Free AWS Certified SysOps Administrator - Associate (SOA-C02) Exam Questions and Answers

Last updated: September 11, 2026

Exam code

SOA-C02

Provider

Amazon

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   - (Exam Topic 1) A SysOps administrator is helping a development team deploy an application to AWS Trie AWS CloudFormat on temp ate includes an Amazon Linux EC2 Instance an Amazon Aurora DB cluster and a hard coded database password that must be rotated every 90 days What is the MOST secure way to manage the database password?

   • A. Use the AWS SecretsManager Secret resource with the GenerateSecretString property to automatically generate a password Use the AWS SecretsManager
   • B. Use me AWS SecretsManager Secret resource with the SecretStrmg property Accept a password as a CloudFormation parameter Use the AllowedPatteen
   • C. Use the AWS SSM Parameter resource Accept input as a Qoudformatton parameter to store the parameter as a secure sting Configure the application to
   • D. Use the AWS SSM Parameter resource Accept input as a Cloudf ormetton parameter to store the parameter as a string Configure the application to retrieve the
   Reveal Answer

2. Question #2

   - (Exam Topic 1) A company has a simple web application that runs on a set of Amazon EC2 instances behind an Elastic Load Balancer in the eu-west-2 Region. Amazon Route 53 holds a DNS record for the application with a simple touting policy. Users from all over the world access the application through their web browsers. The company needs to create additional copies of the application in the us-east-1 Region and in the ap-south-1 Region. The company must direct users to the Region that provides the fastest response times when the users load the application. What should a SysOps administrator do to meet these requirements?

   • A. In each new Region, create a new Elastic Load Balancer and a new set of EC2 Instances to run a copy of the applicatio
   • B. Transition to a geolocation routing policy.
   • C. In each new Region, create a copy of the application on new EC2 instance
   • D. Add these new EC2 instances to the Elastic Load Balancer in eu-west-2. Transition to a latency routing policy.
   Reveal Answer

3. Question #3

   - (Exam Topic 1) A recent audit found that most resources belonging to the development team were in violation of patch compliance standards The resources were properly tagged Which service should be used to quickly remediate the issue and bring the resources back into compliance?

   • A. AWS Config
   • B. Amazon Inspector
   • C. AWS Trusted Advisor
   • D. AWS Systems Manager
   Reveal Answer

4. Question #4

   - (Exam Topic 1) A company uses AWS CloudFormation to deploy its application infrastructure Recently, a user accidentally changed a property of a database in a CloudFormation template and performed a stack update that caused an interruption to the application A SysOps administrator must determine how to modify the deployment process to allow the DevOps team to continue to deploy the infrastructure, but prevent against accidental modifications to specific resources. Which solution will meet these requirements?

   • A. Set up an AWS Config rule to alert based on changes to any CloudFormation stack An AWS Lambda function can then describe the stack to determine if any
   • B. Set up an Amazon CloudWatch Events event with a rule to trigger based on any CloudFormation API call An AWS Lambda function can then describe the stack
   • C. Launch the CloudFormation templates using a stack policy with an explicit allow for all resources and an explicit deny of the protected resources with an action
   • D. Attach an IAM policy to the DevOps team role that prevents a CloudFormation stack from updating, with a condition based on the specific Amazon Resource
   Reveal Answer

5. Question #5

   - (Exam Topic 1) An existing, deployed solution uses Amazon EC2 instances with Amazon EBS General Purpose SSD volumes, an Amazon RDS PostgreSQL database, an Amazon EFS file system, and static objects stored in an Amazon S3 bucket. The Security team now mandates that at-rest encryption be turned on immediately for all aspects of the application, without creating new resources and without any downtime. To satisfy the requirements, which one of these services can the SysOps administrator enable at-rest encryption on?

   • A. EBS General Purpose SSD volumes
   • B. RDS PostgreSQL database
   • C. Amazon EFS file systems
   • D. S3 objects within a bucket
   Reveal Answer

6. Question #6

   - (Exam Topic 1) A company has launched a social media website that gives users the ability to upload images directly to a centralized Amazon S3 bucket. The website is popular in areas that are geographically distant from the AWS Region where the S3 bucket is located. Users are reporting that uploads are slow. A SysOps administrator must improve the upload speed. What should the SysOps administrator do to meet these requirements?

   • A. Create S3 access points in Regions that are closer to the users.
   • B. Create an accelerator in AWS Global Accelerator for the S3 bucket.
   • C. Enable S3 Transfer Acceleration on the S3 bucket.
   • D. Enable cross-origin resource sharing (CORS) on the S3 bucket.
   Reveal Answer

7. Question #7

   - (Exam Topic 1) A company has an Amazon CloudFront distribution that uses an Amazon S3 bucket as its origin. During a review of the access logs, the company determines that some requests are going directly to the S3 bucket by using the website hosting endpoint. A SysOps administrator must secure the S3 bucket to allow requests only from CloudFront. What should the SysOps administrator do to meet this requirement?

   • A. Create an origin access identity (OAI) in CloudFron
   • B. Associate the OAI with the distributio
   • C. Remove access to and from other principals in the S3 bucket polic
   • D. Update the S3 bucket policy to allow access only from the OAI.
   Reveal Answer

8. Question #8

   - (Exam Topic 1) A company maintains a large set of sensitive data in an Amazon S3 bucket. The company's security team asks a SyeOps administrator to help verify that all current objects in the S3 bucket are encrypted. What is the MOST operationally efficient solution that meets these requirements?

   • A. Create a script that runs against the S3 bucket and outputs the status of each object.
   • B. Create an S3 Inventory configuration on the S3 bucket Induce the appropriate status fields.
   • C. Provide the security team with an IAM user that has read access to the S3 bucket.
   • D. Use the AWS CLI to output a list of all objects in the S3 bucket.
   Reveal Answer

9. Question #9

   - (Exam Topic 1) A company's SysOps administrator deploys four new Amazon EC2 instances by using the standard Amazon Linux 2 Amazon Machine Image (AMI). The company needs to be able to use AWS Systems Manager to manage the instances The SysOps administrator notices that the instances do not appear in the Systems Manager console What must the SysOps administrator do to resolve this issue?

   • A. Connect to each instance by using SSH Install Systems Manager Agent on each instance Configure Systems Manager Agent to start automatically when the
   • B. Use AWS Certificate Manager (ACM) to create a TLS certificate Import the certificate into each instance Configure Systems Manager Agent to use the TLS
   • C. Connect to each instance by using SSH Create an ssm-user account Add the ssm-user account to the/etcsudoers d directory
   • D. Attach an IAM instance profile to the instances Ensure that the instance profile contains the AmazonSSMManagedinstanceCore policy
   Reveal Answer

10. Question #10

    - (Exam Topic 1) A company needs to deploy a new workload on AWS. The company must encrypt all data at rest and must rotate the encryption keys once each year. The workload uses an Amazon RDS for MySQL Multi-AZ database for data storage. Which configuration approach will meet these requirements?

    • A. Enable Transparent Data Encryption (TDE) in the MySQL configuration fil
    • B. Manually rotate the key every 12 months.
    • C. Enable RDS encryption on the database at creation time by using the AWS managed key for Amazon RDS.
    • D. Create a new AWS Key Management Service (AWS KMS) customer managed ke
    Reveal Answer