Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #71
A company wants to archive sensitive data on Amazon S3 Glacier. The company’s regulatory and compliance requirements do not allow any modifications to the data by any account.
Which solution meets these requirements?
- A . Attach a vault lock policy to an S3 Glacier vault that contains the archived data. Use the lock ID to validate the vault lock policy after 24 hours.
- B . Attach a vault lock policy to an S3 Glacier vault that contains the archived data. Use the lock ID to validate the vault lock policy within 24 hours.
- C . Configure S3 Object Lock in governance mode. Upload all files after 24 hours.
- D . Configure S3 Object Lock in governance mode. Upload all files within 24 hours.
Correct Answer: A
A
Explanation:
To meet regulatory and compliance requirements for archiving sensitive data on Amazon S3 Glacier with no modifications allowed by any account, attaching a vault lock policy to an S3 Glacier vault and validating the vault lock policy after 24 hours is the most appropriate solution.
Vault Lock Policy:
Amazon S3 Glacier Vault Lock allows you to easily deploy and enforce compliance controls for individual S3 Glacier vaults via a lockable policy.
You can specify controls such as Write Once Read Many (WORM) in a vault lock policy and lock the policy from future edits.
Implementing Vault Lock:
Attach a vault lock policy to the S3 Glacier vault that contains the archived data.
Initiate the vault lock process, which involves providing a policy and locking it after a validation period of 24 hours.
Steps:
Open the S3 Glacier console.
Select the vault and configure a vault lock policy with the required compliance controls.
Use the InitiateVaultLock API to set the policy and start the lock process.
Validate and complete the lock process after 24 hours using the lock ID.
Reference: Amazon S3 Glacier Vault Lock
Managing S3 Glacier Vault Lock Policies
A
Explanation:
To meet regulatory and compliance requirements for archiving sensitive data on Amazon S3 Glacier with no modifications allowed by any account, attaching a vault lock policy to an S3 Glacier vault and validating the vault lock policy after 24 hours is the most appropriate solution.
Vault Lock Policy:
Amazon S3 Glacier Vault Lock allows you to easily deploy and enforce compliance controls for individual S3 Glacier vaults via a lockable policy.
You can specify controls such as Write Once Read Many (WORM) in a vault lock policy and lock the policy from future edits.
Implementing Vault Lock:
Attach a vault lock policy to the S3 Glacier vault that contains the archived data.
Initiate the vault lock process, which involves providing a policy and locking it after a validation period of 24 hours.
Steps:
Open the S3 Glacier console.
Select the vault and configure a vault lock policy with the required compliance controls.
Use the InitiateVaultLock API to set the policy and start the lock process.
Validate and complete the lock process after 24 hours using the lock ID.
Reference: Amazon S3 Glacier Vault Lock
Managing S3 Glacier Vault Lock Policies
Question #72
A development team recently deployed a new version of a web application to production. After the release, penetration testing revealed a cross-site scripting vulnerability that could expose user data.
Which AWS service will mitigate this issue?
- A . AWS Shield Standard
- B . AWS WAF
- C . Elastic Load Balancing
- D . Amazon Cognito
Correct Answer: B
B
Explanation:
AWS WAF (Web Application Firewall) helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. AWS WAF can mitigate cross-site scripting (XSS) vulnerabilities by filtering and monitoring HTTP requests based
on custom rules.
Create a Web ACL:
Navigate to the AWS WAF console.
Create a new Web ACL and associate it with your application.
Add Rules to Mitigate XSS:
Use AWS Managed Rules for common threats, including XSS. Create custom rules to inspect requests and block malicious scripts. Associate Web ACL with Resources:
Attach the Web ACL to your CloudFront distribution, API Gateway, or Application Load Balancer to filter incoming requests.
Reference: AWS WAF Developer Guide
AWS WAF Managed Rules
B
Explanation:
AWS WAF (Web Application Firewall) helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. AWS WAF can mitigate cross-site scripting (XSS) vulnerabilities by filtering and monitoring HTTP requests based
on custom rules.
Create a Web ACL:
Navigate to the AWS WAF console.
Create a new Web ACL and associate it with your application.
Add Rules to Mitigate XSS:
Use AWS Managed Rules for common threats, including XSS. Create custom rules to inspect requests and block malicious scripts. Associate Web ACL with Resources:
Attach the Web ACL to your CloudFront distribution, API Gateway, or Application Load Balancer to filter incoming requests.
Reference: AWS WAF Developer Guide
AWS WAF Managed Rules
Question #73
A company has a memory-intensive application that runs on a fleet of Amazon EC2 instances behind an Elastic Load Balancer (ELB). The instances run in an Auto Scaling group. A Sysops administrator must ensure that the application can scale based on the number of users that connect to the application.
Which solution will meet these requirements?
- A . Create a scaling policy that will scale the application based on the ActiveConnectionCount Amazon CloudWatch metric that is generated from the ELB.
- B . Create a scaling policy that will scale the application based on the mem used Amazon CloudWatch metric that is generated from the ELB.
- C . Create a scheduled scaling policy to increase the number of EC2 instances in the Auto Scaling group to support additional connections.
- D . Create and deploy a script on the ELB to expose the number of connected users as a custom Amazon CloudWatch metric. Create a scaling policy that uses the metric.
Correct Answer: A
A
Explanation:
To ensure that the application can scale based on the number of users that connect to the application, the SysOps administrator should create a scaling policy that scales the application based on the ActiveConnectionCount Amazon CloudWatch metric generated from the ELB.
ActiveConnectionCount Metric:
The ActiveConnectionCount metric indicates the number of active connections to the ELB. By monitoring this metric, the application can scale in response to the number of users actively connected.
Steps to Implement:
Go to the Amazon EC2 Auto Scaling console.
Select the Auto Scaling group that manages the EC2 instances for the application.
Create a new scaling policy.
Set the policy to scale based on the ActiveConnectionCount metric from the ELB.
Reference: Elastic Load Balancing Metrics and Dimensions
Auto Scaling Policies
A
Explanation:
To ensure that the application can scale based on the number of users that connect to the application, the SysOps administrator should create a scaling policy that scales the application based on the ActiveConnectionCount Amazon CloudWatch metric generated from the ELB.
ActiveConnectionCount Metric:
The ActiveConnectionCount metric indicates the number of active connections to the ELB. By monitoring this metric, the application can scale in response to the number of users actively connected.
Steps to Implement:
Go to the Amazon EC2 Auto Scaling console.
Select the Auto Scaling group that manages the EC2 instances for the application.
Create a new scaling policy.
Set the policy to scale based on the ActiveConnectionCount metric from the ELB.
Reference: Elastic Load Balancing Metrics and Dimensions
Auto Scaling Policies
Question #74
A company has a mobile app that uses Amazon S3 to store images The images are popular for a week, and then the number of access requests decreases over time The images must be highly available and must be immediately accessible upon request A SysOps administrator must reduce S3 storage costs for the company.
Which solution will meet these requirements MOST cost-effectively?
- A . Create an S3 Lifecycle policy to transition the images to S3 Glacier after 7 days
- B . Create an S3 Lifecycle policy to transition the images to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 7 days
- C . Create an S3 Lifecycle policy to transition the images to S3 Standard after 7 days
- D . Create an S3 Lifecycle policy to transition the images to S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days
Correct Answer: D
D
Explanation:
To reduce S3 storage costs while ensuring the images remain highly available and immediately accessible, transitioning the images to S3 Standard-IA after 7 days is the most cost-effective solution.
Understand Storage Classes:
S3 Standard-IA (Infrequent Access) is designed for data that is accessed less frequently but requires rapid access when needed. It offers lower storage costs compared to S3 Standard, but higher retrieval costs.
Reference: Amazon S3 Storage Classes
Create a Lifecycle Policy:
Navigate to the S3 console and select the bucket storing the images.
Go to the "Management" tab and select "Lifecycle".
Create a new lifecycle rule. Set the rule to transition objects to S3 Standard-IA 7 days after creation.
Reference: Managing your storage lifecycle
Configure the Transition:
In the Lifecycle rule configuration, add a "Transition" action.
Specify the transition to S3 Standard-IA and set the number of days to 7.
Save and apply the rule.
This setup ensures that images are stored in the cost-effective S3 Standard-IA storage class after their initial period of high access, meeting the requirement of high availability and immediate access.
D
Explanation:
To reduce S3 storage costs while ensuring the images remain highly available and immediately accessible, transitioning the images to S3 Standard-IA after 7 days is the most cost-effective solution.
Understand Storage Classes:
S3 Standard-IA (Infrequent Access) is designed for data that is accessed less frequently but requires rapid access when needed. It offers lower storage costs compared to S3 Standard, but higher retrieval costs.
Reference: Amazon S3 Storage Classes
Create a Lifecycle Policy:
Navigate to the S3 console and select the bucket storing the images.
Go to the "Management" tab and select "Lifecycle".
Create a new lifecycle rule. Set the rule to transition objects to S3 Standard-IA 7 days after creation.
Reference: Managing your storage lifecycle
Configure the Transition:
In the Lifecycle rule configuration, add a "Transition" action.
Specify the transition to S3 Standard-IA and set the number of days to 7.
Save and apply the rule.
This setup ensures that images are stored in the cost-effective S3 Standard-IA storage class after their initial period of high access, meeting the requirement of high availability and immediate access.
Question #75
A SysOps administrator noticed that the cache hit ratio for an Amazon CloudFront distribution is less than 10%.
Which collection of configuration changes will increase the cache hit ratio for the distribution? (Select TWO.)
- A . Ensure that only required cookies, query strings, and headers are forwarded in the Cache Behavior Settings.
- B . Change the Viewer Protocol Policy to use HTTPS only.
- C . Configure the distribution to use presigned cookies and URLs to restrict access to the distribution.
- D . Enable automatic compression of objects in the Cache Behavior Settings.
- E . Increase the CloudFront time to live (TTL) settings in the Cache Behavior Settings.
Correct Answer: AE
AE
Explanation:
To increase the cache hit ratio for an Amazon CloudFront distribution, you can make several adjustments to its configuration:
Minimize Forwarding of Cookies, Query Strings, and Headers:
By default, CloudFront caches based on URL, but if it forwards headers, cookies, and query strings to the origin, it can decrease the cache hit ratio.
Navigate to your CloudFront distribution in the AWS Management Console.
In the Behaviors tab, edit the cache behavior.
Set the option to forward only the necessary cookies, query strings, and headers. This reduces the variations of objects stored in the cache.
Increase Time to Live (TTL) Settings:
Increasing the TTL allows objects to stay in the cache for a longer period, reducing the frequency of fetching data from the origin.
In the same Behaviors tab, adjust the Minimum TTL, Maximum TTL, and Default TTL settings to higher values. This ensures that content remains cached for a longer duration before it needs to be fetched again from the origin.
Reference: Cache Behavior Settings
Optimizing Cache Behavior
AE
Explanation:
To increase the cache hit ratio for an Amazon CloudFront distribution, you can make several adjustments to its configuration:
Minimize Forwarding of Cookies, Query Strings, and Headers:
By default, CloudFront caches based on URL, but if it forwards headers, cookies, and query strings to the origin, it can decrease the cache hit ratio.
Navigate to your CloudFront distribution in the AWS Management Console.
In the Behaviors tab, edit the cache behavior.
Set the option to forward only the necessary cookies, query strings, and headers. This reduces the variations of objects stored in the cache.
Increase Time to Live (TTL) Settings:
Increasing the TTL allows objects to stay in the cache for a longer period, reducing the frequency of fetching data from the origin.
In the same Behaviors tab, adjust the Minimum TTL, Maximum TTL, and Default TTL settings to higher values. This ensures that content remains cached for a longer duration before it needs to be fetched again from the origin.
Reference: Cache Behavior Settings
Optimizing Cache Behavior
Question #76
A company is running an application on a group of Amazon EC2 instances behind an Application Load Balancer The EC2 instances run across three Availability Zones The company needs to provide the customers with a maximum of two static IP addresses for their applications
How should a SysOps administrator meet these requirement?
- A . Add AWS Global Accelerator in front of the Application Load Balancer
- B . Add an internal Network Load Balancer behind the Application Load Balancer
- C . Configure the Application Load Balancer in only two Availability Zones.
- D . Create two Elastic IP addresses and assign them to the Application Load Balancer.
Correct Answer: A
A
Explanation:
AWS Global Accelerator:
AWS Global Accelerator is a service that improves the availability and performance of your applications with a global user base. It provides static IP addresses that act as a fixed entry point to your application endpoints (such as ALBs).
Steps:
Go to the AWS Management Console.
Navigate to Global Accelerator.
Click on "Create accelerator."
Configure the accelerator by providing a name and adding listeners.
Add your Application Load Balancer as an endpoint.
Allocate two static IP addresses.
This setup ensures that your application is accessible via two static IP addresses, fulfilling the requirement.
Reference: AWS Global Accelerator
A
Explanation:
AWS Global Accelerator:
AWS Global Accelerator is a service that improves the availability and performance of your applications with a global user base. It provides static IP addresses that act as a fixed entry point to your application endpoints (such as ALBs).
Steps:
Go to the AWS Management Console.
Navigate to Global Accelerator.
Click on "Create accelerator."
Configure the accelerator by providing a name and adding listeners.
Add your Application Load Balancer as an endpoint.
Allocate two static IP addresses.
This setup ensures that your application is accessible via two static IP addresses, fulfilling the requirement.
Reference: AWS Global Accelerator
Question #77
A company has created an AWS CloudFormation template that consists of the AWS: EC2 Instance resource and a custom Cloud Formation resource The custom CloudFormation resource is an AWS Lambda function that attempts to run automation on the Amazon EC2 instance.
During testing, the Lambda function fails because the Lambda function tries to run before the EC2 instance is launched
Which solution will resolve this issue?
- A . Add a DependsOn attribute to the custom resource. Specify the EC2 instance in the DependsOn attribute.
- B . Update the custom resource’s service token to point to a valid Lambda function
- C . Update the Lambda function to use the cfn-response module to send a response to the custom resource.
- D . Use the Fn::lf intrinsic function to check for the EC2 instance before the custom resource runs.
Correct Answer: A
A
Explanation:
DependsOn Attribute in CloudFormation:
The DependsOn attribute in AWS CloudFormation ensures that one resource is created only after
another resource has been successfully created. In this case, it ensures that the EC2 instance is fully launched before the custom resource (the Lambda function) is executed.
Steps:
Update the CloudFormation template to include the DependsOn attribute for the custom resource. Ensure that the custom resource references the EC2 instance.
Resources:
MyEC2Instance:
Type: AWS::EC2::Instance
Properties:
# EC2 properties
MyCustomResource:
Type: Custom::MyCustomResource
DependsOn: MyEC2Instance
Properties:
ServiceToken: !GetAtt MyLambdaFunction.Arn
# Other properties
Reference: AWS CloudFormation DependsOn Attribute
A
Explanation:
DependsOn Attribute in CloudFormation:
The DependsOn attribute in AWS CloudFormation ensures that one resource is created only after
another resource has been successfully created. In this case, it ensures that the EC2 instance is fully launched before the custom resource (the Lambda function) is executed.
Steps:
Update the CloudFormation template to include the DependsOn attribute for the custom resource. Ensure that the custom resource references the EC2 instance.
Resources:
MyEC2Instance:
Type: AWS::EC2::Instance
Properties:
# EC2 properties
MyCustomResource:
Type: Custom::MyCustomResource
DependsOn: MyEC2Instance
Properties:
ServiceToken: !GetAtt MyLambdaFunction.Arn
# Other properties
Reference: AWS CloudFormation DependsOn Attribute
Question #78
A company hosts several write-intensive applications. These applications use a MySQL database that runs on a single Amazon EC2 instance. The company asks a SysOps administrator to implement a highly available database solution that is ideal for multi-tenant workloads.
Which solution should the SysOps administrator implement to meet these requirements?
- A . Create a second EC2 instance for MySQL. Configure the second instance to be a read replica.
- B . Migrate the database to an Amazon Aurora DB cluster. Add an Aurora Replica.
- C . Migrate the database to an Amazon Aurora multi-master DB cluster.
- D . Migrate the database to an Amazon RDS for MySQL DB instance.
Correct Answer: B
B
Explanation:
To implement a highly available database solution that is ideal for multi-tenant workloads, migrating the database to an Amazon Aurora DB cluster and adding an Aurora Replica is the most suitable solution.
Amazon Aurora:
A fully managed relational database engine that’s compatible with MySQL and PostgreSQL. Provides high availability and durability through multiple replicas and automated failover.
Aurora Replicas:
Aurora Replicas share the same storage as the primary instance, providing increased read throughput and high availability.
In the event of a primary instance failure, an Aurora Replica can be promoted to primary.
Implementation Steps:
Migrate the MySQL database to an Amazon Aurora DB cluster.
Add one or more Aurora Replicas to the cluster to distribute read traffic and enhance availability.
Reference: Amazon Aurora
High Availability for Amazon Aurora
B
Explanation:
To implement a highly available database solution that is ideal for multi-tenant workloads, migrating the database to an Amazon Aurora DB cluster and adding an Aurora Replica is the most suitable solution.
Amazon Aurora:
A fully managed relational database engine that’s compatible with MySQL and PostgreSQL. Provides high availability and durability through multiple replicas and automated failover.
Aurora Replicas:
Aurora Replicas share the same storage as the primary instance, providing increased read throughput and high availability.
In the event of a primary instance failure, an Aurora Replica can be promoted to primary.
Implementation Steps:
Migrate the MySQL database to an Amazon Aurora DB cluster.
Add one or more Aurora Replicas to the cluster to distribute read traffic and enhance availability.
Reference: Amazon Aurora
High Availability for Amazon Aurora
Question #79
The SysOps administrator needs to prevent any account within an AWS Organization from leaving the organization.
- A . Create a service control policy (SCP) that denies the LeaveOrganization action. Apply the SCP to the root organizational unit (OU).
- B . Create a service control policy (SCP) that denies the RemoveAccountFromOrganization action.
Apply the SCP to the root organizational unit (OU). - C . Deploy an AWS Lambda function in each member account to remove any Organizations permissions when a user is created.
- D . Turn on AWS Config. Set up the account-part-of-organizations managed rule. Configure the rule to
run every hour.
Correct Answer: A
A
Explanation:
To prevent accounts from leaving an AWS Organization, an SCP that denies the LeaveOrganization action should be applied to the root organizational unit (OU).
Service Control Policy (SCP): By denying LeaveOrganization, member accounts are restricted from leaving the organization.
Root OU Application: Applying this policy at the root level ensures that no account in the organization can bypass it.
The RemoveAccountFromOrganization action pertains to removing an account by the organization’s management account rather than preventing member accounts from leaving. AWS Config’s account-part-of-organizations rule does not enforce this restriction but only monitors it.
A
Explanation:
To prevent accounts from leaving an AWS Organization, an SCP that denies the LeaveOrganization action should be applied to the root organizational unit (OU).
Service Control Policy (SCP): By denying LeaveOrganization, member accounts are restricted from leaving the organization.
Root OU Application: Applying this policy at the root level ensures that no account in the organization can bypass it.
The RemoveAccountFromOrganization action pertains to removing an account by the organization’s management account rather than preventing member accounts from leaving. AWS Config’s account-part-of-organizations rule does not enforce this restriction but only monitors it.
Question #80
A SysOps administrator has launched a large general purpose Amazon EC2 instance to regularly process large data files. The instance has an attached 1 TB General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volume. The instance also is EBS-optimized. To save costs, the SysOps administrator stops the instance each evening and restarts the instance each morning.
When data processing is active, Amazon CloudWatch metrics on the instance show a consistent 3.000 VolumeReadOps. The SysOps administrator must improve the I/O performance while ensuring data integrity.
Which action will meet these requirements?
- A . Change the instance type to a large, burstable, general purpose instance.
- B . Change the instance type to an extra large general purpose instance.
- C . Increase the EBS volume to a 2 TB General Purpose SSD (gp2) volume.
- D . Move the data that resides on the EBS volume to the instance store.
Correct Answer: C
C
Explanation:
Step-by-Step
Understand the Problem:
The EC2 instance processes large data files and uses a 1 TB General Purpose SSD (gp2) EBS volume.
CloudWatch metrics show consistent high VolumeReadOps.
The requirement is to improve I/O performance while ensuring data integrity.
Analyze the Requirements:
Improve I/O performance.
Maintain data integrity.
Evaluate the Options:
Option A: Change the instance type to a large, burstable, general-purpose instance.
Burstable instances provide a baseline level of CPU performance with the ability to burst to a higher level when needed. However, this does not address the I/O performance directly.
Option B: Change the instance type to an extra-large general-purpose instance.
A larger instance type might improve performance, but it does not directly address the I/O performance of the EBS volume.
Option C: Increase the EBS volume to a 2 TB General Purpose SSD (gp2) volume.
Increasing the size of a General Purpose SSD (gp2) volume can increase its IOPS. The larger the volume, the higher the baseline performance in terms of IOPS.
Option D: Move the data that resides on the EBS volume to the instance store.
Instance store volumes provide high I/O performance but are ephemeral, meaning data will be lost if the instance is stopped or terminated. This does not ensure data integrity.
Select the Best Solution:
Option C: Increasing the EBS volume size to 2 TB will provide higher IOPS, improving I/O performance while maintaining data integrity.
Reference: Amazon EBS Volume Types
General Purpose SSD (gp2) Volumes
Increasing the size of the General Purpose SSD (gp2) volume is an effective way to improve I/O performance while ensuring data integrity remains intact.
C
Explanation:
Step-by-Step
Understand the Problem:
The EC2 instance processes large data files and uses a 1 TB General Purpose SSD (gp2) EBS volume.
CloudWatch metrics show consistent high VolumeReadOps.
The requirement is to improve I/O performance while ensuring data integrity.
Analyze the Requirements:
Improve I/O performance.
Maintain data integrity.
Evaluate the Options:
Option A: Change the instance type to a large, burstable, general-purpose instance.
Burstable instances provide a baseline level of CPU performance with the ability to burst to a higher level when needed. However, this does not address the I/O performance directly.
Option B: Change the instance type to an extra-large general-purpose instance.
A larger instance type might improve performance, but it does not directly address the I/O performance of the EBS volume.
Option C: Increase the EBS volume to a 2 TB General Purpose SSD (gp2) volume.
Increasing the size of a General Purpose SSD (gp2) volume can increase its IOPS. The larger the volume, the higher the baseline performance in terms of IOPS.
Option D: Move the data that resides on the EBS volume to the instance store.
Instance store volumes provide high I/O performance but are ephemeral, meaning data will be lost if the instance is stopped or terminated. This does not ensure data integrity.
Select the Best Solution:
Option C: Increasing the EBS volume size to 2 TB will provide higher IOPS, improving I/O performance while maintaining data integrity.
Reference: Amazon EBS Volume Types
General Purpose SSD (gp2) Volumes
Increasing the size of the General Purpose SSD (gp2) volume is an effective way to improve I/O performance while ensuring data integrity remains intact.