VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ
Amazon

AWS Certified SysOps Administrator - Associate Free Sample Questions

Create a free account to browse all 12 sample questions. The full practice test includes 134 questions. Use the simulator for timed and flashcard mode. Or, view more alternate versions SOA-C03 240 Questions SOA-C01 54 Questions SOA-C02-2 957 Questions.

Try Simulator

SOA-C02 Sample Questions

  1. Q1

    A company hosts an internal application on Amazon EC2 instances. All application data and requests route through an AWS Site-to-Site VPN connection between the on-premises network and AWS. The company must monitor the application for changes that allow network access outside of the corporate network. Any change that exposes the application externally must be restricted automatically.

    Which solution meets these requirements in the MOST operationally efficient manner?

    Show answer & explanation

    Correct answer: A

    Lambda functions can automatically remediate security group changes by removing non-corporate CIDR ranges when triggered by VPC Flow Logs anomalies through CloudWatch alarms. This provides automated response to unauthorized network access attempts. AWS Config provides compliance monitoring but not automated remediation, and Systems Manager scheduling lacks real-time detection capabilities.

    Timed and flashcard mode in the Simulator
  2. Q2

    A SysOps administrator is setting up an automated process to recover an Amazon EC2 instance in the event of an underlying hardware failure. The recovered instance must have the same private IP address and the same Elastic IP address that the original instance had. The SysOps team must receive an email notification when the recovery process is initiated.Which solution will meet these requirements?

    Show answer & explanation

    Correct answer: A

    CloudWatch alarms with StatusCheckFailed_Instance metric can automatically recover EC2 instances during hardware failures while preserving both private IP addresses and attached Elastic IP addresses. The EC2 recover action migrates the instance to new hardware maintaining network configuration, while Auto Scaling groups would launch new instances with different IP addresses. Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-createalarm.html

    Timed and flashcard mode in the Simulator
  3. Q3

    A SysOps Administrator is managing a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group. The administrator wants to set an alarm for when all target instances associated with the ALB are unhealthy.

    Which condition should be used with the alarm?

    Show answer & explanation

    Correct answer: A

    HealthyHostCount = 1 would trigger when at least one instance is unhealthy (not all), and EC2 StatusCheckFailed metrics monitor individual instances rather than ALB target groups.

    Timed and flashcard mode in the Simulator
  4. Q4

    A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct 1AM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket.

    Which action will solve this problem while adhering to least privilege access?

    Show answer & explanation

    Correct answer: B

    S3 gateway endpoints allow private subnet instances to access S3 directly through the VPC without routing through internet gateways or NAT gateways, providing secure and cost-effective access. Routing private subnets through internet gateways violates network security principles, and NAT gateways in private subnets cannot provide internet access (they must be in public subnets).

    Timed and flashcard mode in the Simulator
  5. Q5Multiple answers

    A company's IT department noticed an increase in the spend of their developer AWS account. There are over 50 developers using the account, and the finance team wants to determine the service costs incurred by each developer.

    What should a SysOps administrator do to provide the finance team with the per-developer service cost breakdown?

    Show answer & explanation

    Correct answers: A, C

    Activating the createdBy tag enables cost allocation by individual developers, as AWS automatically tags resources with the IAM user who created them. Cost Explorer then allows filtering and analyzing costs by these tags to determine spending per developer. The createdBy tag is automatically populated by AWS with the IAM principal (user or role) that created the resource, making it ideal for tracking individual developer costs. Other options like aws:username require manual tagging, Owner is not an AWS-managed tag, and keyName is specific to EC2 key pairs, not general cost allocation.

    sequenceDiagram participant Dev as Developer participant IAM as IAM User participant AWS as AWS Service participant Tag as Cost Allocation Tag participant CE as Cost Explorer Dev->>IAM: Authenticates IAM->>AWS: Creates Resources AWS->>Tag: Auto-tags with createdBy Tag->>CE: Cost data with tags CE->>Finance: Per-developer cost reports
    Timed and flashcard mode in the Simulator
  6. Q6Multiple answers

    A company wants to be alerted through email when 1AM CreateUser API calls are made within its AWS account.

    Which combination of actions should a SysOps administrator take to meet this requirement? (Choose two.)

    Show answer & explanation

    Correct answers: A, D

    EventBridge rules with CloudTrail as the event source can detect IAM CreateUser API calls and trigger notifications. CloudTrail logs all API calls including IAM operations, making it the correct event source for monitoring CreateUser actions. IAM Access Analyzer is for resource sharing analysis, not API call monitoring, and CloudSearch is for search functionality, not event monitoring.

    SNS topics provide email notification capabilities for EventBridge events, allowing administrators to receive alerts when IAM CreateUser API calls occur. SES is primarily for sending marketing emails or transactional emails from applications, not for event-driven notifications from AWS services.

    Timed and flashcard mode in the Simulator

Register free to unlock 6 more sample questions

Create a free account to continue with the rest of the SOA-C02 sample set.

Lifetime One

Own this practice test forever.

$79.99
$75.99
one-time
  • Full access to 1,385 questions
  • Study, Timed & Flashcard Modes
  • All past and future versions i
  • Detailed Explanations
  • Study Tracking & Past Attempts
  • Brainy AI Assistant
  • Lifetime updates

Two

Any 2 exams per month.

$20.00/exam
$39.99
/month
  • 2 active exam slots
  • Study, Timed & Flashcard Modes
  • All past and future versions i
  • Detailed Explanations
  • Study Tracking & Past Attempts
  • 1,000 Brainy AI Credits
  • Cancel anytime
Popular

Pro Four

Any 4 exams per month.

$17.50/exam
$69.99
/month
  • 4 active exam slots
  • Study, Timed & Flashcard Modes
  • All past and future versions i
  • Detailed Explanations
  • Study Tracking & Past Attempts
  • 5,000 Brainy AI Credits
  • Dedicated support

Premium Twelve

Any 12 exams over 3 months.

$15.00/exam
$179.99
/3 months
  • 4 active exam slots
  • Study, Timed & Flashcard Modes
  • All past and future versions i
  • Detailed Explanations
  • Study Tracking & Past Attempts
  • 15,000 Brainy AI Credits
  • Dedicated support
  • Friend seat included — full access

Trusted by professionals at

NvidiaSupabaseGitHubOpenAITursoClerkClaude AIAmazon