SOA-C02 Sample Questions & Answers
Monitoring, logging and remediating issues carries the biggest share, ahead of deployment and network connectivity tied together, backup and restore for reliability, responding to security threats, and cost and performance optimization.
Launch the full SOA-C02 simulator →Showing 6 of 12 free samples.
- Question 1Intermediate
A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct 1AM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket.
Which action will solve this problem while adhering to least privilege access?
Show answer & explanation
Correct answer: B
S3 gateway endpoints allow private subnet instances to access S3 directly through the VPC without routing through internet gateways or NAT gateways, providing secure and cost-effective access. Routing private subnets through internet gateways violates network security principles, and NAT gateways in private subnets cannot provide internet access (they must be in public subnets).
- Question 2IntermediateSelect 2
A company's IT department noticed an increase in the spend of their developer AWS account. There are over 50 developers using the account, and the finance team wants to determine the service costs incurred by each developer.
What should a SysOps administrator do to provide the finance team with the per-developer service cost breakdown?
Show answer & explanation
Correct answers: A, C
Activating the createdBy tag enables cost allocation by individual developers, as AWS automatically tags resources with the IAM user who created them. Cost Explorer then allows filtering and analyzing costs by these tags to determine spending per developer. The createdBy tag is automatically populated by AWS with the IAM principal (user or role) that created the resource, making it ideal for tracking individual developer costs. Other options like aws:username require manual tagging, Owner is not an AWS-managed tag, and keyName is specific to EC2 key pairs, not general cost allocation.
sequenceDiagram participant Dev as Developer participant IAM as IAM User participant AWS as AWS Service participant Tag as Cost Allocation Tag participant CE as Cost Explorer Dev->>IAM: Authenticates IAM->>AWS: Creates Resources AWS->>Tag: Auto-tags with createdBy Tag->>CE: Cost data with tags CE->>Finance: Per-developer cost reportsActivating the createdBy tag enables cost allocation by individual developers, as AWS automatically tags resources with the IAM user who created them. Cost Explorer then allows filtering and analyzing costs by these tags to determine spending per developer. The createdBy tag is automatically populated by AWS with the IAM principal (user or role) that created the resource, making it ideal for tracking individual developer costs. Other options like aws:username require manual tagging, Owner is not an AWS-managed tag, and keyName is specific to EC2 key pairs, not general cost allocation.
sequenceDiagram participant Dev as Developer participant IAM as IAM User participant AWS as AWS Service participant Tag as Cost Allocation Tag participant CE as Cost Explorer Dev->>IAM: Authenticates IAM->>AWS: Creates Resources AWS->>Tag: Auto-tags with createdBy Tag->>CE: Cost data with tags CE->>Finance: Per-developer cost reports - Question 3IntermediateSelect 2
A company wants to be alerted through email when 1AM CreateUser API calls are made within its AWS account.
Which combination of actions should a SysOps administrator take to meet this requirement? (Choose two.)
Show answer & explanation
Correct answers: A, D
EventBridge rules with CloudTrail as the event source can detect IAM CreateUser API calls and trigger notifications. CloudTrail logs all API calls including IAM operations, making it the correct event source for monitoring CreateUser actions. IAM Access Analyzer is for resource sharing analysis, not API call monitoring, and CloudSearch is for search functionality, not event monitoring.
SNS topics provide email notification capabilities for EventBridge events, allowing administrators to receive alerts when IAM CreateUser API calls occur. SES is primarily for sending marketing emails or transactional emails from applications, not for event-driven notifications from AWS services.
- Question 4IntermediateSelect 2
A company must ensure that any objects uploaded to an S3 bucket are encrypted.
Which of the following actions will meet this requirement? (Choose two.)
Show answer & explanation
Correct answers: C, E
S3 default encryption automatically encrypts all objects uploaded to the bucket using SSE-S3, SSE-KMS, or SSE-C, ensuring no unencrypted objects are stored. This provides a baseline encryption policy for the entire bucket. Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html
S3 bucket policies can explicitly deny PUT requests that lack encryption headers (x-amz-server-side-encryption), preventing unencrypted uploads at the API level. Combined with default encryption, this provides defense in depth. ACLs cannot control encryption requirements, Inspector is for security assessments not encryption enforcement, and Shield protects against DDoS attacks not encryption. Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html
- Question 5IntermediateSelect 2
A company has an Amazon RDS DB instance. The company wants to implement a caching service while maintaining high availability. Which combination of actionswill meet these requirements? (Choose two.)
Show answer & explanation
Correct answers: A, D
A, D
A, D
- Question 6Intermediate
A company has an infernal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone. A SysOps administrator must make the application highly available.
Which action should the SysOps administrator take to meet this requirement?
Show answer & explanation
Correct answer: C
C
Ready for the real thing?
The full SOA-C02 simulator has every exam-style question, timed mode, and instant scoring.