Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
Question #441
A SysOps administrator is optimizing the cost of a workload. The workload is running in multiple AWS Regions and is using AWS Lambda with Amazon EC2 On-Demand Instances for the compute. The overall usage is predictable. The amount of compute that is consumed in each Region varies, depending on the users’ locations.
Which approach should the SysOps administrator use to optimize this workload?
- A . Purchase Compute Savings Plans based on the usage during the past 30 days
- B . Purchase Convertible Reserved Instances by calculating the usage baseline.
- C . Purchase EC2 Instance Savings Plane based on the usage during the past 30 days
- D . Purchase Standard Reserved Instances by calculating the usage baseline.
Correct Answer: A
A
Explanation:
To optimize the cost of a workload running in multiple AWS Regions using AWS Lambda and EC2 On-Demand Instances, the SysOps administrator should purchase Compute Savings Plans based on the usage during the past 30 days.
Compute Savings Plans:
Compute Savings Plans provide the most flexibility and can be applied across various compute services such as EC2, AWS Lambda, and Fargate.
They offer significant savings compared to On-Demand pricing.
Analysis and Purchase:
Analyze the compute usage over the past 30 days to determine the baseline usage.
Purchase Compute Savings Plans based on this baseline to maximize savings while maintaining flexibility across different regions and compute services.
Reference: AWS Savings Plans
A
Explanation:
To optimize the cost of a workload running in multiple AWS Regions using AWS Lambda and EC2 On-Demand Instances, the SysOps administrator should purchase Compute Savings Plans based on the usage during the past 30 days.
Compute Savings Plans:
Compute Savings Plans provide the most flexibility and can be applied across various compute services such as EC2, AWS Lambda, and Fargate.
They offer significant savings compared to On-Demand pricing.
Analysis and Purchase:
Analyze the compute usage over the past 30 days to determine the baseline usage.
Purchase Compute Savings Plans based on this baseline to maximize savings while maintaining flexibility across different regions and compute services.
Reference: AWS Savings Plans
Question #442
The security team is concerned because the number of AWS Identity and Access Management (IAM) policies being used in the environment is increasing. The team tasked a SysOps administrator to report on the current number of IAM policies in use and the total available IAM policies.
Which AWS service should the administrator use to check how current IAM policy usage compares to current service limits?
- A . AWS Trusted Advisor
- B . Amazon Inspector
- C . AWS Config
- D . AWS Organizations
Correct Answer: A
A
Explanation:
Step-by-Step
Understand the Problem:
The security team is concerned about the increasing number of IAM policies.
The task is to report on the current number of IAM policies and compare them to the service limits.
Analyze the Requirements:
The solution should help in checking the usage of IAM policies against the service limits.
Evaluate the Options:
Option A: AWS Trusted Advisor
AWS Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices.
It includes a service limits check that alerts you when you are approaching the limits of your AWS service usage, including IAM policies.
Option B: Amazon Inspector
Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It does not report on IAM policy usage.
Option C: AWS Config
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. While useful for compliance, it does not provide a comparison against service limits.
Option D: AWS Organizations
AWS Organizations helps you centrally manage and govern your environment as you grow and scale your AWS resources. It does not provide insights into IAM policy limits.
Select the Best Solution:
Option A: AWS Trusted Advisor is the correct answer because it includes a service limits check that can report on the current number of IAM policies in use and compare them to the service limits.
Reference: AWS Trusted Advisor Documentation
IAM Service Limits
AWS Trusted Advisor is the appropriate tool for monitoring IAM policy usage and comparing it against service limits, providing the necessary insights to manage and optimize IAM policies effectively.
A
Explanation:
Step-by-Step
Understand the Problem:
The security team is concerned about the increasing number of IAM policies.
The task is to report on the current number of IAM policies and compare them to the service limits.
Analyze the Requirements:
The solution should help in checking the usage of IAM policies against the service limits.
Evaluate the Options:
Option A: AWS Trusted Advisor
AWS Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices.
It includes a service limits check that alerts you when you are approaching the limits of your AWS service usage, including IAM policies.
Option B: Amazon Inspector
Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It does not report on IAM policy usage.
Option C: AWS Config
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. While useful for compliance, it does not provide a comparison against service limits.
Option D: AWS Organizations
AWS Organizations helps you centrally manage and govern your environment as you grow and scale your AWS resources. It does not provide insights into IAM policy limits.
Select the Best Solution:
Option A: AWS Trusted Advisor is the correct answer because it includes a service limits check that can report on the current number of IAM policies in use and compare them to the service limits.
Reference: AWS Trusted Advisor Documentation
IAM Service Limits
AWS Trusted Advisor is the appropriate tool for monitoring IAM policy usage and comparing it against service limits, providing the necessary insights to manage and optimize IAM policies effectively.
Question #443
A recent organizational audit uncovered an existing Amazon RDS database that is not currently configured for high availability. Given the critical nature of this database, it must be configured for high availability as soon as possible.
How can this requirement be met?
- A . Switch to an active/passive database pair using the create-db-instance-read-replica with the — availability-zone flag.
- B . Specify high availability when creating a new RDS instance, and live-migrate the data.
- C . Modify the RDS instance using the console to include the Multi-AZ option.
- D . Use the modify-db-instance command with the –na flag.
Correct Answer: C
C
Explanation:
To configure an Amazon RDS database for high availability, you can use the Multi-AZ deployment option. Multi-AZ deployments provide enhanced availability and durability for RDS instances, making them a suitable choice for production environments. Here’s a step-by-step guide to achieve this:
Login to AWS Management Console:
Open the Amazon RDS console at Amazon RDS Console.
Select the RDS Instance:
In the navigation pane, choose Databases.
Select the database instance that you want to modify.
Modify the Instance:
Choose the Modify button.
In the Availability & durability section, select the option to enable Multi-AZ deployment.
Choose the appropriate instance class and storage settings if needed.
Apply Changes:
Review your settings, and then choose Continue.
Choose Apply immediately if you want the changes to take effect immediately. Otherwise, the changes will be applied during the next maintenance window.
Review and Confirm:
Confirm the changes and the instance will start modifying to a Multi-AZ deployment. This process might take some time, depending on the size of your database.
Reference: Modifying an Amazon RDS DB instance
Multi-AZ Deployments
C
Explanation:
To configure an Amazon RDS database for high availability, you can use the Multi-AZ deployment option. Multi-AZ deployments provide enhanced availability and durability for RDS instances, making them a suitable choice for production environments. Here’s a step-by-step guide to achieve this:
Login to AWS Management Console:
Open the Amazon RDS console at Amazon RDS Console.
Select the RDS Instance:
In the navigation pane, choose Databases.
Select the database instance that you want to modify.
Modify the Instance:
Choose the Modify button.
In the Availability & durability section, select the option to enable Multi-AZ deployment.
Choose the appropriate instance class and storage settings if needed.
Apply Changes:
Review your settings, and then choose Continue.
Choose Apply immediately if you want the changes to take effect immediately. Otherwise, the changes will be applied during the next maintenance window.
Review and Confirm:
Confirm the changes and the instance will start modifying to a Multi-AZ deployment. This process might take some time, depending on the size of your database.
Reference: Modifying an Amazon RDS DB instance
Multi-AZ Deployments
Question #444
An AWS Cloud Formation template creates an Amazon RDS instance This template is used to build up development environments as needed and then delete the stack when the environment is no longer required. The RDS-persisted data must be retained for further use. even after the Cloud Format ton stack is deleted
How can this be achieved in a reliable and efficient way?
- A . Write a script to continue backing up the RDS instance every live minutes.
- B . Create an AWS Lambda function to take a snapshot of the RDS instance, and manually invoke the function before deleting the stack.
- C . Use the Snapshot Deletion Policy in the Cloud Formation template definition of the RDS instance.
- D . Create a new CloudFormallon template to perform backups of the RDS instance, and run this template before deleting the stack.
Correct Answer: C
C
Explanation:
Snapshot Deletion Policy:
The Snapshot Deletion Policy ensures that a snapshot is created when an RDS instance is deleted as part of a CloudFormation stack deletion.
Steps:
Update your CloudFormation template to include the DeletionPolicy attribute for the RDS instance resource.
Example template snippet:
Resources:
MyDBInstance:
Type: AWS::RDS::DBInstance
Properties:
# DB instance properties DeletionPolicy: Snapshot
This configuration retains a snapshot of the RDS instance data when the stack is deleted.
Reference: AWS CloudFormation DeletionPolicy
C
Explanation:
Snapshot Deletion Policy:
The Snapshot Deletion Policy ensures that a snapshot is created when an RDS instance is deleted as part of a CloudFormation stack deletion.
Steps:
Update your CloudFormation template to include the DeletionPolicy attribute for the RDS instance resource.
Example template snippet:
Resources:
MyDBInstance:
Type: AWS::RDS::DBInstance
Properties:
# DB instance properties DeletionPolicy: Snapshot
This configuration retains a snapshot of the RDS instance data when the stack is deleted.
Reference: AWS CloudFormation DeletionPolicy
Question #445
A company wants to be alerted through email when IAM CreateUser API calls are made within its AWS account.
Which combination of actions should a SysOps administrator take to meet this requirement? (Choose two.)
- A . Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the event source and IAM CreateUser as the specific API call for the event pattern.
- B . Create an Amazon EventBridge (Amazon CloudWatch Events) rule with Amazon CloudSearch as the event source and IAM CreateUser as the specific API call for the event pattern.
- C . Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS IAM Access Analyzer as the event source and IAM CreateUser as the specific API call for the event pattern.
- D . Use an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email subscription.
- E . Use an Amazon Simple Email Service (Amazon SES) notification as an event target with an email subscription.
Correct Answer: AD
AD
Explanation:
To receive email notifications when IAM CreateUser API calls are made, you need to create an EventBridge rule that captures these events from CloudTrail and then routes them to an SNS topic that has an email subscription.
Enable CloudTrail:
Ensure AWS CloudTrail is enabled in your account to log API activity. Go to AWS CloudTrail Console and enable it if not already enabled.
Create SNS Topic:
Open the Amazon SNS console at Amazon SNS Console.
Create a new topic and name it (e.g., IAMCreateUserNotifications).
Create an email subscription for the topic by entering your email address and confirming the subscription via the email received.
Create EventBridge Rule:
Open the Amazon EventBridge console at Amazon EventBridge Console.
Create a new rule and provide a name and description.
For the Event source, select AWS events or EventBridge Schema.
In Event pattern, select AWS services and choose CloudTrail as the service.
Specify the event type as AWS API Call via CloudTrail.
In the Event source dropdown, select IAM and in the API operation, enter CreateUser.
Add Target:
Add a target and select SNS topic.
Choose the SNS topic you created earlier (IAMCreateUserNotifications).
Configure Permissions:
Ensure that the EventBridge rule has permission to publish to the SNS topic.
This configuration will trigger an email notification whenever an IAM CreateUser API call is made, keeping you informed of new user creations.
Reference: Creating an EventBridge Rule That Triggers on an Event
Setting Up a CloudWatch Event to Trigger SNS
Creating CloudTrail Event Rules
AD
Explanation:
To receive email notifications when IAM CreateUser API calls are made, you need to create an EventBridge rule that captures these events from CloudTrail and then routes them to an SNS topic that has an email subscription.
Enable CloudTrail:
Ensure AWS CloudTrail is enabled in your account to log API activity. Go to AWS CloudTrail Console and enable it if not already enabled.
Create SNS Topic:
Open the Amazon SNS console at Amazon SNS Console.
Create a new topic and name it (e.g., IAMCreateUserNotifications).
Create an email subscription for the topic by entering your email address and confirming the subscription via the email received.
Create EventBridge Rule:
Open the Amazon EventBridge console at Amazon EventBridge Console.
Create a new rule and provide a name and description.
For the Event source, select AWS events or EventBridge Schema.
In Event pattern, select AWS services and choose CloudTrail as the service.
Specify the event type as AWS API Call via CloudTrail.
In the Event source dropdown, select IAM and in the API operation, enter CreateUser.
Add Target:
Add a target and select SNS topic.
Choose the SNS topic you created earlier (IAMCreateUserNotifications).
Configure Permissions:
Ensure that the EventBridge rule has permission to publish to the SNS topic.
This configuration will trigger an email notification whenever an IAM CreateUser API call is made, keeping you informed of new user creations.
Reference: Creating an EventBridge Rule That Triggers on an Event
Setting Up a CloudWatch Event to Trigger SNS
Creating CloudTrail Event Rules
Question #446
A SysOps administrator needs to develop a solution that provides email notification and inserts a record into a database every time a file is put into an Amazon S3 bucket.
What is the MOST operationally efficient solution that meets these requirements?
- A . Set up an S3 event notification that targets an Amazon Simple Notification Service (Amazon SNS) topic Create two subscriptions for the SNS topic Use one subscription to send the email notification Use the other subscription to invoke an AWS Lambda function that inserts the record into the database
- B . Set up an Amazon CloudWatch alarm that enters ALARM state whenever an object is created in the S3 bucket Configure the alarm to invoke an AWS Lambda (unction that sends the email notification and inserts the record into the database
- C . Create an AWS Lambda function to send the email notification and insert the record into the database whenever a new object is detected in the S3 bucket invoke the function every minute with an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule.
- D . Set up two S3 event notifications Target a separate AWS Lambda function with each notification Configure one function to send the email notification Configure the other function to insert the record into the database
Correct Answer: A
A
Explanation:
The most operationally efficient solution to provide email notifications and insert a record into a database when a file is put into an S3 bucket is to use S3 event notifications that target an SNS topic with two subscriptions.
Set Up S3 Event Notification:
Open the S3 console and select the bucket.
Navigate to "Properties" -> "Event notifications" -> "Create event notification."
Configure the event to trigger on s3:ObjectCreated:*.
Create an SNS Topic:
Open the SNS console and create a new topic.
Set up two subscriptions for the SNS topic:
One subscription to send the email notification.
Another subscription to invoke an AWS Lambda function that inserts the record into the database.
Lambda Function for Database Insertion:
Create an AWS Lambda function to handle the database insertion. Configure the function to trigger from the SNS topic.
Reference: Configuring S3 Event Notifications
Amazon SNS Subscriptions
Invoking Lambda with SNS
A
Explanation:
The most operationally efficient solution to provide email notifications and insert a record into a database when a file is put into an S3 bucket is to use S3 event notifications that target an SNS topic with two subscriptions.
Set Up S3 Event Notification:
Open the S3 console and select the bucket.
Navigate to "Properties" -> "Event notifications" -> "Create event notification."
Configure the event to trigger on s3:ObjectCreated:*.
Create an SNS Topic:
Open the SNS console and create a new topic.
Set up two subscriptions for the SNS topic:
One subscription to send the email notification.
Another subscription to invoke an AWS Lambda function that inserts the record into the database.
Lambda Function for Database Insertion:
Create an AWS Lambda function to handle the database insertion. Configure the function to trigger from the SNS topic.
Reference: Configuring S3 Event Notifications
Amazon SNS Subscriptions
Invoking Lambda with SNS
Question #447
A company’s application on EC2 instances relies on a Single-AZ RDS for MySQL DB instance. The SysOps administrator needs to ensure failover to minimize downtime.
- A . Modify the DB instance to be a Multi-AZ DB instance deployment.
- B . Add a read replica in the same Availability Zone where the DB instance is deployed.
- C . Add the DB instance to an Auto Scaling group that has a minimum capacity of 2 and a desired capacity of 2.
- D . Use RDS Proxy to configure a proxy in front of the DB instance.
Correct Answer: A
A
Explanation:
To ensure high availability and failover for RDS, converting the instance to a Multi-AZ deployment is the best practice. Multi-AZ configurations provide automated standby in a different Availability Zone, automatically failing over to the standby in case of instance or Availability Zone issues.
Modify DB instance: AWS allows for seamless conversion of an existing Single-AZ RDS instance to a Multi-AZ deployment, making it more resilient to outages without requiring significant application changes.
Failover mechanism: In Multi-AZ, failover is managed automatically by AWS, minimizing application downtime.
A
Explanation:
To ensure high availability and failover for RDS, converting the instance to a Multi-AZ deployment is the best practice. Multi-AZ configurations provide automated standby in a different Availability Zone, automatically failing over to the standby in case of instance or Availability Zone issues.
Modify DB instance: AWS allows for seamless conversion of an existing Single-AZ RDS instance to a Multi-AZ deployment, making it more resilient to outages without requiring significant application changes.
Failover mechanism: In Multi-AZ, failover is managed automatically by AWS, minimizing application downtime.
Question #448
A company is attempting to manage its costs in the AWS Cloud. A SysOps administrator needs specific company-defined tags that are assigned to resources to appear on the billing report.
What should the SysOps administrator do to meet this requirement?
- A . Activate the tags as AWS generated cost allocation tags.
- B . Activate the tags as user-defined cost allocation tags.
- C . Create a new cost category. Select the account billing dimension.
- D . Create a new AWS Cost and Usage Report. Include the resource IDs.
Correct Answer: B
B
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/custom-tags.html "User-defined tags are tags that you define, create, and apply to resources. After you have created and applied the user-defined tags, you can activate by using the Billing and Cost Management console for cost allocation tracking. "
To meet this requirement, the SysOps administrator should activate the company-defined tags as user-defined cost allocation tags. This will ensure that the tags appear on the billing report and that the resources can be tracked with the specific tags. The other options (activating the tags as AWS generated cost allocation tags, creating a new cost category and selecting the account billing dimension, and creating a new AWS Cost and Usage Report and including the resource IDs) will not meet the requirements and are not the correct solutions for this issue.
B
Explanation:
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/custom-tags.html "User-defined tags are tags that you define, create, and apply to resources. After you have created and applied the user-defined tags, you can activate by using the Billing and Cost Management console for cost allocation tracking. "
To meet this requirement, the SysOps administrator should activate the company-defined tags as user-defined cost allocation tags. This will ensure that the tags appear on the billing report and that the resources can be tracked with the specific tags. The other options (activating the tags as AWS generated cost allocation tags, creating a new cost category and selecting the account billing dimension, and creating a new AWS Cost and Usage Report and including the resource IDs) will not meet the requirements and are not the correct solutions for this issue.
Question #449
A company is deploying an ecommerce application to an AWS Region that is located in France. The company wants users from only France to be able to access the first version of the application. The company plans to add more countries for the next version of the application. A SysOps administrator needs to configure the routing policy in Amazon Route 53.
Which solution will meet these requirements?
- A . Use a geoproximity routing policy. Select France as the location in the record.
- B . Use a geolocation routing policy. Select France as the location in the record.
- C . Use an IP-based routing policy. Select all IP addresses that are allocated to France in the record.
- D . Use a geoproximity routing policy. Select all IP addresses that are allocated to France in the record.
Correct Answer: B
B
Explanation:
To restrict access to an application based on geographic location (France in this case), the appropriate routing policy in Amazon Route 53 is geolocation routing. This policy allows you to specify traffic routing based on the geographic location of your users:
B: Use a geolocation routing policy. Select France as the location in the record. This ensures that only DNS queries originating from France are routed to the application, fulfilling the requirement to limit access to users within France initially. More information about setting up geolocation routing can be found in the AWS Route 53 documentation on geolocation routing Amazon Route 53 Geolocation Routing.
B
Explanation:
To restrict access to an application based on geographic location (France in this case), the appropriate routing policy in Amazon Route 53 is geolocation routing. This policy allows you to specify traffic routing based on the geographic location of your users:
B: Use a geolocation routing policy. Select France as the location in the record. This ensures that only DNS queries originating from France are routed to the application, fulfilling the requirement to limit access to users within France initially. More information about setting up geolocation routing can be found in the AWS Route 53 documentation on geolocation routing Amazon Route 53 Geolocation Routing.
Question #450
A SysOps administrator is provisioning an Amazon Elastic File System (Amazon EFS) file system to provide shared storage across multiple Amazon EC2 instances The instances all exist in the same VPC across multiple Availability Zones. There are two instances In each Availability Zone. The SysOps administrator must make the file system accessible to each instance with the lowest possible latency.
Which solution will meet these requirements?
- A . Create a mount target for the EFS file system in the VPC. Use the mount target to mount the file system on each of the instances
- B . Create a mount target for the EFS file system in one Availability Zone of the VPC. Use the mount target to mount the file system on the instances in that Availability Zone. Share the directory with the other instances.
- C . Create a mount target for each instance. Use each mount target to mount the EFS file system on each respective instance.
- D . Create a mount target in each Availability Zone of the VPC Use the mount target to mount the EFS file system on the Instances in the respective Availability Zone.
Correct Answer: D
D
Explanation:
A mount target provides an IP address for an NFSv4 endpoint at which you can mount an Amazon EFS file system. You mount your file system using its Domain Name Service (DNS) name, which resolves to the IP address of the EFS mount target in the same Availability Zone as your EC2 instance. You can create one mount target in each Availability Zone in an AWS Region. If there are multiple subnets in an Availability Zone in your VPC, you create a mount target in one of the subnets. Then all EC2 instances in that Availability Zone share that mount target. https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html
D
Explanation:
A mount target provides an IP address for an NFSv4 endpoint at which you can mount an Amazon EFS file system. You mount your file system using its Domain Name Service (DNS) name, which resolves to the IP address of the EFS mount target in the same Availability Zone as your EC2 instance. You can create one mount target in each Availability Zone in an AWS Region. If there are multiple subnets in an Availability Zone in your VPC, you create a mount target in one of the subnets. Then all EC2 instances in that Availability Zone share that mount target. https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html