Amazon SOA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company wants to apply an existing Amazon Route 53 private hosted zone to a new VPC to allow for customized resource name resolution within the VPC. The Syspps administrator created the VPC and added the appropriate resource record sets to the private hosted zone.
Which step should the SysOps administrator take to complete the setup?
- A . Associate the Route 53 private hosted zone with the VPC.
- B . Create a rule in the default security group for the VPC that allows traffic to the Route 53 Resolver.
- C . Ensure the VPC network ACLs allow traffic to the Route 53 Resolver.
- D . Ensure there is a route to the Route 53 Resolver in each of the VPC route tables.
A
Explanation:
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html
To apply an existing Amazon Route 53 private hosted zone to a new VPC, the appropriate step is to associate the private hosted zone with the new VPC. This allows the resources within the VPC to use the custom DNS settings defined in the private hosted zone. Option A is the correct step to ensure that DNS queries from the new VPC are resolved using the specified private hosted zone. Detailed steps for this process can be found in the AWS Route 53 documentation on associating hosted zones with VPCs Associating Hosted Zones with VPCs.
A company wants to apply an existing Amazon Route 53 private hosted zone to a new VPC to allow for customized resource name resolution within the VPC. The Syspps administrator created the VPC and added the appropriate resource record sets to the private hosted zone.
Which step should the SysOps administrator take to complete the setup?
- A . Associate the Route 53 private hosted zone with the VPC.
- B . Create a rule in the default security group for the VPC that allows traffic to the Route 53 Resolver.
- C . Ensure the VPC network ACLs allow traffic to the Route 53 Resolver.
- D . Ensure there is a route to the Route 53 Resolver in each of the VPC route tables.
A
Explanation:
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html
To apply an existing Amazon Route 53 private hosted zone to a new VPC, the appropriate step is to associate the private hosted zone with the new VPC. This allows the resources within the VPC to use the custom DNS settings defined in the private hosted zone. Option A is the correct step to ensure that DNS queries from the new VPC are resolved using the specified private hosted zone. Detailed steps for this process can be found in the AWS Route 53 documentation on associating hosted zones with VPCs Associating Hosted Zones with VPCs.
A SysOps administrator is deploying a test site running on Amazon EC2 instances. The application requires both incoming and outgoing connectivity to the internet.
Which combination of steps are required to provide internet connectivity to the EC2 instances? (Choose two.)
- A . Add a NAT gateway to a public subnet.
- B . Attach a private address to the elastic network interface on the EC2 instance.
- C . Attach an Elastic IP address to the internet gateway.
- D . Add an entry to the route table for the subnet that points to an internet gateway.
- E . Create an internet gateway and attach it to a VPC.
DE
Explanation:
To provide both incoming and outgoing connectivity to the internet for EC2 instances, you need to ensure that the instances are in a subnet that has a route to an internet gateway.
Here are the required steps:
Create an Internet Gateway:
Open the Amazon VPC console at Amazon VPC Console.
In the navigation pane, choose Internet Gateways.
Choose Create Internet Gateway.
Enter a name for the internet gateway and choose Create.
Attach the internet gateway to your VPC by selecting the created internet gateway, then choosing Actions, and Attach to VPC.
Modify Route Table:
In the Amazon VPC console, go to the Route Tables section.
Select the route table associated with the subnet where your EC2 instances are located.
Choose Edit routes and add a new route:
Destination: 0.0.0.0/0
Target: Select the internet gateway you created.
These steps ensure that the instances can send and receive traffic to and from the internet.
Reference: Creating and Attaching an Internet Gateway
Route Tables
A company needs to view a list of security groups that are open to the internet on port 3389.
What should a SysOps administrator do to meet this requirement?
- A . Configure Amazon GuardDuty to scan security groups and report unrestricted access on port 3389.
- B . Configure a service control policy (SCP) to identify security groups that allow unrestricted access on port 3389.
- C . Use AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.
- D . Use AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389
D
Explanation:
To view a list of security groups that are open to the internet on port 3389, the most appropriate tool
is AWS Trusted Advisor.
AWS Trusted Advisor:
AWS Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices.
It includes a security check that identifies security groups with unrestricted access.
Using Trusted Advisor:
Go to the AWS Trusted Advisor console.
In the "Security" category, look for the check that identifies security groups with unrestricted access.
Review the report to find security groups that allow unrestricted access on port 3389 (RDP).
Reference: AWS Trusted Advisor
AWS Trusted Advisor Best Practices
A company has a web application with a database tier that consists of an Amazon EC2 instance that runs MySQL. A SysOps administrator needs to minimize potential data loss and the time that is required to recover in the event of a database failure.
What is the MOST operationally efficient solution that meets these requirements?
- A . Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric to invoke an AWS Lambda function that stops and starts the EC2 instance.
- B . Create an Amazon RDS for MySQL Multi-AZ DB instance. Use a MySQL native backup that is stored in Amazon S3 to restore the data to the new database. Update the connection string in the web application.
- C . Create an Amazon RDS for MySQL Single-AZ DB instance with a read replica. Use a MySQL native backup that is stored in Amazon S3 to restore the data to the new database. Update the connection string in the web application.
- D . Use Amazon Data Lifecycle Manager (Amazon DLM) to take a snapshot of the Amazon Elastic Block Store (Amazon EBS) volume every hour. In the event of an EC2 instance failure, restore the EBS volume from a snapshot.
B
Explanation:
Step-by-Step
Understand the Problem:
Minimize potential data loss and recovery time for a MySQL database running on an Amazon EC2 instance.
Analyze the Requirements:
Reduce the risk of data loss.
Ensure quick recovery in the event of a database failure.
Aim for operational efficiency.
Evaluate the Options:
Option A: Create a CloudWatch alarm to invoke a Lambda function that stops and starts the EC2 instance.
This addresses system failures but does not help with minimizing data loss or ensuring database redundancy.
Option B: Create an Amazon RDS for MySQL Multi-AZ DB instance and use a MySQL native backup stored in Amazon S3.
RDS Multi-AZ deployments provide high availability and durability by automatically replicating data to a standby instance in a different Availability Zone.
Using a MySQL native backup stored in Amazon S3 ensures data can be restored efficiently.
Option C: Create an RDS for MySQL Single-AZ DB instance with a read replica.
This provides read scalability but does not ensure high availability or failover capabilities.
Option D: Use Amazon DLM to take hourly snapshots of the EBS volume.
This helps with backups but does not provide immediate failover capabilities or minimize downtime effectively.
Select the Best Solution:
Option B: Using Amazon RDS for MySQL Multi-AZ ensures high availability and automated backups, significantly minimizing data loss and recovery time.
Reference: Amazon RDS Multi-AZ Deployments
Backing Up and Restoring an Amazon RDS DB Instance
Using Amazon RDS for MySQL Multi-AZ provides a highly available and durable solution with automated backups, ensuring minimal data loss and quick recovery.
A user is connected to an Amazon EC2 instance in a private subnet. The user is unable to access the internet from the instance by using the following curl command: curl http:/www.example.com.
A SysOps administrator reviews the VPC configuration and learns the following information:
• The private subnet has a route to a NAT gateway for CIDR 0.0.0.0/0
• The outbound security group for the EC2 instance contains one rule: outbound for port 443 to CIDR 0.0.0.0/0
• The inbound security group for the EC2 instance allows ports 22 and 443 from the user’s IP address.
• The inbound network ACL for the subnet allows port 22 and port range 1024-65535 from CIDR 0.0.0.0/0
Which action will allow the user to complete the curl request successfully?
- A . Add an additional inbound network ACL rule for port 80 to CIDR 0.0.0.0/0.
- B . Add an additional inbound security group rule for port 80 to CIDR 0.0.0.0/0.
- C . Add an additional outbound security group rule for port 80 to CIDR 0.0.0.0/0.
- D . Add an additional outbound security group rule for port 80 to the user’s IP address.
C
Explanation:
Since the EC2 instance is attempting to access the internet using HTTP (port 80) but is configured only to allow HTTPS (port 443) traffic, the security group needs adjustment:
Security Group Configuration: The outbound rules of the security group associated with the EC2 instance must allow traffic over HTTP. Add an outbound rule that enables port 80 to destination 0.0.0.0/0. This rule will allow the instance to send HTTP requests to any IP address on the internet.
Test Connectivity: After updating the security group, test the connectivity using the curl command again to ensure the configuration allows internet access via HTTP.
This change is necessary because the existing security group configuration does not permit outbound HTTP traffic, which is essential for accessing websites using HTTP.
A company is planning to host its stateful web-based applications on AWS A SysOps administrator is
using an Auto Scaling group of Amazon EC2 instances The web applications will run 24 hours a day 7 days a week throughout the year The company must be able to change the instance type within the same instance family later in the year based on the traffic and usage patterns
Which EC2 instance purchasing option will meet these requirements MOST cost-effectively?
- A . Convertible Reserved Instances
- B . On-Demand instances
- C . Spot instances
- D . Standard Reserved instances
A
Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ri-convertible-exchange.html
A company hosts a web portal on Amazon EC2 instances. The web portal uses an Elastic Load Balancer (ELB) and Amazon Route 53 for its public DNS service. The ELB and the EC2 instances are deployed by way of a single AWS CloudFormation stack in the us-east-1 Region. The web portal must be highly available across multiple Regions.
Which configuration will meet these requirements?
- A . Deploy a copy of the stack in the us-west-2 Region. Create a single start of authority (SOA) record in Route 53 that includes the IP address from each ELB. Configure the SOA record with health checks. Use the ELB in us-east-1 as the primary record and the ELB in us-west-2 as the secondary record.
- B . Deploy a copy of the stack in the us-west-2 Region. Create an additional A record in Route 53 that includes the ELB in us-west-2 as an alias target. Configure the A records with a failover routing policy and health checks. Use the ELB in us-east-1 as the primary record and the ELB in us-west-2 as the secondary record.
- C . Deploy a new group of EC2 instances in the us-west-2 Region. Associate the new EC2 instances with the existing ELB, and configure load balancer health checks on all EC2 instances. Configure the ELB to update Route 53 when EC2 instances in us-west-2 fail health checks.
- D . Deploy a new group of EC2 instances in the us-west-2 Region. Configure EC2 health checks on all EC2 instances in each Region. Configure a peering connection between the VPCs. Use the VPC in us-east-1 as the primary record and the VPC in us-west-2 as the secondary record.
B
Explanation:
When you create a hosted zone, Route 53 automatically creates a name server (NS) record and a start of authority (SOA) record for the zone.
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/migrate-dns-domain-in-use.html#migrate-dns-create-hosted-zone
https://en.wikipedia.org/wiki/SOA_record
The application is experiencing high VolumeQueueLength on an EC2 instance with a gp3 EBS volume, causing slow performance during I/O-intensive tasks.
- A . Attach an Amazon ElastiCache cluster to the EBS volume.
- B . Modify the EBS volume properties by enabling the Auto-Enabled IO volume attribute.
- C . Modify the EBS volume properties to increase the IOPS.
- D . Modify the EC2 instance to enable enhanced networking. Reboot the EC2 instance.
C
Explanation:
Increasing the IOPS for the gp3 EBS volume will address the high VolumeQueueLength by allowing more read/write operations, directly improving performance for I/O-intensive tasks. ElastiCache and enhanced networking do not directly affect EBS performance for this issue.
A SysOps administrator creates an AWS CloudFormation template to define an application stack that can be deployed in multiple AWS Regions.
The SysOps administrator also creates an Amazon CloudWatch dashboard by using the AWS Management Console. Each deployment of the application requires its own CloudWatch dashboard.
How can the SysOps administrator automate the creation of the CloudWatch dashboard each time the application is deployed?
- A . Create a script by using the AWS CLI to run the aws cloudformation put-dashboard command with the name of the dashboard. Run the command each time a new CloudFormation stack is created.
- B . Export the existing CloudWatch dashboard as JSON. Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Include the exported JSON in the resource’s DashboardBody property.
- C . Update the CloudFormation template to define an resource. Use the intrinsic Ref function to reference the ID of the existing CloudWatch dashboard.
- D . Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Specify the name of the existing dashboard in the DashboardName property.
B
Explanation:
You can only use the Intrinsic Ref function to reference a resource that is being created at the same time as the current CloudFormation template. The question states that the CloudWatch dashboard was previously created using the AWS Management Console, so there is no ID to reference the existing CloudWatch dashboard in the CloudFormation template. You would need to export the existing CloudWatch dashboard as JSON, then use the DashboardBody property in the CloudFormation template to replicate it upon each deployment
(https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure.html)