Amazon SOA-C02 AWS Certified SysOps Administrator – Associate (SOA-C02) Free Practice Test — 30 Questions
This practice bank of 30 questions exercises your ability to design and troubleshoot AWS solutions across identity and access management, compute scaling, database backup and recovery, and cost optimization. You will evaluate IAM cross-account roles, ALB and NLB capacity planning, scaling strategies (scheduled, Auto Scaling, OpsWorks), RDS point-in-time restore, Reserved Instances vs. Savings Plans, WAF rule tuning, CloudTrail monitoring, KMS key rotation, CloudFront caching, and EBS performance. The questions require both quantitative calculation (IOPS, cost, instance count) and qualitative decision-making (least privilege, change management, compliance). Mastery of these topics is essential for the SOA-C02 SysOps Administrator Associate certification.
What this SOA-C02 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Security and Access Control
This section covers IAM cross-account roles with trust policies to enforce least privilege, MFA implementation and its effectiveness, WAF rule configurations for SQL injection and XSS, CloudTrail monitoring for IAM changes, KMS key rotation with IAM policies and CloudTrail logging, and GDPR-aligned data protection strategies. The questions test your ability to choose secure yet practical configurations that balance protection with operational efficiency.
- Create IAM roles in the target account with a trust policy allowing source account users to assume the role, not create direct IAM users.
- Enable CloudTrail for both management and data events and configure SNS notifications for real-time alerts on IAM policy changes.
- Use positive security models in WAF to allow known good traffic, combined with continuous monitoring and adjustment.
- Enable automatic annual key rotation in KMS and enforce strict IAM policies based on roles, with CloudTrail logging all key usage.
Compute and Load Balancing
This section addresses ALB and NLB capacity planning, sticky session trade-offs, Auto Scaling scheduled scaling, and right-sizing EC2 instances with Auto Scaling. Calculations for required instance counts based on request rates and per-instance capacity are key. The importance of distributing instances across multiple Availability Zones for high availability is emphasized.
- For ALB peak load of 10,000 requests/min with 200 requests/instance, provision at least 50 instances across multiple AZs.
- Sticky sessions can cause uneven load distribution; use them only when session state cannot be externalized.
- Scheduled scaling actions take effect after a short warm-up period; during that time the original instance count remains.
- Switching to a smaller instance type may cause performance degradation; use Auto Scaling to dynamically match demand.
Database and Backup
This section covers Amazon RDS automated backups for point-in-time recovery, retention periods, and the implications of restoration overwriting the current state. AWS Backup is also addressed, confirming that automated backups include transaction logs for PITR within the retention window. Multi-AZ deployments for high availability are a recurring theme.
- Restore an RDS database to a point 10 days ago using automated backups retained for 30 days; the process overwrites the current state.
- Automated backups include transaction logs, enabling restoration to any second within the retention period.
- For critical databases, deploy in Multi-AZ to ensure automatic failover and high availability.
- Manual snapshots are unnecessary for daily point-in-time recovery; automated backups suffice.
Cost Optimization and Automation
This section tests cost calculations for Reserved Instances and Savings Plans, EBS gp2 volume IOPS determination, and the use of AWS Systems Manager Patch Manager and CodeDeploy for automation. It also covers OpsWorks Stacks for multi-layer scaling and AWS CLI commands for dynamic region selection. Understanding discount percentages and volume size requirements is critical.
- A 3-year Standard RI at 30% discount on a $10k/month baseline yields $252,000 total (monthly cost $7,000 × 36 months).
- EBS gp2 volume of 200 GiB provides 600 IOPS (3 IOPS/GiB); to reach 1000 IOPS, increase to 334 GiB or switch to io1.
- Use `aws configure set region $ENVIRONMENT_REGION` in scripts to dynamically select region based on environment.
- Configure Patch Manager with a patch baseline including critical patches and apply them within 24 hours using a maintenance window.
Practice Amazon SOA-C02 AWS Certified SysOps Administrator – Associate (SOA-C02) with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 30-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
In a multi-account AWS environment, a company has implemented AWS Identity and Access Management (IAM) to manage user permissions across different accounts. The security team needs to ensure that developers can access specific resources in the production account without granting them full administrative privileges. They decide to create a role that allows developers to assume it when they need access. What is the most effective way to implement this role while ensuring that the principle of least privilege is maintained?
Study workflow
Turn one SOA-C02 attempt into a study plan
- 1
Calculate Required EC2 Capacity for a Load Balancer
Divide the peak requests per minute (or second) by the per-instance capacity. For high availability, add extra instances across multiple Availability Zones. For ALB, ensure instances are healthy and registered. For NLB, consider per-target capacity and round up to the next integer to handle variance.
- 2
Implement IAM Cross-Account Access with Least Privilege
In the production account, create an IAM role with only the permissions needed. In the role's trust policy, specify the development account's ARN and optionally condition on MFA. Then in the development account, attach a policy allowing users to call sts:AssumeRole. This grants temporary credentials without creating permanent users in production.
- 3
Configure RDS Point-in-Time Recovery
Ensure automated backups are enabled with a retention period longer than your target recovery point. To restore, use the AWS Console, CLI, or API, specifying the desired timestamp (up to seconds precision). The restored instance gets a new endpoint; the original instance remains unchanged unless you rename it. Update application connection strings accordingly.
- 4
Evaluate Reserved Instance vs. Savings Plan Costs
Calculate the discounted monthly cost by multiplying the on-demand monthly cost by (1 - discount rate). Multiply by the number of months in the term (36 for 3-year). Compare total costs across options; Savings Plans offer flexibility across instance families, while RIs provide deeper discounts for specific configurations. Consider usage predictability.
- 5
Automate Patching with AWS Systems Manager Patch Manager
Define a patch baseline that includes all required patches (critical, security, etc.). Associate the patch baseline with your instances or use a Default patch baseline. Create a maintenance window with a schedule (e.g., Sunday 2 AM UTC). Configure a Patch Manager task to run during that window. Use compliance reporting to verify patches are applied within the required timeframe.
FAQ
Questions about this SOA-C02 practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
What is the key difference between using an IAM role and an IAM user for cross-account access?+
An IAM role provides temporary credentials assumed by trusted accounts, enforcing least privilege and eliminating long-term keys. An IAM user has permanent credentials, which increases security risk and management overhead. Roles are the recommended approach for cross-account access.
How do I calculate the number of EC2 instances needed for an Application Load Balancer to handle a given peak request rate?+
Divide the peak requests per minute (or second) by the maximum requests each instance can handle. Add capacity for fault tolerance by distributing instances across multiple Availability Zones. For example, 10,000 requests/min with 200 per instance requires at least 50 instances.
Can I restore an Amazon RDS database to a specific time within the retention period using automated backups?+
Yes, automated backups include transaction logs, enabling point-in-time recovery to any second within the retention window. The restoration creates a new DB instance; the original remains unchanged. You can then direct traffic to the restored instance after updating connection strings.
What is the difference between a Reserved Instance and a Savings Plan for cost optimization?+
A Reserved Instance commits to a specific instance family and region for a 1- or 3-year term, offering a higher discount (e.g., 40%). A Savings Plan commits to a dollar amount per hour, with flexibility across instance families and regions, typically at a slightly lower discount (e.g., 20%).
How can I ensure that critical security patches are applied to EC2 instances within 24 hours of release?+
Create a patch baseline that includes all critical patches. Associate the baselines with your instances. Schedule a maintenance window every 24 hours (or more frequently) and configure a Patch Manager task to run during that window. Use compliance reports to confirm all instances are patched.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.