AWS Certified SysOps Administrator Associate SOA-C02 practice test

A company uses an Amazon DynamoDB table with on-demand capacity mode. The table handles a workload with a steady baseline of 500 writes per second but spikes to 2,000 writes per second for a few hours each day. The SysOps administrator wants to reduce costs without affecting application performance during spikes. Which action should the administrator take?

Trap 1: Enable DynamoDB Accelerator (DAX) to cache reads.

DAX is a read cache; it does not reduce write capacity costs.

Trap 2: Create a global table to distribute write traffic.

Global tables replicate data across regions and increase write costs due to additional replication.

Trap 3: Use Amazon ElastiCache to buffer write requests.

ElastiCache is not integrated with DynamoDB write capacity and does not reduce the cost of writes.

A
Switch to provisioned capacity with auto scaling to handle the spikes.
Provisioned capacity with auto scaling can be more cost-effective for workloads with a predictable baseline and occasional spikes. You pay only for the provisioned capacity, not per-request.
B
Enable DynamoDB Accelerator (DAX) to cache reads.
Why wrong: DAX is a read cache; it does not reduce write capacity costs.
C
Create a global table to distribute write traffic.
Why wrong: Global tables replicate data across regions and increase write costs due to additional replication.
D
Use Amazon ElastiCache to buffer write requests.
Why wrong: ElastiCache is not integrated with DynamoDB write capacity and does not reduce the cost of writes.

Question 2easymultiple choice

A company uses Amazon CloudWatch Logs to store application logs. The SysOps administrator needs to count the occurrences of the string 'ERROR' in the logs and trigger an Amazon SNS notification when more than 10 errors occur within a 5-minute window. Which steps should the administrator take?

Trap 1: Create a CloudWatch alarm directly on the log group

CloudWatch alarms cannot be created directly on log groups. Alarms must be based on metrics, not raw log data.

Trap 2: Create an AWS Lambda function to parse the logs and send a…

Using a Lambda function to parse logs and send notifications introduces unnecessary complexity and cost. CloudWatch Logs metric filters provide a built-in solution.

Trap 3: Create an Amazon EventBridge rule to filter log events and send to…

Amazon EventBridge can react to events but does not natively filter log patterns from CloudWatch Logs. This use case is better handled by metric filters and alarms.

A
Create a metric filter on the log group and then create a CloudWatch alarm on the resulting metric
Creating a metric filter on the log group produces a metric that can be used in a CloudWatch alarm. This is the standard, low-operational-overhead approach.
B
Create a CloudWatch alarm directly on the log group
Why wrong: CloudWatch alarms cannot be created directly on log groups. Alarms must be based on metrics, not raw log data.
C
Create an AWS Lambda function to parse the logs and send a notification to Amazon SNS
Why wrong: Using a Lambda function to parse logs and send notifications introduces unnecessary complexity and cost. CloudWatch Logs metric filters provide a built-in solution.
D
Create an Amazon EventBridge rule to filter log events and send to SNS
Why wrong: Amazon EventBridge can react to events but does not natively filter log patterns from CloudWatch Logs. This use case is better handled by metric filters and alarms.

Read the full NAT/PAT explanation →

Question 3easymultiple choice

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and send an alert when it exceeds 90% for 5 consecutive minutes. Which combination of AWS services should the administrator use to meet this requirement?

Trap 1: Amazon CloudWatch Logs, a metric filter to extract CPU utilization…

CPU utilization is already available as a CloudWatch metric; using a log-based metric filter is unnecessary and adds complexity. The EC2 instance would need to emit CPU utilization as log entries, which is not the standard way.

Trap 2: A CloudWatch dashboard and an AWS Lambda function that checks the…

Dashboards are for visualization, not for triggering alerts. Using a Lambda function to poll the dashboard is inefficient and not a designed practice.

Trap 3: Amazon EventBridge (CloudWatch Events) and a Lambda function that…

EventBridge can schedule events, but it does not provide direct CPU monitoring. A Lambda function would need to retrieve and analyze CloudWatch metrics, which is more complex than using a CloudWatch alarm directly.

A
Amazon CloudWatch metric (CPUUtilization), a CloudWatch alarm, and an Amazon SNS topic.
This combination allows monitoring of the metric, evaluation against a threshold, and notification via SNS. It is the simplest and most direct method.
B
Amazon CloudWatch Logs, a metric filter to extract CPU utilization from logs, and an alarm on that metric.
Why wrong: CPU utilization is already available as a CloudWatch metric; using a log-based metric filter is unnecessary and adds complexity. The EC2 instance would need to emit CPU utilization as log entries, which is not the standard way.
C
A CloudWatch dashboard and an AWS Lambda function that checks the dashboard periodically.
Why wrong: Dashboards are for visualization, not for triggering alerts. Using a Lambda function to poll the dashboard is inefficient and not a designed practice.
D
Amazon EventBridge (CloudWatch Events) and a Lambda function that calls the EC2 DescribeInstances API.
Why wrong: EventBridge can schedule events, but it does not provide direct CPU monitoring. A Lambda function would need to retrieve and analyze CloudWatch metrics, which is more complex than using a CloudWatch alarm directly.

Read the full NAT/PAT explanation →

Question 4mediummultiple choice

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?

Trap 1: Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager…

While this combination could work, it is more complex than necessary. Systems Manager Automation is typically used for multi-step runbooks; for a simple stop action, Lambda with the EC2 stop API is sufficient and more straightforward.

Trap 2: Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions

CPU utilization is a metric, not a log. CloudWatch Logs is for log data, not metrics. EventBridge can trigger on metric alarms, but Step Functions is an orchestration service that adds unnecessary complexity for a simple stop action.

Trap 3: AWS CloudTrail + Amazon EventBridge + AWS CodePipeline

CloudTrail logs API actions, not CPU metrics. CodePipeline is a CI/CD service. This combination is not appropriate for monitoring and stopping instances based on CPU utilization.

A
Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation
Why wrong: While this combination could work, it is more complex than necessary. Systems Manager Automation is typically used for multi-step runbooks; for a simple stop action, Lambda with the EC2 stop API is sufficient and more straightforward.
B
Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda
A CloudWatch alarm monitors the CPU metric and publishes to an SNS topic when the threshold is breached. The SNS topic triggers a Lambda function that calls the EC2 StopInstances API to stop the instance. This is a clean, low-overhead solution.
C
Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions
Why wrong: CPU utilization is a metric, not a log. CloudWatch Logs is for log data, not metrics. EventBridge can trigger on metric alarms, but Step Functions is an orchestration service that adds unnecessary complexity for a simple stop action.
D
AWS CloudTrail + Amazon EventBridge + AWS CodePipeline
Why wrong: CloudTrail logs API actions, not CPU metrics. CodePipeline is a CI/CD service. This combination is not appropriate for monitoring and stopping instances based on CPU utilization.

Question 5easymultiple choice

A company's security policy requires that all Amazon S3 buckets must have server-side encryption enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and notify the security team. Which AWS service should be used to detect non-compliant buckets?

Trap 1: Amazon Inspector

Amazon Inspector assesses EC2 instances for software vulnerabilities and network exposure, not S3 bucket configurations.

Trap 2: AWS CloudTrail

CloudTrail logs API activity but does not perform proactive compliance checks on resource configurations.

Trap 3: Amazon GuardDuty

GuardDuty is a threat detection service that monitors for malicious activity; it does not evaluate encryption settings.

A
Amazon Inspector
Why wrong: Amazon Inspector assesses EC2 instances for software vulnerabilities and network exposure, not S3 bucket configurations.
B
AWS Config
AWS Config has managed rules to evaluate resource settings, including S3 bucket encryption. It can automatically detect non-compliant buckets and send notifications.
C
AWS CloudTrail
Why wrong: CloudTrail logs API activity but does not perform proactive compliance checks on resource configurations.
D
Amazon GuardDuty
Why wrong: GuardDuty is a threat detection service that monitors for malicious activity; it does not evaluate encryption settings.

Question 6mediummultiple choice

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance. The administrator wants to ensure that if the stack is updated, the EC2 instance is not accidentally replaced if its properties change. The administrator wants the stack update to fail when a property change would require replacement. Which CloudFormation feature should the administrator use?

Trap 1: CreationPolicy

CreationPolicy controls the creation success of a resource based on signals, but does not affect updates or prevent replacement.

Trap 2: DeletionPolicy

DeletionPolicy determines what happens when a resource is deleted; setting it to Retain would cause replacement to fail, but this is not the intended or clean solution.

Trap 3: UpdateReplacePolicy

CloudFormation does not have an attribute named UpdateReplacePolicy. The correct approach is StackPolicy.

A
CreationPolicy
Why wrong: CreationPolicy controls the creation success of a resource based on signals, but does not affect updates or prevent replacement.
B
DeletionPolicy
Why wrong: DeletionPolicy determines what happens when a resource is deleted; setting it to Retain would cause replacement to fail, but this is not the intended or clean solution.
C
StackPolicy
StackPolicy allows you to explicitly deny update actions (including replacement) on specific resources, causing updates that require replacement to fail.
D
UpdateReplacePolicy
Why wrong: CloudFormation does not have an attribute named UpdateReplacePolicy. The correct approach is StackPolicy.