How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 9 Refer to the Exhibit Practice Questions scenario questions for the SOA-C02 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SOA-C02 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified SysOps Administrator Associate SOA-C02 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise AWS Certified SysOps Administrator Associate SOA-C02 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SOA-C02

exam code

Amazon Web Services

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

Refer to the exhibit. A SysOps administrator runs this CloudWatch Logs Insights query against an application log group. The query returns no results, even though the administrator knows that errors occurred in the last hour. What is the most likely cause?

Exhibit

Consider the following CloudWatch Logs Insights query:
fields @timestamp, @message
| filter @message like /ERROR/
| stats count() by bin(5m)
| sort @timestamp desc

A
The 'stats' command requires a 'by' clause with a field name, but 'bin(5m)' is invalid.
Why wrong: The stats command in CloudWatch Logs Insights does not always require a by clause; for example, stats count() alone is valid. The bin(5m) function is a recognized time-window expression that can be used within the by clause to group results into five-minute intervals. The syntax is legitimate, so the issue is not an invalid command but likely a query execution problem.
B
The log group contains too many log events, causing the query to time out.
CloudWatch Logs Insights queries have a maximum execution time of 60 seconds, and when a log group contains a very high volume of log events within the queried time range, the query engine may exceed that limit. A timeout causes the query to return no results, even though the data exists. This matches the symptom described in the question, making it the correct explanation.
C
The @message field is not a valid field in CloudWatch Logs Insights.
Why wrong: The @message field is a built-in, automatically populating field in CloudWatch Logs Insights that contains the full text of the log event as it was ingested. It is frequently used in queries for pattern matching and parsing, so it is absolutely a valid field. Therefore, the premise that @message is invalid is false and cannot be the reason the query failed.
D
The log group's retention policy is set to 1 day and the data is older than the retention period.
Why wrong: The retention policy controls how long log events are stored before they are deleted, but it does not affect query execution unless the data has already been purged. Since the errors occurred in the last hour, they are well within a 1-day retention window and therefore still available for querying. The retention setting is irrelevant to the timeout issue, so this option is incorrect.

Full breakdown with real-world context →

Question 2easymultiple choice

Full question →

Refer to the exhibit. An IAM policy is attached to an IAM user. Which action can the user perform?

Exhibit

Refer to the exhibit.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "ec2:TerminateInstances",
            "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
        }
    ]
}

A
Start an EC2 instance.
Why wrong: The user can start instances, but the question asks which action is allowed; all listed actions except terminate are allowed.
B
Describe EC2 instances.
Why wrong: Describe* is allowed, but the question asks for a specific action; stop is also allowed.
C
Stop an EC2 instance.
StopInstances is explicitly allowed and not denied.
D
Terminate an EC2 instance.
Why wrong: TerminateInstances is explicitly denied.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

Refer to the exhibit. An IAM policy is attached to a user. Which statement about the user's access is correct?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::example-bucket"
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "true"
        }
      }
    }
  ]
}

A
The user can get objects over HTTP.
Why wrong: Condition requires HTTPS.
B
The user can list objects in the bucket over HTTP.
Why wrong: ListBucket action does not have the condition, so HTTP works.
C
The user can list objects only over HTTPS.
Why wrong: Condition is not on ListBucket.
D
The user can get objects only over HTTPS.
GetObject requires SecureTransport true.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

Refer to the exhibit. A security group is attached to an Application Load Balancer (ALB) that serves HTTPS traffic on port 443. Users can access the application via HTTPS. However, the ALB's health checks to targets on port 80 are failing. What is the reason?

Network Topology

A
The ALB's security group does not allow HTTPS traffic from the internet.
Why wrong: The exhibit clearly shows an inbound HTTPS (port 443) rule from 0.0.0.0/0 on the ALB's security group, so this statement is factually false. More importantly, this rule is for client-to-ALB traffic, which is unrelated to the ALB's ability to reach targets for health checks; those probes originate from the ALB and are filtered by the targets' security group. Even if this rule were absent, the only impact would be users failing to reach the load balancer over HTTPS, not the reported unhealthy targets.
B
The security group for the target instances does not allow HTTP traffic from the ALB's security group.
This is correct because the ALB sends health check requests from its own network interfaces, using the ALB's security group as the source in the allowed inbound rule on each target. The target instance's security group must explicitly allow inbound TCP on the health check port (HTTP/80) from the ALB's security group ID (or from the VPC CIDR if the security group reference is not used). Without that rule, the OS receives the SYN packet but the security group silently drops it, so the health check times out and the target is marked unhealthy. This is the standard root cause for healthy-app-turned-unhealthy after an ALB change or when targets are in a different security group.
C
The ALB's security group does not allow HTTP traffic from the target's IP range.
Why wrong: This statement inverts the traffic flow required for load balancer health checks. The ALB's security group governs inbound connections to the load balancer from clients, not outbound connections that the ALB initiates to targets; for health checks, the target instance's security group must permit HTTP from the ALB's security group or its VPC CIDR. Moreover, the exhibit already shows the ALB allowing HTTP from 10.0.0.0/16, but even that rule is irrelevant because the health check source is the ALB's private IP addresses, not the target's IP range. Thus, a missing inbound rule on the target side is the cause, not a missing rule on the ALB side.
D
The health check is configured to use HTTPS, but the target only supports HTTP.
Why wrong: The health check configuration shown in the exhibit explicitly uses HTTP on port 80, matching the target group's protocol and port, so there is no HTTPS-to-HTTP mismatch. Even if HTTPS were used, the failure would typically be due to the target not presenting a trusted certificate or not listening on 443, neither of which is applicable here. The actual issue is that the target instances' security group is filtering the ALB's health check probes, causing them to fail at the network layer before any TLS handshake or HTTP request could occur.

Full breakdown with real-world context →

Question 5easymultiple choice

Full question →

Refer to the exhibit. A SysOps Administrator runs the above command and sees that an EC2 instance is unhealthy. The health check is configured to check the HTTP endpoint '/health' on port 80. The instance's security group allows inbound HTTP traffic from the ALB's security group. What is the MOST likely cause?

Network Topology

A
The instance is not associated with the target group.
Why wrong: Incorrect. The instance is associated with the target group; otherwise it would not be listed as unhealthy.
B
The application on the instance is not configured to respond to the '/health' path.
Correct. The health check endpoint '/health' is not properly handled by the application, causing the health check to fail.
C
The target group is configured to use port 8080 instead of port 80.
Why wrong: Incorrect. The target group is configured to use port 80, not port 8080.
D
The security group on the instance does not allow inbound traffic from the ALB.
Why wrong: Incorrect. The security group on the instance allows inbound HTTP traffic from the ALB's security group, so this is not the cause of the health check failure.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

Refer to the exhibit. A SysOps administrator has attached the bucket policy shown to an S3 bucket. Users from the IP range 192.0.2.0/24 report that they can access objects, but users from other IP ranges also report they can access objects. What is the most likely reason?

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "192.0.2.0/24"
                }
            }
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": "192.0.2.0/24"
                }
            }
        }
    ]
}
```

A
The bucket is not configured to use the bucket policy.
Why wrong: Bucket policies are always evaluated if present.
B
The bucket policy is malformed and is not being applied.
Why wrong: The policy is syntactically correct.
C
The Condition element in the Allow statement is incorrectly formatted.
Why wrong: The condition is correctly formatted.
D
The bucket ACL allows public read access, overriding the bucket policy Deny.
Bucket ACLs are evaluated before bucket policies, and if an ACL grants access, it can override a Deny in the policy.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

Refer to the exhibit. An IAM user has this policy attached. What is the effect when the user attempts to get an object from my-bucket from an IP address in the range 198.51.100.0/24?

Exhibit

Refer to the exhibit.

Consider the following IAM policy:
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}
```

A
Allowed because the Deny condition does not match
Why wrong: The Deny condition does match because the IP is not in the allowed range.
B
Denied because there is no explicit Allow for that IP range
Why wrong: There is an explicit Deny.
C
Allowed because there is an Allow statement
Why wrong: The Deny overrides the Allow.
D
Denied because the Deny statement applies
The Deny statement explicitly denies access from IPs not in the range.

Full breakdown with real-world context →

Question 8mediummultiple choice

Full question →

Refer to the exhibit. The alarm has been in INSUFFICIENT_DATA state for several hours. What is the most likely cause?

Network Topology

A
The alarm evaluation period is too long.
Why wrong: Period of 300 seconds is standard; INSUFFICIENT_DATA means no data at all.
B
The EC2 instance is stopped or terminated.
If the instance is stopped, no metrics are emitted.
C
The instance has no CloudWatch agent installed.
Why wrong: CPUUtilization is a standard metric, no agent needed.
D
The instance is running but the CPU utilization is below the threshold.
Why wrong: If below threshold, the state would be OK, not INSUFFICIENT_DATA.

Full breakdown with real-world context →

Question 9easymultiple choice

Full question →

Refer to the exhibit. The command returns no datapoints for CPUUtilization for the specified instance. What is the most likely reason?

Network Topology

A
The instance was stopped or did not emit metrics during the specified time range.
If the instance is stopped, no metrics are emitted.
B
The metric name is incorrect.
Why wrong: CPUUtilization is a valid metric for EC2.
C
The instance does not have detailed monitoring enabled.
Why wrong: Basic monitoring (5-minute) is enabled by default; the period matches.
D
The period of 300 seconds is too short.
Why wrong: 300 seconds (5 minutes) is a valid period.

Full breakdown with real-world context →

These SOA-C02 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style SOA-C02 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related SOA-C02 topic practice pages

Monitoring, Logging, and Remediation practice questions

Reliability and Business Continuity practice questions

Deployment, Provisioning, and Automation practice questions

Security and Compliance practice questions

Networking and Content Delivery practice questions

Cost and Performance Optimization practice questions

SOA-C02 fundamentals practice questions

SOA-C02 scenario practice questions

SOA-C02 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. A SysOps administrator runs this CloudWatch Logs Insights query against an application log group. The query returns no results, even though the administrator knows that errors occurred in the last hour. What is the most likely cause?

Exhibit

Refer to the exhibit. An IAM policy is attached to an IAM user. Which action can the user perform?

Exhibit

Refer to the exhibit. An IAM policy is attached to a user. Which statement about the user's access is correct?

Exhibit

Refer to the exhibit. A security group is attached to an Application Load Balancer (ALB) that serves HTTPS traffic on port 443. Users can access the application via HTTPS. However, the ALB's health checks to targets on port 80 are failing. What is the reason?

Refer to the exhibit. A SysOps administrator has attached the bucket policy shown to an S3 bucket. Users from the IP range 192.0.2.0/24 report that they can access objects, but users from other IP ranges also report they can access objects. What is the most likely reason?

Exhibit

Refer to the exhibit. An IAM user has this policy attached. What is the effect when the user attempts to get an object from my-bucket from an IP address in the range 198.51.100.0/24?

Exhibit

Refer to the exhibit. The alarm has been in INSUFFICIENT_DATA state for several hours. What is the most likely cause?

Refer to the exhibit. The command returns no datapoints for CPUUtilization for the specified instance. What is the most likely reason?