Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company hosts a web application on an Amazon EC2 instance. The web server logs are published to Amazon CloudWatch Logs. The log events have the same structure and include the HTTP response codes that are associated with the user requests. The company needs to monitor the number of times that the web server returns an HTTP 404 response.
What is the MOST operationally efficient solution that meets these requirements?
- A . Create a CloudWatch Logs metric filter that counts the number of times that the web server returns an HTTP 404 response.
- B . Create a CloudWatch Logs subscription filter that counts the number of times that the web server returns an HTTP 404 response.
- C . Create an AWS Lambda function that runs a CloudWatch Logs Insights query that counts the number of 404 codes in the log events during the past hour.
- D . Create a script that runs a CloudWatch Logs Insights query that counts the number of 404 codes in the log events during the past hour.
A
Explanation:
This is the most operationally efficient solution that meets the requirements, as it will allow the company to monitor the number of times that the web server returns an HTTP 404 response in real-time. The other solutions (creating a CloudWatch Logs subscription filter, an AWS Lambda function, or a script) will require additional steps and resources to monitor the number of times that the web server returns an HTTP 404 response.
A metric filter allows you to search for specific terms, phrases, or values in your log events, and then to create a metric based on the number of occurrences of those search terms. This allows you to create a CloudWatch Metric that can be used to create alarms and dashboards, which can be used to monitor the number of HTTP 404 responses returned by the web server.
A fleet of servers must send local logs to Amazon CloudWatch.
How should the servers be configured to meet this requirement?
- A . Configure AWS Config to forward events to CloudWatch.
- B . Configure a Simple Network Management Protocol {SNMP) agent to forward events to CloudWatch.
- C . Install and configure the unified CloudWatch agent.
- D . Install and configure the Amazon Inspector agent.
C
Explanation:
To send local logs from a fleet of servers to Amazon CloudWatch:
Install the Unified CloudWatch Agent: The unified CloudWatch agent is capable of collecting both logs and metrics from servers. This agent supports various operating systems and can be configured according to specific logging requirements.
Configuration of the Agent: The agent’s configuration involves specifying which log files to monitor and how they should be processed. This configuration can be done manually or through the AWS Systems Manager for automated deployment across multiple servers.
Send Logs to CloudWatch: Once configured and running, the CloudWatch agent will continuously monitor the specified log files and send the log data to Amazon CloudWatch Logs, allowing you to view, search, and set alarms on log data.
This setup ensures a robust and scalable way to manage log data across a fleet of servers, leveraging AWS native services for seamless integration and management.
While setting up an AWS managed VPN connection, a SysOps administrator creates a customer gateway resource in AWS The customer gateway device resides in a data center with a NAT gateway in front of it
What address should be used to create the customer gateway resource?
- A . The private IP address of the customer gateway device
- B . The MAC address of the NAT device in front of the customer gateway device
- C . The public IP address of the customer gateway device
- D . The public IP address of the NAT device in front of the customer gateway device
D
Explanation:
When setting up an AWS managed VPN connection and creating a customer gateway resource, if the customer gateway device resides behind a NAT device, you should use the public IP address of the NAT device. This is because the VPN connection from AWS will be established to the public IP address that AWS can reach.
Identify the Public IP Address of the NAT Device:
Determine the public IP address assigned to the NAT device in front of the customer gateway.
Create Customer Gateway Resource:
Navigate to the VPC console in the AWS Management Console.
In the navigation pane, choose "Customer Gateways" and then click "Create Customer Gateway".
Enter a name for the customer gateway.
For the "IP Address", enter the public IP address of the NAT device.
Configure VPN Connection:
Create a VPN connection by navigating to the "VPN Connections" section and clicking "Create VPN Connection".
Select the created customer gateway and complete the VPN setup wizard.
Update Routing and Configuration:
Ensure that the routing configurations on both the AWS side and the on-premises side are updated to route traffic through the VPN connection.
Configure the customer gateway device (behind the NAT) to accept traffic from the NAT device and route it appropriately.
Reference: AWS Managed VPN Connections
Customer Gateway Resource
A company’s IT department noticed an increase in the spend of their developer AWS account. There are over 50 developers using the account, and the finance team wants to determine the service costs incurred by each developer.
What should a SysOps administrator do to collect this information? (Select TWO.)
- A . Activate the createdBy tag in the account.
- B . Analyze the usage with Amazon CloudWatch dashboards.
- C . Analyze the usage with Cost Explorer.
- D . Configure AWS Trusted Advisor to track resource usage.
- E . Create a billing alarm in AWS Budgets.
AC
Explanation:
To determine the service costs incurred by each developer, follow these steps:
Activate the createdBy Tag:
Tagging resources with a createdBy tag helps identify which user created the resource. This tag should be applied consistently across all resources created by the developers.
Reference: Tagging Your Resources
Analyze Usage with Cost Explorer:
Use Cost Explorer to filter and group cost and usage data by the createdBy tag. This provides a breakdown of costs incurred by each developer.
Reference: Analyzing Your Costs with Cost Explorer
These two steps together will provide a detailed analysis of the costs incurred by each developer in the AWS account.
A SysOps administrator has used AWS Cloud Formal ion to deploy a serverless application Into a production VPC. The application consists of an AWS Lambda function an Amazon DynamoDB table, and an Amazon API Gateway API. The SysOps administrator must delete the AWS Cloud Formation stack without deleting the DynamoDB table.
Which action should the SysOps administrator take before deleting the AWS Cloud Formation stack?
- A . Add a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack
- B . Add a Snapshot deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
- C . Enable termination protection on the AWS Cloud Formation stack.
- D . Update the application’s IAM policy with a Deny statement for the dynamodb:DeleteTabie action.
A
Explanation:
To delete the AWS CloudFormation stack without deleting the DynamoDB table, you need to apply a deletion policy to the DynamoDB resource. The Retain deletion policy ensures that the specified resource is not deleted when the stack is deleted. Instead, it is retained.
Steps:
Modify the CloudFormation Template:
Add a deletion policy to the DynamoDB table resource.
json
Copy code
{
"Resources": {
"MyDynamoDBTable": {
"Type": "AWS::DynamoDB::Table",
"DeletionPolicy": "Retain",
…
}
}
}
Reference: AWS CloudFormation DeletionPolicy Attribute
Update the Stack:
Update the CloudFormation stack with the modified template.
Reference: Updating a Stack
Delete the Stack:
Proceed to delete the stack. The DynamoDB table will be retained.
Reference: Deleting a Stack
A company wants to prohibit its developers from using a particular family of Amazon EC2 instances. The company uses AWS Organizations and wants to apply the restriction across multiple accounts
What is the MOST operationally efficient way for the company lo apply service control policies (SCPs) to meet these requirements?
- A . Add the accounts to an organizational unit (OUf Apply the SCPs to the OU.
- B . Add the accounts to resource groups in AWS Resource Groups. Apply the SCPs to the resource groups.
- C . Apply the SCPs to each developer account.
- D . Enroll the accounts with AWS Control Tower. Apply the SCPs to the AWS Control Tower management account.
A
Explanation:
Applying SCPs to an Organizational Unit:
Service Control Policies (SCPs) allow you to manage permissions for multiple AWS accounts within an organization.
Steps:
Go to the AWS Management Console.
Navigate to AWS Organizations.
Create an Organizational Unit (OU) if not already created.
Move the target accounts into the OU.
Create an SCP that denies the use of the specific EC2 instance family.
Attach the SCP to the OU.
This approach ensures that the policy is applied consistently across all accounts in the OU.
Reference: AWS Organizations SCPs
A company runs a web application on three Amazon EC2 instances behind an Application Load Balancer (ALB). The company notices that random periods of increased traffic cause a degradation in the application’s performance. A SysOps administrator must scale the application to meet the increased traffic.
Which solution meets these requirements?
- A . Create an Amazon CloudWatch alarm to monitor application latency and increase the size of each EC2 instance If the desired threshold is reached.
- B . Create an Amazon EventBridge (Amazon CloudWatch Events) rule to monitor application latency and add an EC2 instance to the ALB if the desired threshold is reached.
- C . Deploy the application to an Auto Scaling group of EC2 instances with a target tracking scaling policy. Attach the ALB to the Auto Scaling group.
- D . Deploy the application to an Auto Scaling group of EC2 instances with a scheduled scaling policy.
Attach the ALB to the Auto Scaling group.
C
Explanation:
Step-by-Step
Understand the Problem:
The web application experiences performance degradation during random periods of increased traffic.
Analyze the Requirements:
Implement a scalable solution to handle varying traffic loads. Maintain application performance during traffic spikes. Evaluate the Options:
Option A: Monitor application latency with CloudWatch alarm and increase instance size.
Manually resizing instances is not efficient for handling random traffic spikes.
Option B: Use EventBridge rule to add EC2 instance to ALB.
This approach is not as efficient as Auto Scaling for dynamic traffic management.
Option C: Deploy to an Auto Scaling group with target tracking scaling policy.
Automatically adjusts the number of instances based on traffic demand.
Ensures consistent application performance by scaling in response to traffic changes.
Option D: Deploy to an Auto Scaling group with scheduled scaling policy.
Suitable for predictable traffic patterns but not for random traffic spikes.
Select the Best Solution:
Option C: Using an Auto Scaling group with a target tracking scaling policy ensures the application scales dynamically based on traffic, maintaining performance.
Reference: Amazon EC2 Auto Scaling
Target Tracking Scaling Policies
Auto Scaling with a target tracking policy provides a robust solution for handling random traffic increases by dynamically adjusting the number of instances.
A SysOps administrator needs to implement a backup strategy for Amazon EC2 resources and Amazon RDS resources.
The backup strategy must meet the following retention requirements:
• Daily backups: must be kept for 6 days
• Weekly backups: must be kept for 4 weeks:
• Monthly backups: must be kept for 11 months
• Yearly backups: must be kept for 7 years
Which backup strategy will meet these requirements with the LEAST administrative effort?
- A . Use Amazon Data Lifecycle Manager to create an Amazon Elastic Block Store (Amazon EBS) snapshot policy. Create tags on each resource that needs to be backed up. Create multiple schedules according to the requirements within the policy. Set the appropriate frequency and retention period.
- B . Use AWS Backup to create a new backup plan for each retention requirement with a backup frequency of daily, weekly, monthly, or yearly. Set the retention period to match the requirement. Create tags on each resource that needs to be backed up. Set up resource assignment by using the tags.
- C . Create an AWS Lambda function. Program the Lambda function to use native tooling to take backups of file systems in Amazon EC2 and to make copies of databases in Amazon RDS. Create an Amazon EventBridge rule to invoke the Lambda function.
- D . Use Amazon Data Lifecycle Manager to create an Amazon Elastic Block Store (Amazon EBS) snapshot policy. Create tags on each resource that needs to be backed up. Set up resource assignment by using the tags. Create multiple schedules according to the requirements within the policy. Set the appropriate frequency and retention period. In Amazon RDS, activate automated backups on the required DB instances.
B
Explanation:
AWS Backup provides a centralized way to manage backups across AWS services. Here’s how to implement the required backup strategy with minimal administrative effort:
Create Backup Plans: Set up different backup plans in AWS Backup, each configured for a specific backup frequency―daily, weekly, monthly, and yearly.
Set Retention Periods: For each backup plan, configure the retention settings to align with the required retention durations: 6 days, 4 weeks, 11 months, and 7 years respectively.
Tag Resources: Apply tags to each EC2 and RDS resource that needs to be backed up. This allows for the automated inclusion of these resources in the respective backup plans based on their tags.
Assign Resources to Backup Plans: Use the tags to define which resources are included in each
backup plan, ensuring that all necessary resources are backed up according to the defined schedules and retention policies.
AWS Documentation
Reference: More details on setting up and managing AWS Backup can be found here: AWS Backup.
A company has launched a social media website that gives users the ability to upload images directly to a centralized Amazon S3 bucket. The website is popular in areas that are geographically distant from the AWS Region where the S3 bucket is located. Users are reporting that uploads are slow. A SysOps administrator must improve the upload speed.
What should the SysOps administrator do to meet these requirements?
- A . Create S3 access points in Regions that are closer to the users.
- B . Create an accelerator in AWS Global Accelerator for the S3 bucket.
- C . Enable S3 Transfer Acceleration on the S3 bucket.
- D . Enable cross-origin resource sharing (CORS) on the S3 bucket.
C
Explanation:
You might want to use Transfer Acceleration on a bucket for various reasons: ->Your customers upload to a centralized bucket from all over the world. ->You transfer gigabytes to terabytes of data on a regular basis across continents. ->You can’t use all of your available bandwidth over the internet when uploading to Amazon S3." https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html
A company has a simple web application that runs on a set of Amazon EC2 instances behind an Elastic Load Balancer in the eu-west-2 Region. Amazon Route 53 holds a DNS record for the application with a simple touting policy. Users from all over the world access the application through their web browsers.
The company needs to create additional copies of the application in the us-east-1 Region and in the ap-south-1 Region. The company must direct users to the Region that provides the fastest response times when the users load the application.
What should a SysOps administrator do to meet these requirements?
- A . In each new Region, create a new Elastic Load Balancer and a new set of EC2 Instances to run a copy of the application. Transition to a geolocation routing policy.
- B . In each new Region, create a copy of the application on new EC2 instances. Add these new EC2 instances to the Elastic Load Balancer in eu-west-2. Transition to a latency routing policy.
- C . In each new Region, create a copy of the application on new EC2 instances. Add these new EC2 instances to the Elastic Load Balancer in eu-west-2. Transition to a multivalue routing policy.
- D . In each new Region, create a new Elastic Load Balancer and a new set of EC2 instances to run a copy of the application. Transition to a latency routing policy.
D
Explanation:
To direct users to the region that provides the fastest response times, transitioning to a latency routing policy in Amazon Route 53 is the best solution.
Latency-Based Routing:
Latency-based routing allows you to route your traffic to the AWS region that provides the lowest latency.
Implementation:
In each new region (us-east-1 and ap-south-1), create a new Elastic Load Balancer and a new set of
EC2 instances to run a copy of the application.
Open the Route 53 console.
Select the hosted zone and choose "Create Record Set."
Create latency-based records pointing to the load balancers in each region.
Reference: Amazon Route 53 Latency-Based Routing