How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the SOA-C02 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SOA-C02 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified SysOps Administrator Associate SOA-C02 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AWS Certified SysOps Administrator Associate SOA-C02 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SOA-C02

exam code

Amazon Web Services

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Full question →

Drag and drop the steps to troubleshoot high CPU usage on an Amazon EC2 instance into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2easymultiple choice

Full question →

A SysOps administrator is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The administrator wants to identify the specific queries consuming the most CPU. What is the MOST efficient way to achieve this?

A
Use CloudWatch metrics for RDS and create a dashboard for CPU utilization.
Why wrong: CloudWatch metrics do not show specific queries.
B
Enable Performance Insights for the RDS instance and view the top SQL queries.
Performance Insights provides a visual representation of database load and identifies top SQL queries.
C
Enable Enhanced Monitoring for the RDS instance and view the CPU metrics.
Why wrong: Enhanced Monitoring shows OS-level metrics, not specific queries.
D
Enable CloudWatch Logs for the RDS instance and filter for slow query logs.
Why wrong: Slow query logs show queries that take long, not necessarily high CPU.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

An organization has a CloudWatch dashboard that displays metrics for multiple AWS services. The dashboard is shared with the operations team. Recently, some team members reported that the dashboard is not loading for them. Which action should the SysOps administrator take to troubleshoot the issue?

A
Confirm that the team members have the necessary IAM permissions for cloudwatch:GetDashboard.
Without GetDashboard permission, users cannot load the dashboard.
B
Verify that the team members have subscribed to the metric streams.
Why wrong: Subscription is not required to view dashboards.
C
Ensure the CloudWatch agent is installed on the instances displaying the dashboard.
Why wrong: The CloudWatch agent is for data collection, not dashboard viewing.
D
Check that the dashboard is in the same region as the resources.
Why wrong: Dashboards can display cross-region metrics; region mismatch does not prevent loading.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full DNS explanation →

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered using a VPC Peering connection. The instances in VPC A can ping the private IP of instances in VPC B, but not the DNS names. What is the most likely cause?

A
The route tables in VPC A do not have a route to VPC B's CIDR.
Why wrong: Ping works, so routing is correct.
B
The security groups in VPC B block DNS traffic (port 53).
Why wrong: DNS resolution is a VPC feature, not instance-level.
C
The VPC Peering connection does not have 'Enable DNS Resolution' enabled.
DNS resolution across VPC peering requires this option.
D
The VPCs have overlapping CIDR blocks.
Why wrong: Overlapping CIDR would prevent peering setup.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A company has a production environment that includes an Amazon RDS for MySQL database. The SysOps administrator receives an alert that the database's CPU utilization has been above 90% for the past hour. The administrator checks the CloudWatch metrics and sees that the DatabaseConnections metric is also high. The application team reports that users are experiencing slow response times. The administrator wants to investigate which queries are causing the high CPU. The database is already configured to send logs to CloudWatch Logs. Which course of action should the administrator take to identify the problematic queries?

A
Use CloudWatch Logs Insights to query the existing RDS log group for any SQL statements.
Why wrong: The existing logs may not contain slow queries; slow query logging must be enabled.
B
Enable AWS CloudTrail to capture database queries and send them to CloudWatch Logs.
Why wrong: CloudTrail records API calls, not database queries.
C
Enable the slow query log in the RDS parameter group and publish it to CloudWatch Logs. Then use CloudWatch Logs Insights to query the logs for slow queries.
Slow query logs directly show queries that take a long time.
D
Enable Amazon RDS Performance Insights and use the dashboard to identify top SQL queries.
Why wrong: Performance Insights shows top SQL queries but requires enabling; however, it may not show the exact query text.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

A SysOps administrator is troubleshooting an issue where an Application Load Balancer (ALB) is returning HTTP 503 errors to clients. The target group is healthy, and the instances are passing health checks. What is the most likely cause of the 503 errors?

A
The target instances have reached the maximum number of concurrent connections allowed by the application or operating system.
When the application's connection backlog is full, the ALB receives a 'connection refused' or timeout, resulting in a 503.
B
The target instances do not have enough capacity to handle the request volume.
Why wrong: Insufficient capacity typically results in increased latency or 502 errors when the load balancer times out, not a direct 503.
C
The health check settings are configured incorrectly, causing healthy instances to be marked as unhealthy.
Why wrong: Misconfigured health checks would show the targets as unhealthy in the console; the scenario states targets are healthy.
D
The security group for the targets does not allow traffic from the ALB.
Why wrong: A missing security group rule would cause health checks to fail and targets to be marked unhealthy, but the scenario states health checks pass.

Full breakdown with real-world context →

Question 7easymultiple choice

Full question →

A SysOps administrator is troubleshooting a Lambda function that does not write logs to CloudWatch Logs. The IAM role attached to the function includes the policy shown. What is the most likely reason the logs are not being created?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/my-function:*"
    }
  ]
}

A
The log group name in the Resource ARN does not match the actual log group created by the Lambda function.
Lambda creates log groups with a specific naming pattern; mismatch in name prevents writing.
B
The IAM role is not assigned to the Lambda function's execution role.
Why wrong: The administrator is troubleshooting an existing role; the role is attached.
C
The Lambda function is in a VPC without a VPC endpoint for CloudWatch Logs.
Why wrong: Lambda in a VPC can still reach CloudWatch via public endpoints if it has NAT gateway; VPC endpoints are not required.
D
The policy does not include the logs:PutLogEvents permission.
Why wrong: The policy includes logs:PutLogEvents, so permission is present.

Full breakdown with real-world context →

Question 8mediummulti select

Full question →

A company is using an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. The SysOps administrator notices that the scaling is not triggering as expected. Which THREE steps should the administrator take to troubleshoot the issue?

A
Check the scaling activity history in the Auto Scaling group for any errors or cooldown periods.
Activity history shows why scaling did not occur.
B
Ensure that the EC2 instances are passing the ELB health checks.
Why wrong: Health checks are for load balancer, not scaling.
C
Review the scaling policy's cooldown period and threshold settings.
Incorrect cooldown or thresholds can prevent scaling.
D
Verify that the CloudWatch alarm associated with the scaling policy is in ALARM state when CPU is high.
The alarm must trigger the scaling policy.
E
Manually increase the desired capacity to see if the scaling policy takes effect.
Why wrong: Manual changes do not test the policy.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full NAT/PAT explanation →

An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?

A
The NAT gateway's subnet does not have a route to an internet gateway
The NAT gateway needs a route to the IGW to reach the internet.
B
The private subnet's network ACL blocks outbound HTTPS traffic
Why wrong: That could be an issue, but the most likely cause is routing for the NAT gateway itself.
C
The security group attached to the NAT gateway does not allow outbound traffic
Why wrong: NAT gateways do not use security groups; they are controlled by network ACLs.
D
The private instances do not have a public IP address assigned
Why wrong: Private instances route through the NAT gateway, which provides internet access; they do not need public IPs.

Full breakdown with real-world context →

Question 10hardmulti select

Full question →

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot pull secrets from AWS Secrets Manager. The instance has an IAM role with a policy that allows secretsmanager:GetSecretValue. The secret is in the same account and region. What are possible reasons for the failure? (Choose THREE.)

A
The EC2 instance is in a private subnet with no route to the internet or a VPC endpoint for Secrets Manager
Without a route to the Secrets Manager service, the request will fail.
B
The secret is in a different AWS account
Why wrong: The scenario says same account and region.
C
The IAM role is not attached to the instance profile
Why wrong: The instance has a role, so it is attached.
D
The VPC endpoint for Secrets Manager has a policy that denies access from the instance's security group
The endpoint policy can restrict access based on source VPC or security group.
E
The secret is encrypted with a customer managed KMS key, and the IAM role does not have kms:Decrypt permission
Secrets Manager uses KMS for encryption; the role needs Decrypt permission on the key.

Full breakdown with real-world context →

Question 11hardmultiple choice

Review the full routing breakdown →

A SysOps administrator is troubleshooting connectivity issues between two VPCs in different AWS Regions. Both VPCs are connected via a VPC Peering connection. The route tables in both VPCs have routes pointing to the peering connection. Security groups allow all traffic. However, an EC2 instance in VPC A cannot ping an EC2 instance in VPC B. What is the most likely cause?

A
The network ACLs in subnets are blocking ICMP traffic.
Why wrong: While possible, this is less likely if security groups allow all traffic; NACLs must explicitly allow ICMP.
B
VPC Peering is not supported across AWS Regions.
Why wrong: Inter-Region VPC Peering is supported.
C
The route tables in the subnets where the instances reside do not include a route to the peered VPC's CIDR.
Subnet route tables must have explicit routes for the peered VPC's CIDR to the peering connection.
D
The security groups do not allow traffic from the peered VPC's security group ID.
Why wrong: Security groups can reference security group IDs only within the same VPC; cross-peering requires CIDR-based rules.

Full breakdown with real-world context →

Question 12easymultiple choice

Full question →

A company hosts a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. Which step should the SysOps administrator take to troubleshoot the issue?

A
Verify the target group health check settings.
Correct. Unhealthy targets cause 503 errors.
B
Enable cross-zone load balancing.
Why wrong: Cross-zone load balancing distributes traffic evenly but does not fix 503 errors.
C
Increase the idle timeout on the load balancer.
Why wrong: Idle timeout affects connection persistence, not target availability.
D
Add more subnets to the load balancer.
Why wrong: Adding subnets improves availability but does not directly resolve 503 errors from unhealthy targets.

Full breakdown with real-world context →

Question 13hardmultiple choice

Full question →

A SysOps administrator is troubleshooting an issue where an IAM user cannot assume a role in another AWS account. The trust policy of the role allows the user's account to assume the role, and the user has a permissions policy that allows sts:AssumeRole. However, the user still gets an access denied error. What is the MOST likely cause?

A
The trust policy specifies the user's ARN instead of the account ARN
Why wrong: Trust policy can specify account or user; both work.
B
The user's permissions policy does not include sts:AssumeRole for the specific role ARN
The user must have an IAM policy that allows sts:AssumeRole on the target role.
C
The role requires MFA, but the user does not have MFA configured
Why wrong: If required, the error would mention MFA.
D
The role's permissions policy does not include an external ID
Why wrong: External ID is only required for third-party access.

Full breakdown with real-world context →

Question 14mediummultiple choice

Full question →

A sysadmin receives an alert that a Network Load Balancer (NLB) is not passing traffic to targets. The target group health checks are passing. What is the MOST likely cause?

A
Cross-zone load balancing is disabled.
Why wrong: Disabling cross-zone may cause uneven distribution but not total failure.
B
The instances are in a private subnet without a route to the NLB's subnet.
NLB sends traffic directly to instance IPs; if no route back, traffic fails.
C
The listener is not configured for the correct protocol.
Why wrong: Listener configuration would affect health checks if incorrect.
D
The target group health check interval is too long.
Why wrong: Health checks passing means interval is not the issue.

Full breakdown with real-world context →

Question 15hardmulti select

Full question →

A SysOps Administrator is troubleshooting an issue where an Application Load Balancer (ALB) returns 502 Bad Gateway errors. Which THREE are possible causes? (Choose THREE.)

A
The target instance is taking too long to respond (e.g., more than the idle timeout).
Correct because a slow response can cause the ALB to timeout and return 502.
B
The target instance is configured to respond to a different URL path.
Why wrong: Incorrect because a path mismatch results in 404, not 502.
C
The ALB is configured with a different HTTP method than the target expects.
Why wrong: Incorrect because HTTP methods are not related to 502 errors.
D
The security group for the target instances does not allow traffic from the ALB.
Correct because if the ALB cannot connect to the target, it returns 502.
E
The target group has no healthy instances.
Correct because no healthy targets can cause 502.

Full breakdown with real-world context →

These SOA-C02 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style SOA-C02 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SOA-C02 topic practice pages

Monitoring, Logging, and Remediation practice questions

Reliability and Business Continuity practice questions

Deployment, Provisioning, and Automation practice questions

Security and Compliance practice questions

Networking and Content Delivery practice questions

Cost and Performance Optimization practice questions

SOA-C02 fundamentals practice questions

SOA-C02 scenario practice questions

SOA-C02 troubleshooting practice questions

Practice scenarios

Drag and drop the steps to troubleshoot high CPU usage on an Amazon EC2 instance into the correct order.

A SysOps administrator is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The administrator wants to identify the specific queries consuming the most CPU. What is the MOST efficient way to achieve this?

An organization has a CloudWatch dashboard that displays metrics for multiple AWS services. The dashboard is shared with the operations team. Recently, some team members reported that the dashboard is not loading for them. Which action should the SysOps administrator take to troubleshoot the issue?

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered using a VPC Peering connection. The instances in VPC A can ping the private IP of instances in VPC B, but not the DNS names. What is the most likely cause?

A SysOps administrator is troubleshooting an issue where an Application Load Balancer (ALB) is returning HTTP 503 errors to clients. The target group is healthy, and the instances are passing health checks. What is the most likely cause of the 503 errors?

A SysOps administrator is troubleshooting a Lambda function that does not write logs to CloudWatch Logs. The IAM role attached to the function includes the policy shown. What is the most likely reason the logs are not being created?

Exhibit

A company is using an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. The SysOps administrator notices that the scaling is not triggering as expected. Which THREE steps should the administrator take to troubleshoot the issue?

A company hosts a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. Which step should the SysOps administrator take to troubleshoot the issue?

A sysadmin receives an alert that a Network Load Balancer (NLB) is not passing traffic to targets. The target group health checks are passing. What is the MOST likely cause?

A SysOps Administrator is troubleshooting an issue where an Application Load Balancer (ALB) returns 502 Bad Gateway errors. Which THREE are possible causes? (Choose THREE.)