AWS
SysOps Administrator Associate
Monitoring, Reliability, Deployment, Security, Networking & Cost
Exam: SOA-C02
65 Questions & Verified Answers
AWS SysOps Administrator Associate SOA-C02 — 65
Exam Questions
Domain 1: Monitoring, Logging & Remediation (Q01–Q13)
Q01. A SysOps engineer receives an alert that an EC2 instance is failing its System Status Check.
What is the MOST appropriate immediate action?
A. Reboot the instance using the EC2 console reboot option
B. Terminate the instance and launch a new one from an AMI snapshot
C. Stop and Start the instance — this migrates it to different underlying hardware and resolves
most system status check failures caused by AWS infrastructure issues
D. SSH into the instance and run hardware diagnostics
Answer: C. Stop and Start the instance — migrates it to different underlying hardware
resolving infrastructure-level failures
System Status Check tests AWS hardware, power, network, and host. Failure = infrastructure
problem, not OS.
Stop + Start (NOT Reboot): rebooting keeps instance on same host. Stop + Start moves it to new
hardware.
Auto-recovery: configure CloudWatch alarm → EC2 recover action for automated recovery without
manual intervention.
Instance Status Check (different): tests the OS and application. Fix: troubleshoot inside the
instance.
Q02. A team wants to create a CloudWatch alarm that only fires when BOTH CPU utilization
exceeds 80% AND the number of healthy hosts in a target group drops below 2 simultaneously.
Which CloudWatch feature supports this?
A. CloudWatch Metric Math combined with a single threshold alarm
B. Multiple individual CloudWatch alarms with SNS notifications
C. AWS Health Dashboard event correlation
, D. CloudWatch Composite Alarm — combines multiple alarms using Boolean logic
(AND/OR/NOT), triggering only when all specified conditions are simultaneously true
Answer: D. CloudWatch Composite Alarm — combines multiple alarms with AND/OR/NOT
Boolean operators
Composite alarms reduce alarm noise by requiring multiple conditions to be true at the same time.
Configuration: ALARM_RULE = 'ALARM(CPUHighAlarm) AND ALARM(UnhealthyHostsAlarm)'
Benefit: single meaningful page instead of multiple individual alarm notifications.
Nested composites: a composite alarm can include other composite alarms for complex alert logic.
Q03. An application running on EC2 is not reporting memory utilization or disk space to
CloudWatch. What is the MOST likely cause and solution?
A. Memory and disk metrics are disabled by default — enable them in the EC2 console billing
settings
B. CloudWatch does not support memory metrics for EC2
C. The EC2 instance needs to be a specific instance type to support memory metrics
D. The CloudWatch Agent is not installed or configured — EC2 default metrics only capture
hypervisor-level data (CPU, network, disk I/O). Install and configure the CloudWatch Agent to
collect OS-level metrics including memory and disk space
Answer: D. CloudWatch Agent not installed — default EC2 metrics are hypervisor-level only;
Agent is required for memory and disk
Default EC2 metrics: CPUUtilization, NetworkIn/Out, DiskReadOps — from the hypervisor, not the
OS.
Missing: MemoryUtilization, disk space used, swap usage — these require the CloudWatch Agent
inside the OS.
Install: via Systems Manager Run Command (AWS-ConfigureAWSPackage with
AmazonCloudWatchAgent) or user data.
Agent config: specify metrics namespace, collection interval, and log files to collect in the JSON
config file.
Q04. A SysOps engineer needs to query CloudWatch Logs to find all ERROR-level events from
the last 3 hours across 5 different log groups, and aggregate the count by 15-minute intervals.
Which tool is best suited?
A. CloudWatch Metrics with a metric filter
B. AWS CloudTrail Lake for log querying
C. Amazon Athena querying logs exported to S3
D. CloudWatch Logs Insights — supports cross-log-group queries (up to 50 groups), time
range filtering, and the 'stats count(*) by bin(15m)' aggregation command to produce time-
series counts
Answer: D. CloudWatch Logs Insights — cross-log-group queries, time filtering, stats by
bin() for time-series aggregation
Query: fields @timestamp, @message | filter @message like /ERROR/ | stats count(*) by bin(15m)
Cross-group: specify multiple log groups in the Log Insights query editor — up to 50 groups at once.
Visualization: bin() results automatically produce a time-series chart in the console.
Cost: charged per GB of log data scanned — use time range filters to minimize scan costs.
, Q05. A company uses AWS CloudTrail and needs to be immediately alerted when the root
account is used to sign in to the AWS Management Console. What combination of services
achieves this?
A. Configure CloudTrail to send an email when root login is detected
B. Enable AWS Config rule 'root-account-mfa-enabled' with SNS notification
C. Use AWS Trusted Advisor to monitor root account usage
D. Create a CloudWatch Logs metric filter on the CloudTrail log group that matches root login
events (eventName: ConsoleLogin, userIdentity.type: Root), create a CloudWatch alarm on
that metric, and link it to an SNS topic for immediate notification
Answer: D. CloudWatch Logs metric filter on CloudTrail logs for root ConsoleLogin →
CloudWatch alarm → SNS notification
Filter pattern: { ($.userIdentity.type = Root) && ($.eventName = ConsoleLogin) }
Metric filter creates a custom CloudWatch metric — alarm triggers when count >= 1.
SNS topic: send email, SMS, or trigger Lambda for immediate automated response.
This is a CIS AWS Foundations Benchmark recommendation — a security best practice.
Q06. A SysOps engineer wants to automatically restart an EC2 instance whenever a CloudWatch
alarm detects that the instance is impaired. What is the MOST operationally efficient approach?
A. Create a Lambda function triggered by SNS to call the EC2 RebootInstances API
B. Create a CloudWatch alarm with the EC2 reboot action — this directly restarts the instance
without requiring Lambda or SNS
C. Use AWS Systems Manager Automation to periodically reboot all instances
D. Configure Auto Scaling to terminate and replace the impaired instance
Answer: B. CloudWatch alarm with built-in EC2 reboot action — directly restarts the instance
without Lambda or SNS
CloudWatch alarm actions: Reboot (restart instance), Stop, Terminate, or Recover.
Recover action: migrates the instance to new hardware AND preserves the IP address and instance
ID.
Most efficient: built-in EC2 actions are simpler than Lambda — no additional code to maintain.
Use Recover for System Status Check failures; use Reboot for Instance Status Check failures.
Q07. An application writes logs to /var/log/app/error.log on EC2 instances. A SysOps engineer
needs these logs in CloudWatch Logs in real time. What is the CORRECT approach?
A. Configure an S3 event notification to trigger a Lambda function that reads the log file
B. Use AWS CloudTrail Data Events to capture the log file writes
C. Enable VPC Flow Logs and filter for the application log traffic
D. Install the CloudWatch Agent on the EC2 instances, configure the agent to monitor
/var/log/app/error.log, and specify the target CloudWatch Logs log group and log stream in the
agent configuration file
Answer: D. Install CloudWatch Agent, configure it to monitor /var/log/app/error.log, specify
target log group and stream
Agent config (JSON): logs section → log_files → file_path: /var/log/app/error.log, log_group_name:
/app/errors.
Deploy at scale: use Systems Manager Run Command with AWS-ConfigureAWSPackage to deploy
the agent fleet-wide.
SysOps Administrator Associate
Monitoring, Reliability, Deployment, Security, Networking & Cost
Exam: SOA-C02
65 Questions & Verified Answers
AWS SysOps Administrator Associate SOA-C02 — 65
Exam Questions
Domain 1: Monitoring, Logging & Remediation (Q01–Q13)
Q01. A SysOps engineer receives an alert that an EC2 instance is failing its System Status Check.
What is the MOST appropriate immediate action?
A. Reboot the instance using the EC2 console reboot option
B. Terminate the instance and launch a new one from an AMI snapshot
C. Stop and Start the instance — this migrates it to different underlying hardware and resolves
most system status check failures caused by AWS infrastructure issues
D. SSH into the instance and run hardware diagnostics
Answer: C. Stop and Start the instance — migrates it to different underlying hardware
resolving infrastructure-level failures
System Status Check tests AWS hardware, power, network, and host. Failure = infrastructure
problem, not OS.
Stop + Start (NOT Reboot): rebooting keeps instance on same host. Stop + Start moves it to new
hardware.
Auto-recovery: configure CloudWatch alarm → EC2 recover action for automated recovery without
manual intervention.
Instance Status Check (different): tests the OS and application. Fix: troubleshoot inside the
instance.
Q02. A team wants to create a CloudWatch alarm that only fires when BOTH CPU utilization
exceeds 80% AND the number of healthy hosts in a target group drops below 2 simultaneously.
Which CloudWatch feature supports this?
A. CloudWatch Metric Math combined with a single threshold alarm
B. Multiple individual CloudWatch alarms with SNS notifications
C. AWS Health Dashboard event correlation
, D. CloudWatch Composite Alarm — combines multiple alarms using Boolean logic
(AND/OR/NOT), triggering only when all specified conditions are simultaneously true
Answer: D. CloudWatch Composite Alarm — combines multiple alarms with AND/OR/NOT
Boolean operators
Composite alarms reduce alarm noise by requiring multiple conditions to be true at the same time.
Configuration: ALARM_RULE = 'ALARM(CPUHighAlarm) AND ALARM(UnhealthyHostsAlarm)'
Benefit: single meaningful page instead of multiple individual alarm notifications.
Nested composites: a composite alarm can include other composite alarms for complex alert logic.
Q03. An application running on EC2 is not reporting memory utilization or disk space to
CloudWatch. What is the MOST likely cause and solution?
A. Memory and disk metrics are disabled by default — enable them in the EC2 console billing
settings
B. CloudWatch does not support memory metrics for EC2
C. The EC2 instance needs to be a specific instance type to support memory metrics
D. The CloudWatch Agent is not installed or configured — EC2 default metrics only capture
hypervisor-level data (CPU, network, disk I/O). Install and configure the CloudWatch Agent to
collect OS-level metrics including memory and disk space
Answer: D. CloudWatch Agent not installed — default EC2 metrics are hypervisor-level only;
Agent is required for memory and disk
Default EC2 metrics: CPUUtilization, NetworkIn/Out, DiskReadOps — from the hypervisor, not the
OS.
Missing: MemoryUtilization, disk space used, swap usage — these require the CloudWatch Agent
inside the OS.
Install: via Systems Manager Run Command (AWS-ConfigureAWSPackage with
AmazonCloudWatchAgent) or user data.
Agent config: specify metrics namespace, collection interval, and log files to collect in the JSON
config file.
Q04. A SysOps engineer needs to query CloudWatch Logs to find all ERROR-level events from
the last 3 hours across 5 different log groups, and aggregate the count by 15-minute intervals.
Which tool is best suited?
A. CloudWatch Metrics with a metric filter
B. AWS CloudTrail Lake for log querying
C. Amazon Athena querying logs exported to S3
D. CloudWatch Logs Insights — supports cross-log-group queries (up to 50 groups), time
range filtering, and the 'stats count(*) by bin(15m)' aggregation command to produce time-
series counts
Answer: D. CloudWatch Logs Insights — cross-log-group queries, time filtering, stats by
bin() for time-series aggregation
Query: fields @timestamp, @message | filter @message like /ERROR/ | stats count(*) by bin(15m)
Cross-group: specify multiple log groups in the Log Insights query editor — up to 50 groups at once.
Visualization: bin() results automatically produce a time-series chart in the console.
Cost: charged per GB of log data scanned — use time range filters to minimize scan costs.
, Q05. A company uses AWS CloudTrail and needs to be immediately alerted when the root
account is used to sign in to the AWS Management Console. What combination of services
achieves this?
A. Configure CloudTrail to send an email when root login is detected
B. Enable AWS Config rule 'root-account-mfa-enabled' with SNS notification
C. Use AWS Trusted Advisor to monitor root account usage
D. Create a CloudWatch Logs metric filter on the CloudTrail log group that matches root login
events (eventName: ConsoleLogin, userIdentity.type: Root), create a CloudWatch alarm on
that metric, and link it to an SNS topic for immediate notification
Answer: D. CloudWatch Logs metric filter on CloudTrail logs for root ConsoleLogin →
CloudWatch alarm → SNS notification
Filter pattern: { ($.userIdentity.type = Root) && ($.eventName = ConsoleLogin) }
Metric filter creates a custom CloudWatch metric — alarm triggers when count >= 1.
SNS topic: send email, SMS, or trigger Lambda for immediate automated response.
This is a CIS AWS Foundations Benchmark recommendation — a security best practice.
Q06. A SysOps engineer wants to automatically restart an EC2 instance whenever a CloudWatch
alarm detects that the instance is impaired. What is the MOST operationally efficient approach?
A. Create a Lambda function triggered by SNS to call the EC2 RebootInstances API
B. Create a CloudWatch alarm with the EC2 reboot action — this directly restarts the instance
without requiring Lambda or SNS
C. Use AWS Systems Manager Automation to periodically reboot all instances
D. Configure Auto Scaling to terminate and replace the impaired instance
Answer: B. CloudWatch alarm with built-in EC2 reboot action — directly restarts the instance
without Lambda or SNS
CloudWatch alarm actions: Reboot (restart instance), Stop, Terminate, or Recover.
Recover action: migrates the instance to new hardware AND preserves the IP address and instance
ID.
Most efficient: built-in EC2 actions are simpler than Lambda — no additional code to maintain.
Use Recover for System Status Check failures; use Reboot for Instance Status Check failures.
Q07. An application writes logs to /var/log/app/error.log on EC2 instances. A SysOps engineer
needs these logs in CloudWatch Logs in real time. What is the CORRECT approach?
A. Configure an S3 event notification to trigger a Lambda function that reads the log file
B. Use AWS CloudTrail Data Events to capture the log file writes
C. Enable VPC Flow Logs and filter for the application log traffic
D. Install the CloudWatch Agent on the EC2 instances, configure the agent to monitor
/var/log/app/error.log, and specify the target CloudWatch Logs log group and log stream in the
agent configuration file
Answer: D. Install CloudWatch Agent, configure it to monitor /var/log/app/error.log, specify
target log group and stream
Agent config (JSON): logs section → log_files → file_path: /var/log/app/error.log, log_group_name:
/app/errors.
Deploy at scale: use Systems Manager Run Command with AWS-ConfigureAWSPackage to deploy
the agent fleet-wide.
