Amazon Web Services · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A company uses AWS CloudTrail to log API calls across all regions. The SysOps administrator notices that logs for a specific region are missing from the centralized S3 bucket. What is the most likely cause?
The CloudTrail trail is not enabled for that region.
Correct. CloudTrail must be explicitly enabled for each region or a multi-region trail must be used. Missing logs for a specific region strongly suggests the trail is not applied there.
The S3 bucket policy denies write access from CloudTrail for that region.
CloudTrail log file validation is disabled.
The IAM role for CloudTrail does not have permissions to write logs from that region.
A SysOps team needs to monitor application logs in Amazon CloudWatch Logs for specific error codes and automatically invoke an AWS Lambda function for remediation within 5 minutes of an error occurring. Which solution involves the least operational overhead?
Create a CloudWatch Logs subscription filter to stream logs directly to an AWS Lambda function.
Create a CloudWatch metric filter on the log group, create a CloudWatch alarm on the metric, and configure the alarm to post to an SNS topic that triggers the Lambda function.
Correct. This uses native CloudWatch features with minimal overhead, meeting the 5-minute requirement through alarm evaluation intervals.
Use a third-party log aggregation tool that sends webhook notifications to an API Gateway endpoint to invoke the Lambda function.
Write a custom script that runs on an EC2 instance to poll CloudWatch Logs every minute and invoke the Lambda function.
A company uses an Amazon S3 bucket to store sensitive data. The SysOps administrator needs to be notified within 15 minutes if any object in the bucket becomes publicly accessible. Which solution will meet this requirement with the least operational overhead?
Configure an S3 event notification for all object creation events and publish to an Amazon SNS topic that sends an email alert.
Use an AWS Config managed rule to detect 's3-bucket-public-read-prohibited' and trigger an SNS notification via Amazon EventBridge.
Enable Amazon CloudTrail data events for the S3 bucket and create a CloudWatch Logs metric filter for PutObjectAcl (or PutObject with public ACL) and set an alarm.
Configure S3 event notifications for 's3:ObjectCreated:Put' and 's3:ObjectCreated:PutObjectAcl' with a suffix/prefix filter for public grants, sending to an SNS topic.
Correct. This allows real-time notification specifically when objects are created with public ACLs, meeting the requirement with minimal overhead.
A SysOps administrator is troubleshooting an application that runs on AWS Lambda. The application occasionally fails with timeout errors. The administrator needs to identify the exact lines of code that are causing the delays. Which AWS service or feature should be used to gather this information?
Enable detailed CloudWatch Logs and search for 'timeout' strings.
Use AWS X-Ray to trace the Lambda function and view segment details.
Correct. X-Ray traces function executions and can be instrumented to capture subsegments for each function call, helping identify which lines or api calls are slow.
Set a CloudWatch Metric Filter for 'Duration' and create an alarm.
Enable AWS CloudTrail data events for the Lambda function.
A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance fleet and send an alert when the average CPU utilization exceeds 80% for 10 consecutive minutes. The administrator also wants to automatically stop the instance if the CPU utilization remains above 90% for 30 minutes to prevent runaway costs. Which combination of AWS services should be used?
Amazon CloudWatch alarm + AWS Lambda + AWS Systems Manager Automation
Amazon CloudWatch alarm + Amazon Simple Notification Service (SNS) + AWS Lambda
A CloudWatch alarm monitors the CPU metric and publishes to an SNS topic when the threshold is breached. The SNS topic triggers a Lambda function that calls the EC2 StopInstances API to stop the instance. This is a clean, low-overhead solution.
Amazon CloudWatch Logs + Amazon EventBridge + AWS Step Functions
AWS CloudTrail + Amazon EventBridge + AWS CodePipeline
A SysOps administrator manages an application that runs on Amazon EC2 instances and stores critical data in Amazon Elastic Block Store (EBS) volumes. The administrator needs to monitor the EBS volumes for any performance bottlenecks. The key metric of interest is the average number of I/O operations per second (IOPS) that are waiting to be completed. Which Amazon CloudWatch metric should the administrator examine?
VolumeQueueLength
This metric shows the number of pending I/O operations waiting to be serviced. A high value indicates a bottleneck.
VolumeReadOps
VolumeIdleTime
VolumeTotalReadTime
Want more Monitoring, Logging, and Remediation practice?
Practice this domainAn application uses an Amazon DynamoDB table with on-demand capacity. The SysOps administrator needs to ensure the table remains available during an AWS regional outage. Which strategy should be used?
Enable DynamoDB Accelerator (DAX).
Create a read replica in another region.
Use DynamoDB global tables.
Correct. Global tables replicate data across multiple AWS Regions and provide automatic failover for high availability.
Increase read and write capacity units.
A SysOps administrator is testing the failover of an Amazon RDS for PostgreSQL Multi-AZ DB instance. The application currently writes to the primary instance in us-east-1a. Which action will manually trigger a failover to the standby instance in us-east-1b?
Reboot the DB instance and select 'Reboot with failover'.
Correct. This explicitly triggers a failover to the standby instance.
Modify the DB instance to Single-AZ and then back to Multi-AZ.
Reboot the DB instance without selecting any failover option.
Promote the standby instance using the Amazon RDS console.
A company runs a web application on Amazon EC2 instances in a single Availability Zone. The SysOps administrator wants to increase the availability of the application so that it can survive an Availability Zone failure. Which action is the most effective?
Deploy an additional EC2 instance in the same Availability Zone.
Launch EC2 instances in two different Availability Zones and place them behind an Application Load Balancer.
Correct. Spreading instances across AZs with a load balancer ensures continued availability if one AZ becomes unavailable.
Enable termination protection on all EC2 instances.
Use an Amazon RDS Multi-AZ deployment for the database tier.
A company runs a stateful web application on a single Amazon EC2 instance with an Elastic IP address. The SysOps administrator needs to increase availability so that if the instance fails, a new instance can be launched quickly with the same configuration and the same IP address. The administrator also needs to ensure data is not lost. Which solution meets these requirements with the least operational overhead?
Use an Application Load Balancer with an Auto Scaling group and a launch configuration that includes the Elastic IP
Create an AMI from the instance, store data on an Amazon EFS file system, and use an Auto Scaling group with a lifecycle hook to associate the Elastic IP
The AMI provides a pre-configured launch template. EFS provides durable, shared storage for application data. The Auto Scaling group automatically launches a new instance if the current one fails, and the lifecycle hook script associates the Elastic IP to the new instance, ensuring continuity with the same IP.
Create a CloudFormation template that launches a new instance and associates the Elastic IP
Place the instance in an Auto Scaling group with a minimum of 1 and a maximum of 1, and set the health check to replace unhealthy instances
A company runs a critical production database on Amazon RDS for MySQL with a Multi-AZ deployment. The database experiences a primary instance failure. The SysOps administrator needs to understand exactly how the failover process worked and why the application experienced a longer-than-expected downtime. Which AWS service or feature should the administrator use to review detailed events and actions during the failover?
AWS Personal Health Dashboard
The Personal Health Dashboard shows relevant events and notifications specific to the customer's RDS Multi-AZ failover, including timing and causes.
Amazon RDS Performance Insights
Amazon CloudWatch Logs
AWS CloudTrail
A company runs a stateless web application on Amazon EC2 instances in an Auto Scaling group with a minimum of 2 and maximum of 10 instances. The instances are behind an Application Load Balancer (ALB). The SysOps administrator needs to ensure that the application can survive the failure of an entire AWS Availability Zone (AZ) in the region. Which configuration is necessary?
Configure the Auto Scaling group with subnets in at least two Availability Zones and ensure the ALB has subnets in the same AZs.
This distributes instances across multiple AZs, so if one AZ fails, the other AZ continues serving traffic.
Increase the Auto Scaling group minimum to 10 instances to absorb the failure.
Use larger instance types to handle the load of a failed AZ.
Use multiple Application Load Balancers in different AZs.
Want more Reliability and Business Continuity practice?
Practice this domainA team uses AWS CodeDeploy with a deployment configuration of CodeDeployDefault.OneAtATime to deploy a web application to an Auto Scaling group. Instances are behind an Application Load Balancer. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment.' What is the most likely cause?
The health check grace period on the Auto Scaling group is too short.
Correct. A short grace period causes instances to be considered unhealthy before the deployment finishes, triggering Auto Scaling to replace them and causing repeated failures.
The target group deregistration delay is too long.
The CodeDeploy agent is not installed on the instances.
The deployment group is configured to skip the ELB health check.
A development team uses AWS CloudFormation to deploy infrastructure. They want to update a stack but first need to review how the changes will impact existing resources before applying them. Which CloudFormation feature should they use?
Change sets
Correct. Change sets provide a preview of the changes that will be made to the stack, enabling review before execution.
Stack policies
Condition functions
Custom resources
A company uses AWS CodeDeploy to deploy a new version of an application to EC2 instances in an Auto Scaling group behind an Application Load Balancer. The company requires zero downtime during the deployment. Which deployment configuration should be used?
CodeDeployDefault.AllAtOnce
CodeDeployDefault.OneAtATime
CodeDeployDefault.EC2/OnPremises: BlueGreenDeployment
Create a blue/green deployment by configuring CodeDeploy to launch new instances and shift traffic after validation.
Correct. Blue/green deployment with CodeDeploy allows routing traffic to new instances and cutting over after validation, ensuring zero downtime.
A company uses AWS CloudFormation to deploy a three-tier web application. The SysOps administrator wants to update a critical parameter, such as the instance type, and ensure that the change is applied without recreating the EC2 instance, if possible. Which CloudFormation stack update feature should be used to achieve this?
Change sets
Change sets allow you to preview how changes will affect your resources, including whether an update will cause replacement or in-place modification, giving you control to avoid unnecessary recreation.
Stack policy
Update with drift detection
Directly edit the stack template and use the update stack action
A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment strategy is set to CodeDeployDefault.HalfAtATime. The lifecycle hooks for the Auto Scaling group include a test hook that runs during instance launch. During a recent deployment, the deployment failed because the new instances failed the test hook and were not marked as healthy. The SysOps administrator needs to ensure that failed instances are automatically terminated and replaced with new ones from the Auto Scaling group. Which configuration change should the administrator make?
Modify the Auto Scaling group's health check type to ELB
When the health check type is set to ELB, the Auto Scaling group uses the Application Load Balancer's health checks. If the test hook fails, the instance will be marked unhealthy by the ALB, and the Auto Scaling group will terminate and replace it, ensuring only healthy instances remain.
Modify the CodeDeploy deployment configuration to use an increased minimum healthy instance count
Modify the Auto Scaling group's health check grace period to a lower value
Modify the CodeDeploy deployment to ignore the lifecycle hook failure
A company uses AWS CloudFormation to deploy a web application. The template currently hard-codes the EC2 instance type (e.g., t3.medium). The SysOps administrator wants to make the instance type configurable so that different environments (dev, test, prod) can use different instance types without modifying the template each time. Which CloudFormation feature enables this?
Parameters
Parameters allow users to input values when creating or updating a stack, making the template reusable for different environments.
Mappings
Conditions
Outputs
Want more Deployment, Provisioning, and Automation practice?
Practice this domainAn organization requires that all Amazon S3 buckets be encrypted at rest by default. A SysOps administrator needs to enforce this using AWS Config. Which AWS Config managed rule should be used?
s3-bucket-encryption-enabled
Correct. This rule evaluates whether default encryption is configured on the bucket, meeting the requirement for encryption at rest.
s3-bucket-ssl-requests-only
s3-bucket-public-read-prohibited
s3-bucket-logging-enabled
A SysOps administrator needs to ensure that all traffic to an Application Load Balancer (ALB) uses encryption. How can this be enforced?
Configure the security group to allow only HTTPS traffic (port 443).
Create a listener that redirects HTTP requests (port 80) to HTTPS (port 443).
Correct. An ALB listener rule can redirect HTTP to HTTPS, ensuring clients use encrypted connections.
Use AWS WAF to block HTTP requests.
Configure the ALB to use a custom SSL certificate.
An organization requires that all Amazon S3 buckets block public access entirely. A SysOps administrator needs to ensure that no bucket can be made public, even accidentally. Which approach enforces this control at the organizational level?
Apply an S3 Bucket Policy on each bucket that denies public access.
Use an AWS Config managed rule 's3-bucket-public-read-prohibited' to detect and remediate public buckets.
Enable S3 Block Public Access at the account level and attach an SCP to deny changes to it.
Correct. Account-level block public access prevents all public access, and an SCP prevents users from disabling it.
Create an IAM policy that denies s3:PutBucketPolicy for all users.
A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?
AWS Config with a custom rule and AWS Lambda
A custom AWS Config rule can evaluate EC2 instances when they are created (configuration change trigger) and invoke an AWS Lambda function to terminate instances lacking the required tag or having an invalid value. This provides continuous compliance enforcement.
AWS CloudTrail and Amazon CloudWatch Events
AWS Service Catalog and AWS Organizations
Amazon Inspector and AWS Systems Manager
A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?
Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning
AWS Config evaluates resources against the rule. When a noncompliant bucket is detected (whether newly created or changed), the automatic remediation using Systems Manager Automation enables versioning on the bucket, ensuring continuous compliance.
Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning
Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action
Use AWS Service Catalog to enforce versioning on all buckets provisioned through it
An organization requires that all Amazon EC2 instances must be launched only with approved Amazon Machine Images (AMIs) that have been pre-approved by the security team. The SysOps administrator needs to enforce this policy for all current and future instances in the AWS account. Unapproved AMIs should be prevented from launching. Which solution meets these requirements with the least operational overhead?
Use AWS Config with the 'approved-amis-by-id' managed rule to evaluate and automatically remediate noncompliant instances.
AWS Config can continuously monitor and automatically remediate instances launched with unapproved AMIs, requiring minimal manual effort.
Use an AWS Service Control Policy (SCP) to deny ec2:RunInstances if the AMI ID is not in an approved list.
Create an IAM policy that denies ec2:RunInstances for any AMI not on an approved list and attach it to all IAM users and roles.
Use AWS Systems Manager Patch Manager to approve AMIs and configure the fleet to use only approved images.
Want more Security and Compliance practice?
Practice this domainA company wants to establish a dedicated, low-latency, private connection between its on-premises data center and an AWS VPC. The company does not want to use the public internet. Which AWS service should be used to meet this requirement?
AWS Direct Connect
Correct. AWS Direct Connect provides a dedicated private connection between on-premises and AWS, avoiding the public internet.
AWS Virtual Private Gateway
AWS Transit Gateway
VPC Peering
A company has two VPCs in different AWS regions (us-east-1 and eu-west-1) that are peered. Applications in both VPCs need to communicate using private IP addresses. The ping tests are successful, but the latency is significantly higher than expected. Which change is most likely to improve the latency between the VPCs?
Enable DNS resolution for the VPC peering connection.
Correct. When DNS resolution is enabled, instances can resolve private DNS names of instances in the peered VPC, ensuring traffic stays within the AWS backbone and avoids unnecessary hops or public internet routing.
Use a Transit Gateway instead of VPC Peering for cross-region connectivity.
Increase the MTU on the instances' network interfaces to 9001.
Configure ECMP (Equal-Cost Multi-Path) routing on the VPC peering connection.
A company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's IP addresses are used by a third-party service to allowlist traffic. The EC2 instances are part of an Auto Scaling group that may scale up and down. The SysOps administrator needs to ensure that the third-party service always has the current IP addresses of the ALB without requiring manual updates. Which solution should the administrator implement?
Use AWS Global Accelerator and provide the static IP addresses to the third party
Global Accelerator provides two static IP addresses that serve as a fixed entry point. You can add the ALB as an endpoint, and traffic will be directed to the ALB's current healthy instances, while the static IPs remain unchanged.
Use Amazon Route 53 with a simple routing policy pointing to the ALB DNS name
Use an Amazon CloudFront distribution with the ALB as the origin and provide the CloudFront IP addresses
Use an AWS Network Load Balancer (NLB) with static IP addresses in front of the ALB
A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. The company's SysOps administrator wants to ensure that traffic from the VPC destined for the on-premises network uses the Direct Connect connection instead of the internet. Which configuration should be used?
Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW)
The VGW is attached to the VPC and is the entry/exit point for Direct Connect. By adding a route with the on-premises destination and the VGW as the target, traffic is forced through the Direct Connect connection.
Add a route in the VPC route table pointing to the on-premises network via a NAT gateway
Add a route in the VPC route table pointing to the on-premises network via an internet gateway
Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection
A company has two VPCs in the same AWS region. VPC A hosts a web application, and VPC B hosts a database. The SysOps administrator needs to enable private IP communication between the two VPCs without using the public internet. The administrator wants a simple, low-cost solution that uses the AWS network backbone. Which AWS service should be used?
VPC Peering
VPC Peering directly connects two VPCs using private IPs over the AWS network, simple and cost-effective for a pair of VPCs.
AWS Transit Gateway
AWS Direct Connect
AWS Site-to-Site VPN
A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?
Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.
Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.
Global Accelerator preserves the client source IP when the endpoint is an NLB. The NLB passes traffic to the ALB, which can see the original client IP in the X-Forwarded-For header. This satisfies both performance (using Global Accelerator) and logging requirements.
Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.
Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.
Want more Networking and Content Delivery practice?
Practice this domainA SysOps administrator manages an Amazon RDS for MySQL instance that experiences high CPU utilization during business hours. The application is read-heavy. Which action will most effectively improve performance and reduce cost?
Enable Multi-AZ deployment.
Scale up the instance size to a larger instance class.
Add a read replica.
Correct. Read replicas handle read traffic, reducing load on the primary instance and improving performance cost-effectively.
Enable automated backups.
A SysOps administrator manages a web application running on Amazon EC2 instances that run 24/7 for the next 12 months. The workload is steady and predictable. Which EC2 purchasing option provides the highest cost savings for this use case?
Standard Reserved Instances
Correct. Standard Reserved Instances offer the highest discount for a steady, predictable 24/7 workload with a 1-year or 3-year term.
Spot Instances
On-Demand Instances
Savings Plans (Compute)
A company runs a large number of EC2 instances across multiple accounts and regions. The finance team needs to track costs per project and department. Each EC2 instance must be tagged with a ProjectID and Department tag. A SysOps administrator needs to ensure that all newly launched EC2 instances are tagged automatically before they can be used, and that existing untagged instances are retroactively tagged. The tags must be propagated to cost reports in AWS Cost Explorer. Which combination of steps will achieve this with the least operational overhead?
Use AWS Config with auto-remediation to tag new instances, and activate the tags as cost allocation tags. For existing instances, run the Tag Editor with a CSV import.
Correct. AWS Config auto-remediation tags non-compliant new instances; Tag Editor bulk-tags existing instances; activation in Billing console propagates tags to cost reports.
Create an AWS Lambda function that tags instances at launch via CloudTrail events, and use AWS Budgets to enforce tagging.
Use AWS Cost Categories to automatically group costs based on resource tags.
Ensure all AMIs used have tags that propagate to instances, and enable cost allocation tags.
A company runs a batch processing application on Amazon EC2 that runs for 2 hours every night. The workload can tolerate interruptions. Which EC2 purchasing option provides the lowest cost for this use case?
On-Demand Instances
Reserved Instances
Spot Instances
Spot Instances allow you to use spare EC2 capacity at up to 90% discount compared to On-Demand. The workload is interruption-tolerant and fits the nightly batch window well, making this the most cost-effective option.
Dedicated Hosts
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application reads data from an Amazon RDS for MySQL database. During peak hours, the database CPU utilization is consistently high, and the application experiences increased latency. The SysOps administrator observes that 90% of database queries are read-only. Which combination of actions will both improve performance and optimize costs?
Enable Multi-AZ for the RDS instance and scale up the instance size
Implement a read replica for the RDS instance and modify the application to route read queries to the read replica
Read replicas can handle read traffic, reducing load on the primary instance. This improves performance and, by avoiding unnecessary scale-up, can be more cost-effective. Only the primary instance needs to be sized for writes.
Enable Amazon RDS Performance Insights and increase the storage allocation
Implement Amazon ElastiCache for Memcached in front of the database and migrate read-heavy queries to cache
A company runs a web application on Amazon EC2 instances that are part of an Auto Scaling group. The application's traffic is predictable with regular peaks during business hours and low traffic at night. The SysOps administrator wants to optimize costs while ensuring that performance meets demand. The administrator also needs to minimize manual intervention. Which scaling policy should be used?
Scheduled scaling
Scheduled scaling adjusts capacity at predefined times, matching predictable patterns with no manual effort after setup.
Target tracking scaling
Simple scaling
Manual scaling
Want more Cost and Performance Optimization practice?
Practice this domainThe SOA-C02 exam has 65 questions and must be completed in 180 minutes. The passing score is 720/1000.
Operations scenario questions and hands-on lab tasks covering monitoring, deployment, security, storage, and cost management on AWS. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.
The exam covers 6 domains: Monitoring, Logging, and Remediation, Reliability and Business Continuity, Deployment, Provisioning, and Automation, Security and Compliance, Networking and Content Delivery, Cost and Performance Optimization. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Amazon Web Services SOA-C02 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.