Amazon SOA-C02 Practice Exams
Last updated on Oct 24,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 24,2026
The company wants to use three On-Demand Instances at all times and additional three Spot Instances when prices drop to a specific threshold, ensuring high availability with minimal management overhead.
- A . Configure a launch template for the Spot Instances. Set the maximum price for the Spot Instances.
Configure another launch template for the On-Demand Instances. - B . Configure a launch template that uses the InstanceMarketOptions property for the Spot Instances and the On-Demand Instances. Set the maximum price for the Spot Instances.
- C . Configure a launch template that uses the MixedInstancesPolicy property for the Spot Instances and the On-Demand Instances. Set the maximum price for the Spot Instances.
- D . Configure a launch template that uses the InstanceMarketOptions property and the MixedInstancesPolicy property for the Spot Instances and the On-Demand Instances. Set the maximum price for the Spot Instances.
C
Explanation:
The MixedInstancesPolicy feature in Auto Scaling groups allows for the configuration of both On-Demand and Spot Instances within a single Auto Scaling group, balancing cost savings and high availability:
MixedInstancesPolicy: Enables configuration to maintain a minimum of three On-Demand Instances and add Spot Instances when prices drop, without the need to create separate launch templates.
Setting Maximum Spot Price: Ensures that additional Spot Instances are launched only when within the defined budget.
This solution offers the least management overhead, as it combines both On-Demand and Spot instances seamlessly in one configuration.
A SysOps administrator needs EC2 instances in a VPC to resolve DNS names for hosts in an on-premises data center.
- A . Create an Amazon Route 53 private hosted zone. Populate the zone with the hostnames and IP addresses of the hosts in the on-premises data center.
- B . Create an Amazon Route 53 Resolver outbound endpoint. Add the IP addresses of an on-premises DNS server for the domain names that need to be forwarded.
- C . Set up a forwarding rule for reverse DNS queries in Amazon Route 53 Resolver. Set the enableDnsHostnames attribute to true for the VPC.
- D . Add the hostnames and IP addresses for the on-premises hosts to the /etc/hosts file of each EC2 instance.
B
Explanation:
The most efficient way to enable DNS resolution between the VPC and the on-premises environment is by configuring a Route 53 Resolver outbound endpoint.
Route 53 Resolver Outbound Endpoint: This enables the VPC to forward DNS queries to the on-premises DNS server, which can resolve internal hostnames.
Minimal Maintenance: This solution is scalable and requires minimal ongoing maintenance compared to manual entries or creating and managing a large number of DNS entries manually.
A company has an internal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone. A SysOps administrator must make the application highly available.
Which action should the SysOps administrator take to meet this requirement?
- A . Increase the maximum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
- B . Increase the minimum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
- C . Update the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.
- D . Update the Auto Scaling group to launch new instances in an Availability Zone in a second AWS Region.
C
Explanation:
To make an internal web application highly available, you should configure the Amazon EC2 Auto Scaling group to launch instances in multiple Availability Zones within the same AWS Region. This ensures that the application remains available even if one Availability Zone becomes unavailable.
Login to AWS Management Console:
Open the Amazon EC2 console at Amazon EC2 Console.
Update Auto Scaling Group:
In the navigation pane, choose Auto Scaling Groups.
Select the Auto Scaling group that you want to modify.
Choose Edit.
Add Multiple Availability Zones:
In the Availability Zones and subnets section, select at least one additional Availability Zone.
Ensure that the selected subnets belong to different Availability Zones.
Save Changes:
Save the configuration changes to update the Auto Scaling group.
Reference: Distributing Instances Across Multiple Availability Zones
Auto Scaling Groups
A company runs a stateless application that is hosted on an Amazon EC2 instance. Users are reporting performance issues. A SysOps administrator reviews the Amazon CloudWatch metrics for the application and notices that the instance’s CPU utilization frequently reaches 90% during business hours.
What is the MOST operationally efficient solution that will improve the application’s responsiveness?
- A . Configure CloudWatch logging on the EC2 instance. Configure a CloudWatch alarm for CPU utilization to alert the SysOps administrator when CPU utilization goes above 90%.
- B . Configure an AWS Client VPN connection to allow the application users to connect directly to the EC2 instance private IP address to reduce latency.
- C . Create an Auto Scaling group, and assign it to an Application Load Balancer. Configure a target tracking scaling policy that is based on the average CPU utilization of the Auto Scaling group.
- D . Create a CloudWatch alarm that activates when the EC2 instance’s CPU utilization goes above 80%. Configure the alarm to invoke an AWS Lambda function that vertically scales the instance.
C
Explanation:
To improve application responsiveness and handle high CPU utilization:
Create Auto Scaling Group:
Create an Auto Scaling group (ASG) for the EC2 instances running the application.
Reference: Auto Scaling Groups
Assign to Application Load Balancer:
Use an Application Load Balancer (ALB) to distribute traffic across the instances in the ASG.
Reference: Application Load Balancers
Configure Target Tracking Scaling Policy:
Set up a target tracking scaling policy based on average CPU utilization, for example, keeping CPU utilization around 50-60%.
Reference: Scaling Policies for Auto Scaling
This configuration ensures that the application scales out to handle increased load and improves performance during peak times.
A SysOps administrator must analyze Amazon CloudWatch logs across 10 AWS Lambda functions for historical errors. The logs are in JSON format and are stored in Amazon S3. Errors sometimes do not appear in the same field, but all errors begin with the same string prefix.
What is the MOST operationally efficient way for the SysOps administrator to analyze the log files?
- A . Use S3 Select to write a query to search for errors. Run the query across all log groups of interest.
- B . Create an AWS Glue processing job to index the logs of interest. Run a query in Amazon Athena to search for errors.
- C . Use Amazon CloudWatch Logs Insights to write a query to search for errors. Run the query across all log groups of interest.
- D . Use Amazon CloudWatch Contributor Insights to create a rule. Apply the rule across all log groups of interest.
B
Explanation:
To analyze CloudWatch logs across multiple AWS Lambda functions for historical errors, the most operationally efficient way is to use AWS Glue and Amazon Athena.
AWS Glue and Amazon Athena:
AWS Glue can crawl the data in S3, creating a catalog that makes it queryable. Amazon Athena allows you to run SQL queries on the data cataloged by AWS Glue. Steps to Implement:
Set up an AWS Glue crawler to index the logs stored in S3.
Configure the crawler to create a table in the AWS Glue Data Catalog.
Use Amazon Athena to query the table for errors using SQL. Since errors have a common string prefix, you can use SQL queries to filter and find these errors.
Reference: AWS Glue
Amazon Athena
A SysOps administrator is troubleshooting connection timeouts to an Amazon EC2 instance that has a public IP address. The instance has a private IP address of 172.31.16.139. When the SysOps administrator tries to ping the instance’s public IP address from the remote IP address 203.0.113.12, the response is "request timed out." The flow logs contain the following information:
What is one cause of the problem?
- A . Inbound security group deny rule
- B . Outbound security group deny rule
- C . Network ACL inbound rules
- D . Network ACL outbound rules
C
Explanation:
The issue of "request timed out" when pinging the public IP address of the EC2 instance could be due to the Network ACL (NACL) inbound rules.
Check NACL Inbound Rules:
Network ACLs act at the subnet level and can explicitly allow or deny traffic to or from a subnet.
Ensure that the NACL associated with the subnet containing the EC2 instance has inbound rules that allow ICMP traffic (which is used for ping).
Example rule to allow inbound ICMP traffic:
Rule Number: 100
Type: ICMP
Protocol: 1
Port Range: N/A (ICMP doesn’t use ports)
Source: 0.0.0.0/0 (or specific IP range)
Allow/Deny: ALLOW
Reference: Network ACLs
Verify Security Groups:
Although the most probable cause is NACLs, also ensure that the security group attached to the instance allows inbound ICMP traffic.
By allowing ICMP traffic in the NACL inbound rules, you can resolve the timeout issue when pinging the EC2 instance.
An organization with a large IT department has decided to migrate to AWS With different job functions in the IT department it is not desirable to give all users access to all AWS resources Currently the organization handles access via LDAP group membership
What is the BEST method to allow access using current LDAP credentials?
- A . Create an AWS Directory Service Simple AD Replicate the on-premises LDAP directory to Simple AD
- B . Create a Lambda function to read LDAP groups and automate the creation of IAM users
- C . Use AWS CloudFormation to create IAM roles Deploy Direct Connect to allow access to the on-premises LDAP server
- D . Federate the LDAP directory with IAM using SAML Create different IAM roles to correspond to different LDAP groups to limit permissions
D
Explanation:
To allow access using current LDAP credentials while migrating to AWS, the best approach is to federate the LDAP directory with IAM using SAML.
Set Up SAML-Based Federation:
AWS supports identity federation using SAML (Security Assertion Markup Language) 2.0. You need to configure your LDAP directory to federate with AWS IAM via SAML.
Reference: About SAML 2.0-based Federation
Create and Configure IAM Roles:
Create IAM roles in AWS that correspond to different LDAP groups. Each role should have the appropriate permissions for its specific job function.
Reference: Creating IAM Roles
Set Up Identity Provider in AWS:
Configure AWS as a SAML 2.0 identity provider. This involves setting up a trust relationship between AWS and your LDAP directory.
Reference: Creating and Managing a SAML Identity Provider Assign IAM Roles to SAML Provider:
Map the LDAP group membership to IAM roles. This allows users to assume the roles based on their LDAP group membership.
Reference: Configuring SAML Assertions for Role-Based Access Control
By federating the LDAP directory with IAM using SAML, the organization can leverage existing LDAP credentials and group memberships to manage access to AWS resources effectively.
A company’s SysOps administrator regularly checks the AWS Personal Health Dashboard in each of the company’s accounts. The accounts are part of an organization in AWS Organizations. The company recently added 10 more accounts to the organization. The SysOps administrator must consolidate the alerts from each account’s Personal Health Dashboard.
Which solution will meet this requirement with the LEAST amount of effort?
- A . Enable organizational view in AWS Health.
- B . Configure the Personal Health Dashboard in each account to forward events to a central AWS CloudTrail log.
- C . Create an AWS Lambda function to query the AWS Health API and to write all events to an Amazon DynamoDB table.
- D . Use the AWS Health API to write events to an Amazon DynamoDB table.
A
Explanation:
Enabling the organizational view in AWS Health will allow the SysOps administrator to consolidate the alerts from each account’s Personal Health Dashboard. It will also provide the administrator with a single view of all the accounts in the organization, allowing them to easily monitor the health of all the accounts in the organization.
Reference: [1] https://aws.amazon.com/premiumsupport/knowledge-center/organizational-view-health-dashboard/
A company hosts a web application on an Amazon EC2 instance in a production VPC. Client connections to the application are failing. A SysOps administrator inspects the VPC flow logs and finds the following entry:
2 111122223333 eni-<###> 192.0.2.15 203.0.113.56 40711 443 6 1 40 1418530010 1418530070 REJECT OK
What is a possible cause of these failed connections?
- A . A security group is denying traffic on port 443.
- B . The EC2 instance is shut down.
- C . The network ACL is blocking HTTPS traffic.
- D . The VPC has no internet gateway attached.
A
Explanation:
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-accepted-rejected
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#
Accepted and rejected traffic: In this example, RDP traffic (destination port 3389, TCP protocol) to network interface eni-1235b8ca123456789 in account 123456789010 was rejected. 2 123456789010 eni-1235b8ca123456789 172.31.9.69 172.31.9.12 49761 3389 6 20 4249 1418530010 1418530070 REJECT OK
A company has a stateful web application that is hosted on Amazon EC2 instances in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) that has a single target group. The ALB is configured as the origin in an Amazon CloudFront distribution. Users are reporting random logouts from the web application.
Which combination of actions should a SysOps administrator take to resolve this problem? (Select TWO.)
- A . Change to the least outstanding requests algorithm on the ALB target group.
- B . Configure cookie forwarding in the CloudFront distribution cache behavior.
- C . Configure header forwarding in the CloudFront distribution cache behavior.
- D . Enable group-level stickiness on the ALB listener rule.
- E . Enable sticky sessions on the ALB target group.
BE
Explanation:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html
You can configure each cache behavior to do one of the following: Forward all cookies to your origin
C CloudFront includes all cookies sent by the viewer when it forwards requests to the origin. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/sticky-sessions.html
By default, an Application Load Balancer routes each request independently to a registered target based on the chosen load-balancing algorithm.