AWS Certified SysOps Administrator SOA-C02 Exam 2026:
Certification Practice Test — Monitoring, Reliability, Automation,
Security, Networking & Cost Optimization — 190 Multiple-Choice
Questions with Answers & Detailed Rationales
DOMAIN 1: MONITORING, LOGGING, AND REMEDIATION (Questions 1–38)
Question 1
A SysOps administrator needs to monitor a fleet of EC2 instances for high CPU utilization and
automatically recover instances that become unresponsive. The recovery must preserve the
instance ID and private IP address. Which solution should be implemented?
A. Configure a CloudWatch alarm with the recover action for the instance
B. Create an Auto Scaling group with a minimum of one instance and terminate unhealthy
instances
C. Implement a Lambda function that stops and starts the instance when CPU exceeds
threshold
D. Configure EC2 Auto Recovery using a lifecycle hook with SNS notification
Correct Answer: A
Explanation: EC2 auto recovery preserves instance ID, private IP, and Elastic IP, whereas Auto
Scaling replaces instances entirely.
Question 2
A company requires that all API calls made in its AWS account be logged and searchable for
at least 90 days. The logs must capture the identity of the caller and the source IP address.
Which service configuration meets these requirements?
,A. Enable AWS CloudTrail with a multi-region trail delivering to CloudWatch Logs
B. Enable VPC Flow Logs for all VPCs and deliver to S3
C. Configure AWS Config with recording of all resource types
D. Enable Amazon GuardDuty with findings exported to S3
Correct Answer: A
Explanation: CloudTrail captures API caller identity and source IP; multi-region ensures
comprehensive coverage.
Question 3
A SysOps administrator notices that a critical application's CloudWatch Logs group is growing
rapidly, incurring unexpected costs. The logs must be retained for compliance for one year.
Which action reduces cost while meeting retention requirements?
A. Modify the log group retention policy to 365 days
B. Create a subscription filter to stream logs to S3 and delete the log group
C. Export existing logs to S3 and set retention to one day
D. Enable CloudWatch Logs Insights for automatic archiving
Correct Answer: C
Explanation: Exporting to S3 provides low-cost long-term storage, while short CloudWatch
retention minimizes ingest costs.
Question 4
,An application running on EC2 instances generates custom metrics that need to be visualized
alongside standard AWS metrics. The operations team wants to detect anomalies in request
latency automatically. What should the SysOps administrator configure?
A. CloudWatch custom metrics with anomaly detection bands
B. CloudWatch Logs metric filters with alarm thresholds
C. AWS X-Ray traces with service maps
D. Amazon Managed Grafana with CloudWatch data source
Correct Answer: A
Explanation: CloudWatch anomaly detection uses ML to establish normal baselines and
alerts on deviations automatically.
Question 5
A SysOps administrator receives an alert that an RDS instance's free storage space is critically
low. The administrator needs to ensure proactive notifications before storage falls below
10%. Which configuration should be implemented?
A. RDS Enhanced Monitoring with a CloudWatch alarm on FreeStorageSpace
B. RDS Performance Insights with a threshold-based alert
C. A CloudWatch alarm on the FreeStorageSpace metric with a threshold of 10% of allocated
storage
D. AWS Trusted Advisor check for RDS storage with email notification
Correct Answer: C
Explanation: CloudWatch alarms on the FreeStorageSpace metric provide direct threshold-
based notification for proactive management.
, Question 6
A company's security team requires that all failed SSH login attempts on Linux EC2 instances
be detected and trigger an automated response. Which combination of services achieves
this?
A. CloudWatch Logs agent + metric filter + alarm + SNS
B. VPC Flow Logs + GuardDuty + Lambda
C. AWS Config rule + SSM Automation + SNS
D. CloudTrail + EventBridge + Step Functions
Correct Answer: A
Explanation: CloudWatch Logs agent ships auth logs; a metric filter counts failures; alarm
triggers SNS for notification.
Question 7
A SysOps administrator needs to troubleshoot intermittent latency spikes in a microservices
application. The team requires end-to-end tracing across service boundaries. Which service
should be enabled?
A. AWS CloudTrail with data events
B. Amazon CloudWatch ServiceLens
C. AWS X-Ray with tracing enabled on all services
D. VPC Reachability Analyzer
Correct Answer: C
Certification Practice Test — Monitoring, Reliability, Automation,
Security, Networking & Cost Optimization — 190 Multiple-Choice
Questions with Answers & Detailed Rationales
DOMAIN 1: MONITORING, LOGGING, AND REMEDIATION (Questions 1–38)
Question 1
A SysOps administrator needs to monitor a fleet of EC2 instances for high CPU utilization and
automatically recover instances that become unresponsive. The recovery must preserve the
instance ID and private IP address. Which solution should be implemented?
A. Configure a CloudWatch alarm with the recover action for the instance
B. Create an Auto Scaling group with a minimum of one instance and terminate unhealthy
instances
C. Implement a Lambda function that stops and starts the instance when CPU exceeds
threshold
D. Configure EC2 Auto Recovery using a lifecycle hook with SNS notification
Correct Answer: A
Explanation: EC2 auto recovery preserves instance ID, private IP, and Elastic IP, whereas Auto
Scaling replaces instances entirely.
Question 2
A company requires that all API calls made in its AWS account be logged and searchable for
at least 90 days. The logs must capture the identity of the caller and the source IP address.
Which service configuration meets these requirements?
,A. Enable AWS CloudTrail with a multi-region trail delivering to CloudWatch Logs
B. Enable VPC Flow Logs for all VPCs and deliver to S3
C. Configure AWS Config with recording of all resource types
D. Enable Amazon GuardDuty with findings exported to S3
Correct Answer: A
Explanation: CloudTrail captures API caller identity and source IP; multi-region ensures
comprehensive coverage.
Question 3
A SysOps administrator notices that a critical application's CloudWatch Logs group is growing
rapidly, incurring unexpected costs. The logs must be retained for compliance for one year.
Which action reduces cost while meeting retention requirements?
A. Modify the log group retention policy to 365 days
B. Create a subscription filter to stream logs to S3 and delete the log group
C. Export existing logs to S3 and set retention to one day
D. Enable CloudWatch Logs Insights for automatic archiving
Correct Answer: C
Explanation: Exporting to S3 provides low-cost long-term storage, while short CloudWatch
retention minimizes ingest costs.
Question 4
,An application running on EC2 instances generates custom metrics that need to be visualized
alongside standard AWS metrics. The operations team wants to detect anomalies in request
latency automatically. What should the SysOps administrator configure?
A. CloudWatch custom metrics with anomaly detection bands
B. CloudWatch Logs metric filters with alarm thresholds
C. AWS X-Ray traces with service maps
D. Amazon Managed Grafana with CloudWatch data source
Correct Answer: A
Explanation: CloudWatch anomaly detection uses ML to establish normal baselines and
alerts on deviations automatically.
Question 5
A SysOps administrator receives an alert that an RDS instance's free storage space is critically
low. The administrator needs to ensure proactive notifications before storage falls below
10%. Which configuration should be implemented?
A. RDS Enhanced Monitoring with a CloudWatch alarm on FreeStorageSpace
B. RDS Performance Insights with a threshold-based alert
C. A CloudWatch alarm on the FreeStorageSpace metric with a threshold of 10% of allocated
storage
D. AWS Trusted Advisor check for RDS storage with email notification
Correct Answer: C
Explanation: CloudWatch alarms on the FreeStorageSpace metric provide direct threshold-
based notification for proactive management.
, Question 6
A company's security team requires that all failed SSH login attempts on Linux EC2 instances
be detected and trigger an automated response. Which combination of services achieves
this?
A. CloudWatch Logs agent + metric filter + alarm + SNS
B. VPC Flow Logs + GuardDuty + Lambda
C. AWS Config rule + SSM Automation + SNS
D. CloudTrail + EventBridge + Step Functions
Correct Answer: A
Explanation: CloudWatch Logs agent ships auth logs; a metric filter counts failures; alarm
triggers SNS for notification.
Question 7
A SysOps administrator needs to troubleshoot intermittent latency spikes in a microservices
application. The team requires end-to-end tracing across service boundaries. Which service
should be enabled?
A. AWS CloudTrail with data events
B. Amazon CloudWatch ServiceLens
C. AWS X-Ray with tracing enabled on all services
D. VPC Reachability Analyzer
Correct Answer: C
