instances that you want to manage with Systems Manager.
Choose Actions, then Instance Settings, and select Attach/Replace IAM Role.
Attach the IAM role you created.
This setup ensures that Systems Manager has the necessary permissions to manage the instances.
Reference: Setting Up AWS Systems Manager
Create an IAM Instance Profile for Systems Manager
A company needs to deploy a new workload on AWS. The company must encrypt all data at rest and must rotate the encryption keys once each year. The workload uses an Amazon RDS for MySQL Multi-AZ database for data storage.
Which configuration approach will meet these requirements?
- A . Enable Transparent Data Encryption (TDE) in the MySQL configuration file. Manually rotate the key every 12 months.
- B . Enable RDS encryption on the database at creation time by using the AWS managed key for Amazon RDS.
- C . Create a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable RDS encryption on the database at creation time by using the KMS key.
- D . Create a new AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the RDS DB instance.
C
Explanation:
This configuration approach will meet the requirement of encrypting all data at rest and rotating the encryption keys once each year. By creating a new AWS KMS customer managed key and enabling automatic key rotation, the encryption keys will be rotated automatically every year. By enabling RDS encryption on the database at creation time using the KMS key, all data stored in the RDS for MySQL Multi-AZ database will be encrypted at rest. This approach provide more control over key management and rotation and provide additional security benefits.
A company’s architeclure team must receive immediate email notification whenever new Amazon EC2 Instances are launched In the company’s main AWS production account
What should a SysOps administrator do to meet this requirement?
- A . Create a user data script that sends an email message through a smarx host connector Include the architecture team’s email address in the user data script as the recipient. Ensure that all new EC2 instances include the user data script as part of a standardized build process.
- B . Create an Amazon Simple Notification Service (Amazon SNS) topic and a subscription that uses the email protocol. Enter (he architecture team’s email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched Specify the SNS topic as the rule’s target
- C . Create an Amazon Simple Queue Service (Amazon SOS) queue and a subscription that uses the email protocol Enter the architecture team’s email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched Specify the SOS queue as the rule’s target
- D . Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure AWS Systems Manager to publish EC2 events to the SNS topic. Create an AWS Lambda function to poll the SNS topic. Configure the Lambda function to send any messages to the architecture team’s email address.
B
Explanation:
Create an SNS Topic and Subscription:
Amazon SNS allows you to send notifications to multiple endpoints.
Steps:
Go to the AWS Management Console.
Navigate to SNS and create a new topic.
Create a subscription for the topic using the email protocol.
Enter the architecture team’s email address as the subscriber.
Reference: Amazon SNS
Create an EventBridge Rule:
Amazon EventBridge can monitor events and trigger actions.
Steps:
Go to the AWS Management Console.
Navigate to EventBridge.
Create a new rule that reacts to EC2 instance launch events.
Specify the SNS topic as the rule’s target.
Reference: Amazon EventBridge
A SysOps administrator is investigating a company’s web application for performance problems The application runs on Amazon EC2 instances that are in an Auto Scaling group. The application receives large traffic increases at random times throughout the day. During periods of rapid traffic increases, the Auto Scaling group is not adding capacity fast enough. As a result, users are experiencing poor performance.
The company wants to minimize costs without adversely affecting the user experience when web traffic surges quickly. The company needs a solution that adds more capacity to me Auto Scaling group for larger traffic increases than for smaller traffic increases.
How should the SysOps administrator configure the Auto Scaling group to meet these requirements?
- A . Create a simple scaling policy with settings to make larger adjustments in capacity when the system is under heavy load
- B . Create a step scaling policy with settings to make larger adjustments in capacity when the system is under heavy load.
- C . Create a target tracking scaling policy with settings to make larger adjustments in capacity when the system is under heavy load
- D . Use Amazon EC2 Auto Scaling lifecycle hooks Adjust the Auto Scaling group’s maximum number of instances after every scaling event
B
Explanation:
Step Scaling Policy:
Step scaling policies allow you to define scaling actions based on different levels of CloudWatch alarms.
Steps:
Go to the AWS Management Console.
Navigate to EC2 Auto Scaling.
Select your Auto Scaling group.
Create or edit a scaling policy and choose "Step scaling."
Define different steps based on CloudWatch alarm thresholds (e.g., CPU usage or request count). Configure larger adjustments for higher thresholds and smaller adjustments for lower thresholds. Example Configuration:
For CPU > 80%, increase capacity by 4 instances.
For CPU > 60%, increase capacity by 2 instances.
For CPU > 40%, increase capacity by 1 instance.
Reference: Step Scaling for Amazon EC2 Auto Scaling