Amazon AWS Certified SysOps Administrator (SOA-C01) Free Practice Test - 20 Questions
This practice bank exercises core SysOps skills across monitoring, networking, security, automation, and database management. It tests decision-making for CloudWatch alarms, IAM vs bucket policies, CloudTrail integrity validation, Auto Scaling lifecycle hooks, ELB connection draining, RDS backup retention, VPC Flow Logs, cross-account S3 access, CloudWatch Logs multi-line patterns, S3 lifecycle policies, instance metadata, Auto Scaling cooldowns, ALB access logs, Route53 failover, CloudFormation rollback, RDS read replica promotion, S3 event notifications, EC2 instance recovery, ELB sticky sessions, and Systems Manager Run Command. Mastery requires understanding service interactions and configuration specifics.
What this SOA-C01 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Monitoring and Logging
This section covers services that observe and record system behavior: CloudWatch, CloudTrail, VPC Flow Logs, and CloudWatch Logs agent. Custom metrics like MemoryUtilization require the CloudWatch agent installed on the instance to publish data; without it, alarms show INSUFFICIENT DATA. CloudTrail log file validation uses hash digests to ensure log files have not been tampered. VPC Flow Logs capture metadata about IP traffic, showing accept/reject decisions from security groups and NACLs. For multi-line log entries (e.g., stack traces), the CloudWatch Logs agent's multi_line_start_pattern option groups them into a single event.
- Custom metrics need CloudWatch agent installed on EC2.
- CloudTrail log file validation ensures integrity via hash digests.
- VPC Flow Logs capture network traffic metadata and rule decisions.
- Multi-line logs require multi_line_start_pattern in agent config.
Identity and Access Management
IAM policies and resource-based policies (e.g., S3 bucket policies) work together but have distinct evaluation logic. An explicit deny in an IAM policy overrides any allow from a bucket policy, resulting in denied access. For cross-account S3 access, the account owning the bucket must grant permissions via a bucket policy, and the consuming account must have an IAM policy allowing the actions. The IAM role does not need a trust policy for S3 operations; trust policies are for role assumption.
- Explicit deny always overrides allows; final decision is deny.
- Cross-account S3 requires both IAM policy and bucket policy.
- No trust policy needed for S3; trust is for assuming roles.
Compute and Auto Scaling
EC2 instance recovery uses a CloudWatch alarm on the StatusCheckFailed metric with the recovery action to automatically move the instance to a new host. Auto Scaling lifecycle hooks pause instance transitions to run custom scripts before the instance becomes InService. Cooldown periods prevent rapid scaling by setting a wait time after a scaling activity. User data runs on boot but may not wait for hooks. EC2 instances access user data via http://169.254.169.254/latest/user-data.
- EC2 recovery uses CloudWatch alarm on StatusCheckFailed.
- Lifecycle hooks pause transitions to run custom actions.
- Cooldown period dampens rapid scaling fluctuations.
- User data is accessed via the instance metadata service.
Storage and Database
S3 lifecycle policies apply based on object creation date relative to the policy effective date; objects created before the policy do not automatically transition unless specifically included. S3 event notifications can directly trigger Lambda on object uploads without CloudTrail. RDS automated backups are retained for 1 to 35 days; manual snapshots can be kept indefinitely. To promote a read replica to a primary after failure, use the promote read replica action, which stops replication and enables writes.
- S3 lifecycle policies only affect objects created after policy creation.
- S3 event notifications directly trigger Lambda on uploads.
- RDS automated backup max retention is 35 days.
- Promote read replica action makes it standalone writable.
Practice Amazon AWS Certified SysOps Administrator (SOA-C01) with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 20-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
A SysOps administrator configured a CloudWatch alarm on the MemoryUtilization metric for an EC2 instance. The alarm state remains 'INSUFFICIENT DATA' despite the instance running. What is the most likely cause?
Show hint
Monitor EC2 instances with CloudWatch
Study workflow
Turn one SOA-C01 attempt into a study plan
- 1
Configure CloudWatch Custom Metrics
Install the CloudWatch agent on each EC2 instance. Attach an IAM role with policies for publishing metrics to CloudWatch. Configure the agent to collect MemoryUtilization and other custom metrics. Verify data appears in CloudWatch metrics to avoid INSUFFICIENT DATA alarms.
- 2
Set Up Cross-Account S3 Access
In Account B (bucket owner), create a bucket policy that grants necessary S3 actions to the IAM role ARN from Account A. In Account A, attach an IAM policy to the role allowing the same S3 actions. Ensure no explicit deny in either policy. Test access.
- 3
Implement Auto Scaling Lifecycle Hooks
Create a lifecycle hook for the 'autoscaling:EC2_INSTANCE_LAUNCHING' event. Define an action type (e.g., Lambda function) to run your custom script. Ensure the Lambda has permission to complete the hook using the 'complete-lifecycle-action' API. Test the hook by launching a new instance.
- 4
Enable ELB Connection Draining
Access the target group settings for your Application Load Balancer. Set the 'Deregistration delay' (connection draining) value to a duration that allows in-flight requests to complete (e.g., 300 seconds). Save changes. Verify during scaling events that new requests stop and existing connections finish.
- 5
Use Systems Manager Run Command
Ensure each EC2 instance has the SSM Agent installed and an IAM role that allows SSM actions. Use Run Command in AWS Systems Manager to specify the script (e.g., 'sudo yum update -y'), select target instances by tags, and execute across multiple regions simultaneously. Monitor command output for success.
FAQ
Questions about this SOA-C01 practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Why is my CloudWatch alarm for MemoryUtilization showing INSUFFICIENT DATA?+
MemoryUtilization is a custom metric that requires the CloudWatch agent to be installed and publishing data. Without the agent, no data is sent, causing the insufficient data state. Install and configure the agent to resolve this.
How do I prevent my Auto Scaling group from rapidly scaling in and out?+
Adjust the cooldown period. Increase the time (default 300 seconds) after a scaling activity before another can start. This dampens the effect of fluctuating CPU utilization and prevents instability.
What is the difference between automated backups and manual snapshots for RDS?+
Automated backups are retained up to 35 days and are automatically deleted with the DB instance. Manual snapshots are not automatically deleted and can be retained indefinitely. Both are used for point-in-time recovery.
How can I route traffic to a secondary region if my primary site fails?+
Use Route53 failover routing policy. Create a primary record with a health check and a secondary record. If the health check fails, Route53 automatically routes traffic to the secondary resource.
What is the best way to run a script on multiple EC2 instances across regions?+
Use AWS Systems Manager Run Command. It allows you to run commands remotely on tagged instances without SSH, across multiple regions simultaneously. Ensure instances have the SSM Agent and appropriate IAM role.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.