Free SOA-C02 Practice Test Questions and Answers (2026)

For improving upload performance globally for an Amazon S3 bucket, enabling S3 Transfer

Acceleration is the best solution. This service optimizes file transfers to S3 using Amazon

CloudFront's globally distributed edge locations. After enabling this feature, uploads to the S3 bucket

are first routed to an AWS edge location and then transferred to S3 over an optimized network path.

Option C is correct, and the developers should use the provided accelerate endpoint in their API

calls. For more details, consult the AWS documentation on S3 Transfer Acceleration Amazon S3

Transfer Acceleration.

Objective:

Enforce corporate policy to prevent the creation of EC2 instances in unauthorized AWS Regions.

Using Service Control Policies (SCPs):

SCPs are an AWS Organizations feature that allow centralized control over permissions for all

accounts in the organization.

By attaching an SCP to the root level of the organization, you can enforce the restriction across all

accounts.

Solution Implementation:

Step 1: Open the AWS Organizations console.

Step 2: Create a new SCP with the following policy:

{

"Version": "2012-10-17",

"Statement":

[

{

"Effect": "Deny",

"Action": "ec2:RunInstances",

"Resource": "*",

"Condition": {

"StringNotEquals": {

"aws:RequestedRegion":

[

"us-east-1",

"us-west-2"

]

}

}

}

]

}

Replace "us-east-1" and "us-west-2" with the allowed Regions.

Step 3: Attach the SCP to the root level of the organization.

AWS Reference:

Service Control Policies (SCPs):SCP Best Practices

Restricting EC2 Regions with SCP:SCP Examples

Why Other Options Are Incorrect:

Option A: CloudTrail and EventBridge with Lambda are operationally less efficient and reactive rather

than preventative.

Option B: IAM policies applied at the account level require manual configuration for each account,

which is less efficient.

Option C: Permissions boundaries are more suited for controlling specific IAM user or role actions,

not account-wide restrictions.

Amazon FSx provides a fully managed file system that is optimized for Windows-based workloads

and can be used to create file shares that can be accessed both on premises and in the AWS Cloud.

The file shares that are created in Amazon FSx are highly available and can be accessed with low

latency. Additionally, Amazon FSx supports Windows-based authentication, making it easy to

integrate with existing Windows user accounts.

Reference:

[1] https://aws.amazon.com/fsx/

[2] https://aws.amazon.com/storage/file-storage/

[3] https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html

[4] https://aws.amazon.com/premiumsupport/knowledge-center/fsx-file-gateway-access/

To analyze CloudWatch logs across multiple AWS Lambda functions for historical errors, the most

operationally efficient way is to use AWS Glue and Amazon Athena.

AWS Glue and Amazon Athena:

AWS Glue can crawl the data in S3, creating a catalog that makes it queryable.

Amazon Athena allows you to run SQL queries on the data cataloged by AWS Glue.

Steps to Implement:

Set up an AWS Glue crawler to index the logs stored in S3.

Configure the crawler to create a table in the AWS Glue Data Catalog.

Use Amazon Athena to query the table for errors using SQL. Since errors have a common string

prefix, you can use SQL queries to filter and find these errors.

AWS Glue

Amazon Athena

The requirement is to monitor and notify whenever a non-production EC2 instance is started during

the night. Amazon EventBridge offers a robust solution by triggering workflows in response to

events.

Setting up Amazon EventBridge: Create an EventBridge rule that listens for the "EC2 Instance State-

change Notification" event. Configure the rule to trigger only when instances transition to the

"running" state.

Lambda Function: Attach a Lambda function as the target of the EventBridge rule. This function will

execute when an EC2 instance starts. Inside the Lambda function, implement logic to check the

current time and confirm it is during the night hours. Additionally, the function will check the

instance's tags to verify if it's labeled as "non-production".

Notification via Amazon SNS: If the conditions are met (non-production and nighttime), the Lambda

function publishes a message to an Amazon SNS topic specifically set up for this alert. The IT

manager is subscribed to this topic, enabling them to receive an email notification almost

instantaneously when the event occurs.

This solution is operationally efficient as it leverages serverless components that are inherently

scalable and cost-effective, providing real-time monitoring and notifications without the need for

continuous polling or complex infrastructure.

NAT Gateway Setup:

A NAT gateway allows instances in a private subnet to connect to the internet or other AWS services,

but prevents the internet from initiating a connection with those instances.

Steps:

Go to the AWS Management Console.

Navigate to VPC and select "NAT Gateways."

Create a NAT gateway in the public subnet of each Availability Zone.

Allocate an Elastic IP address to each NAT gateway.

Update the route tables for the private subnets to route internet-bound traffic to the NAT gateways.

Creating a NAT Gateway

To upgrade the instance type of a Memcached cluster in Amazon ElastiCache due to increased usage

and the need for more memory:

ModifyCacheCluster API: Utilize the ModifyCacheCluster API call. This API allows you to change

various settings of an existing cache cluster, including the instance type, which is referred to as

cacheNodeType.

Instance Upgrade: Specify a new, larger cacheNodeType that provides more memory. This upgrade

will involve a brief interruption as nodes are replaced with the larger type, but it is necessary to

accommodate the increased load and memory requirements.

Cluster Availability: Ensure that the Memcached cluster is configured for minimal downtime during

this change. The upgrade process is handled by ElastiCache, and the new nodes will join the cluster

with more memory capacity.

This approach enables you to effectively scale up the resources available to your Memcached cluster,

enhancing its performance and capacity to handle larger workloads.

In AWS CloudFormation, the PrivateDnsName property of an EC2 instance cannot be directly set

within the template. This property is automatically assigned by AWS when the instance is launched

within a VPC and is associated with the private IP address of the instance. The attempt to explicitly

set PrivateDnsName in a CloudFormation template will result in an error, causing the stack creation

to fail. Therefore, option C is correct. For reference, the AWS documentation on EC2 instances in

CloudFormation does not list PrivateDnsName as a configurable property AWS CloudFormation User

Guide.

The reason is that it uses the Amazon CloudWatch billing alarm which is a built-in service specifically

designed to monitor and alert on cost usage of your AWS account, which makes it a more suitable

solution for this use case. The alarm can be configured to detect when costs reach 75% of the

threshold and when it is triggered, it can publish a message to an Amazon Simple Notification Service

(Amazon SNS) topic. The email distribution list can be subscribed to the topic, so that they will

receive the alerts when costs reach 75% of the threshold.

AWS Budgets allows you to track and manage your costs, but it doesn't specifically focus on data

transfer costs between regions, and it might not provide as much granularity as CloudWatch Alarms.

Enabling the organizational view in AWS Health will allow the SysOps administrator to consolidate

the alerts from each account’s Personal Health Dashboard. It will also provide the administrator with

a single view of all the accounts in the organization, allowing them to easily monitor the health of all

the accounts in the organization.

Reference:

[1] https://aws.amazon.com/premiumsupport/knowledge-center/organizational-view-healthdashboard/

To resolve DNS across VPCs in different accounts, you should:

Authorization: In Account B, initiate a VPC association authorization for the private hosted zone. This

action allows another AWS account to associate a VPC with this hosted zone.

Association: In Account A, after receiving the authorization from Account B, associate its VPC with

the private hosted zone that exists in Account B. This step will enable EC2 instances within the VPC in

Account A to resolve DNS records hosted in Account B.

AWS Documentation Reference:

AWS provides detailed guidance on associating VPCs with private hosted zones across accounts in

their documentation: Associating VPCs and Private Hosted Zones Across Accounts.

Aurora Auto Scaling:

Aurora Auto Scaling adjusts the number of Aurora Replicas in response to changes in connectivity or

workload.

Steps:

Go to the AWS Management Console.

Navigate to RDS and select the Aurora cluster.

Under "Actions," choose "Add Aurora Replica" to initially add replicas if needed.

Go to the "Auto Scaling" section and create an auto scaling policy.

Set the target value for the DatabaseConnections metric to 195.

Define the minimum and maximum number of replicas.

Save the configuration.

This ensures that the Aurora cluster scales automatically when the number of connections

approaches the threshold, improving read performance.

Aurora Auto Scaling

AWS Systems Manager Run Command provides an efficient method to execute administrative tasks

on EC2 instances. This solution will minimize the time and complexity involved:

Select Document: Choose AWS-RunShellScript for Linux-based instances or AWS-

RunPowerShellScript for Windows-based instances.

Configure Command: Enter the mitigation script provided by the security team into the command

document.

Target Instances: Use the tagging system to target only the instances that match the specific OS as

identified by their tags.

Execute Command: Run the command across the targeted instances.

Verification and Reporting: The command history in Systems Manager will serve as evidence of

execution and success, which can be reported back to the security team.

AWS Documentation Reference:

More about Run Command can be found here: AWS Systems Manager Run Command.

This solution is operationally efficient and leverages AWS services to provide notifications when the

Lambda function is not invoked, indicating that the file did not arrive.

Steps:

Create a CloudWatch Alarm:

Open the Amazon CloudWatch console.

In the navigation pane, choose "Alarms" and then "Create Alarm".

Select Lambda Metrics:

Choose "Select metric" and then navigate to "AWS Lambda" metrics.

Select the Lambda function that processes the S3 files.

Choose the "Invocations" metric.

Configure the Alarm:

Set the period to 1 hour.

Define the threshold condition to trigger when the Invocations metric is zero.

Under "Additional configuration", configure the alarm to treat missing data as "breaching".

Set Alarm Actions:

Configure the alarm action to send a notification to an Amazon SNS topic.

Create an SNS topic if one does not exist, and subscribe the application team to this topic.

Testing and Verification:

Ensure that the alarm triggers correctly by simulating a missing file scenario and confirming that the

notification is sent to the SNS topic.

This approach uses CloudWatch to monitor the invocation frequency of the Lambda function,

ensuring that the application team is notified whenever the expected file does not arrive within the

specified timeframe.

Reference:

Amazon CloudWatch Alarms

Monitoring Lambda Functions

Amazon SNS Notifications

When using the RequestCountPerTarget metric for scaling in an Auto Scaling group, the behavior of

instance scaling follows specific rules set by Auto Scaling policies and cooldown periods:

Scaling Trigger: The Auto Scaling group triggers a scaling action whenever the

RequestCountPerTarget exceeds the predefined limit set in the scaling policy.

Cooldown Period: After launching an EC2 instance due to a scaling action, the Auto Scaling group

enters a cooldown period. During this period, despite further breaches of the threshold, no

additional instances will be launched. This is designed to give the newly launched instance time to

start and begin handling traffic, preventing the Auto Scaling group from launching too many

instances too quickly.

This mechanism helps maintain efficient use of resources by adapting to changes in load while

avoiding rapid, unnecessary scaling actions.

AWS CloudFormation StackSets extends the functionality of stacks by enabling you to create, update,

or delete stacks across multiple accounts and regions with a single operation. Using a stack set, the

SysOps administrator can manage deployments across different regions and accounts within AWS

Organizations efficiently.

Setting up StackSets: First, define your CloudFormation template that describes all the resources that

need to be deployed across the regions. Store this template in an S3 bucket accessible by the central

administration account.

Service-Managed Permissions: When creating a stack set, select the option for service-managed

permissions if you are using AWS Organizations. This allows AWS CloudFormation to automatically

set up the necessary permissions in the target accounts.

Deploying the Stack Set: From the central administration account, create the stack set and specify the

target accounts and regions. CloudFormation will then ensure that the resources defined in the

template are instantiated in each of the specified regions and accounts.

This method simplifies management and ensures consistency of infrastructure across multiple

regions and accounts, leveraging the organizational units in AWS Organizations for centralized

governance.

AWS Backup supports automated backups for EC2 (including attached EBS volumes). It allows:

Central management

Scheduled daily backups

Low operational overhead

From AWS Backup documentation:

You can create backup plans with schedules and retention rules, and assign resources like EC2

instances for automated backup.

CloudTrail Log File Integrity Validation:

AWS CloudTrail provides a feature for log file integrity validation to ensure logs have not been

modified or deleted.

Steps to Enable and Validate:

Enable Log File Integrity Validation:

Go to the CloudTrail Console.

Select or create a trail.

In the trail settings, enable Log file validation.

Use the AWS CLI for Validation:

Use the following CLI command:

aws cloudtrail validate-logs --trail-name

This command validates the digest files generated by CloudTrail against the log files.

Why Other Options Are Incorrect:

B: Using the AWS CloudTrail Processing Library is unnecessary for validation.

C: CloudTrail Insights is designed to identify unusual activity, not monitor log modifications.

D: Amazon CloudWatch Logs cannot directly monitor CloudTrail logs for integrity.

Reference:

CloudTrail Log File Validation

AWS CLI Command for Validation

To ensure that the Auto Scaling group scales out when CPU utilization rises above 50%, the

administrator should configure the Auto Scaling group to dynamically scale based on demand. This is

achieved by setting up a scaling policy that triggers based on specific CloudWatch alarms—like CPU

utilization exceeding 50%. This dynamic scaling method directly responds to changes in workload,

ensuring that resources are allocated efficiently and promptly as demand increases. Option C is the

correct answer, aligning with best practices for managing EC2 Auto Scaling based on real-time

metrics. Further guidance is available in AWS documentation on dynamic scaling Dynamic Scaling for

EC2.

For the issue of "too many connections" on a MySQL database, using RDS Proxy offers a streamlined

solution:

RDS Proxy Setup: RDS Proxy sits between your application and the database. It pools and efficiently

manages database connections, which reduces the number of direct connections to the database.

Connection Management: By handling connection pooling, RDS Proxy can help mitigate issues

related to connection overhead and limits, such as the "too many connections" error, by allowing the

database to serve more requests from a smaller and more stable number of connections.

Minimal Code Changes: Integrating RDS Proxy requires changes only to the database connection

settings in the application's configuration files to point to the RDS Proxy endpoint instead of directly

to the database. This minimizes the amount of code change needed and leverages RDS Proxy to

handle connection scaling and management more efficiently.

This approach enhances database performance and scalability by efficiently managing connections

without the need for significant application changes or database resizing.