1
AWS Certified SysOps
Administrator – Associate (SOA-
C02) Practice Exam V2.0 – 150
Advanced Multiple-Choice
Questions a well detailed one
written and graded
A+ upgraded
, 2
Domain 1: Monitoring, Logging, and Remediation (Questions 1–25)
Question 1
A SysOps administrator is troubleshooting an application that fails intermittently. The
administrator needs to correlate application logs with system-level metrics from the same EC2
instance. Which approach provides the MOST effective correlation?
A) Export CloudWatch Logs to S3 and use Athena to query logs alongside CloudTrail events
B) Use CloudWatch Logs Insights with the @timestamp field to join with CloudWatch metrics
C) Enable detailed monitoring on the EC2 instance and use the CloudWatch console
D) Install the CloudWatch agent with the logs and metrics configuration, then use CloudWatch
Logs Insights and metric math
- detailed answer 100% correct :- D
Rationale: The CloudWatch agent can collect both logs and custom metrics from EC2 instances.
CloudWatch Logs Insights allows querying logs, and metric math can combine log-based metrics
with system metrics for correlation. CloudWatch does not natively support joining logs with
metrics in a single query.
Question 2
An organization has enabled AWS CloudTrail in an AWS account. The security team requires that
all management events be retained for 7 years. What is the MOST cost-effective approach?
A) Enable CloudTrail logging to CloudWatch Logs with a 7-year retention policy
B) Enable CloudTrail logging to S3 with a lifecycle policy to transition to S3 Glacier Deep Archive
after 30 days
C) Enable CloudTrail logging to S3 with versioning enabled
D) Enable CloudTrail logging to both S3 and CloudWatch Logs with a 7-year retention policy
- detailed answer 100% correct :- B
Rationale: S3 Glacier Deep Archive provides the lowest-cost long-term storage. A lifecycle policy
automates the transition from S3 Standard to Glacier Deep Archive after 30 days, balancing cost
and accessibility for the 7-year retention requirement.
, 3
Question 3
A CloudWatch alarm configured with an SNS topic is in the ALARM state. The SysOps
administrator receives no notifications. What is the MOST likely cause?
A) The SNS topic is not configured with a subscription
B) The CloudWatch alarm is in the INSUFFICIENT_DATA state
C) The IAM role for CloudWatch does not have permissions to publish to SNS
D) The alarm period is set to a value that is too long
- detailed answer 100% correct :- A
Rationale: For an SNS topic to deliver notifications, it must have at least one confirmed
subscription (e.g., email, SMS, Lambda). Even if CloudWatch publishes to SNS, without a
subscription, no one receives the notification.
Question 4
A SysOps administrator needs to monitor the number of 5xx error responses from an
Application Load Balancer. Which CloudWatch metric should be used?
A) HTTPCode_ELB_5XX_Count
B) TargetResponseTime
C) HealthyHostCount
D) RequestCount
- detailed answer 100% correct :- A
Rationale: HTTPCode_ELB_5XX_Count is the CloudWatch metric that tracks the number of
HTTP 5xx error responses generated by the Application Load Balancer. This metric is available in
the AWS/ApplicationELB namespace.
Question 5
A company has deployed an application that runs on EC2 instances in an Auto Scaling group.
The SysOps administrator needs to receive a notification when any instance in the group is
terminated due to a health check failure. What is the MOST efficient solution?
A) Create a CloudWatch alarm on the StatusCheckFailed metric for each instance
B) Create an EventBridge rule that matches Auto Scaling instance termination events
C) Configure CloudTrail to log Auto Scaling events and send to SNS
D) Use AWS Config to monitor instance health status
, 4
- detailed answer 100% correct :- B
Rationale: EventBridge can capture EC2 Auto Scaling lifecycle events, including instance
termination due to health check failures. This provides a centralized way to monitor these
events without creating per-instance alarms.
Question 6
Which CloudWatch Logs feature enables real-time processing of log data as it arrives?
A) Log groups
B) Metric filters
C) Subscription filters
D) Log streams
- detailed answer 100% correct :- C
Rationale: CloudWatch Logs subscription filters provide a real-time feed of log events to AWS
services like Kinesis, Lambda, or OpenSearch. Unlike metric filters (which create metrics from
logs), subscription filters enable real-time streaming and processing.
Question 7
A SysOps administrator needs to create a CloudWatch dashboard that aggregates metrics from
multiple AWS accounts. What is the correct approach?
A) Use CloudWatch cross-account observability with a designated monitoring account
B) Create separate dashboards in each account and use the AWS Management Console to
switch between them
C) Use AWS Organizations to share CloudWatch dashboards across accounts
D) Export metrics from each account to S3 and import into a single dashboard
- detailed answer 100% correct :- A
Rationale: CloudWatch cross-account observability allows you to monitor and troubleshoot
applications that span multiple accounts within a Region. A monitoring account can view and
interact with metrics and logs from source accounts without switching between accounts.
Question 8
A SysOps administrator is investigating a performance issue and needs to analyze CloudTrail logs
AWS Certified SysOps
Administrator – Associate (SOA-
C02) Practice Exam V2.0 – 150
Advanced Multiple-Choice
Questions a well detailed one
written and graded
A+ upgraded
, 2
Domain 1: Monitoring, Logging, and Remediation (Questions 1–25)
Question 1
A SysOps administrator is troubleshooting an application that fails intermittently. The
administrator needs to correlate application logs with system-level metrics from the same EC2
instance. Which approach provides the MOST effective correlation?
A) Export CloudWatch Logs to S3 and use Athena to query logs alongside CloudTrail events
B) Use CloudWatch Logs Insights with the @timestamp field to join with CloudWatch metrics
C) Enable detailed monitoring on the EC2 instance and use the CloudWatch console
D) Install the CloudWatch agent with the logs and metrics configuration, then use CloudWatch
Logs Insights and metric math
- detailed answer 100% correct :- D
Rationale: The CloudWatch agent can collect both logs and custom metrics from EC2 instances.
CloudWatch Logs Insights allows querying logs, and metric math can combine log-based metrics
with system metrics for correlation. CloudWatch does not natively support joining logs with
metrics in a single query.
Question 2
An organization has enabled AWS CloudTrail in an AWS account. The security team requires that
all management events be retained for 7 years. What is the MOST cost-effective approach?
A) Enable CloudTrail logging to CloudWatch Logs with a 7-year retention policy
B) Enable CloudTrail logging to S3 with a lifecycle policy to transition to S3 Glacier Deep Archive
after 30 days
C) Enable CloudTrail logging to S3 with versioning enabled
D) Enable CloudTrail logging to both S3 and CloudWatch Logs with a 7-year retention policy
- detailed answer 100% correct :- B
Rationale: S3 Glacier Deep Archive provides the lowest-cost long-term storage. A lifecycle policy
automates the transition from S3 Standard to Glacier Deep Archive after 30 days, balancing cost
and accessibility for the 7-year retention requirement.
, 3
Question 3
A CloudWatch alarm configured with an SNS topic is in the ALARM state. The SysOps
administrator receives no notifications. What is the MOST likely cause?
A) The SNS topic is not configured with a subscription
B) The CloudWatch alarm is in the INSUFFICIENT_DATA state
C) The IAM role for CloudWatch does not have permissions to publish to SNS
D) The alarm period is set to a value that is too long
- detailed answer 100% correct :- A
Rationale: For an SNS topic to deliver notifications, it must have at least one confirmed
subscription (e.g., email, SMS, Lambda). Even if CloudWatch publishes to SNS, without a
subscription, no one receives the notification.
Question 4
A SysOps administrator needs to monitor the number of 5xx error responses from an
Application Load Balancer. Which CloudWatch metric should be used?
A) HTTPCode_ELB_5XX_Count
B) TargetResponseTime
C) HealthyHostCount
D) RequestCount
- detailed answer 100% correct :- A
Rationale: HTTPCode_ELB_5XX_Count is the CloudWatch metric that tracks the number of
HTTP 5xx error responses generated by the Application Load Balancer. This metric is available in
the AWS/ApplicationELB namespace.
Question 5
A company has deployed an application that runs on EC2 instances in an Auto Scaling group.
The SysOps administrator needs to receive a notification when any instance in the group is
terminated due to a health check failure. What is the MOST efficient solution?
A) Create a CloudWatch alarm on the StatusCheckFailed metric for each instance
B) Create an EventBridge rule that matches Auto Scaling instance termination events
C) Configure CloudTrail to log Auto Scaling events and send to SNS
D) Use AWS Config to monitor instance health status
, 4
- detailed answer 100% correct :- B
Rationale: EventBridge can capture EC2 Auto Scaling lifecycle events, including instance
termination due to health check failures. This provides a centralized way to monitor these
events without creating per-instance alarms.
Question 6
Which CloudWatch Logs feature enables real-time processing of log data as it arrives?
A) Log groups
B) Metric filters
C) Subscription filters
D) Log streams
- detailed answer 100% correct :- C
Rationale: CloudWatch Logs subscription filters provide a real-time feed of log events to AWS
services like Kinesis, Lambda, or OpenSearch. Unlike metric filters (which create metrics from
logs), subscription filters enable real-time streaming and processing.
Question 7
A SysOps administrator needs to create a CloudWatch dashboard that aggregates metrics from
multiple AWS accounts. What is the correct approach?
A) Use CloudWatch cross-account observability with a designated monitoring account
B) Create separate dashboards in each account and use the AWS Management Console to
switch between them
C) Use AWS Organizations to share CloudWatch dashboards across accounts
D) Export metrics from each account to S3 and import into a single dashboard
- detailed answer 100% correct :- A
Rationale: CloudWatch cross-account observability allows you to monitor and troubleshoot
applications that span multiple accounts within a Region. A monitoring account can view and
interact with metrics and logs from source accounts without switching between accounts.
Question 8
A SysOps administrator is investigating a performance issue and needs to analyze CloudTrail logs
