AWS SysOps practice questions: 498 questions with full explanations

Questions on the exam

65

Time allowed

130 minutes format →

Passing score

720 of 1000 — vendor, checked September 4, 2026 detail →

Exam fee

$150 — vendor, checked September 4, 2026 detail →

498 practice questions for AWS SysOps Administrator - Associate (SOA-C02, retired), grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min AWS SysOps readiness check →

AWS SysOps exam format →  ·  AWS SysOps passing score →  · AWS SysOps exam cost →

Questions by domain

• Monitoring, Logging, and Remediation — 100 questions →
• Networking and Content Delivery — 90 questions →
• Deployment, Provisioning, and Automation — 89 questions →
• Reliability and Business Continuity — 80 questions →
• Security and Compliance — 79 questions →
• Cost and Performance Optimization — 60 questions →

Sample questions

Memory utilization is not a default CloudWatch metric: What is the most likely cause and solution?

1. Memory utilization is not a default CloudWatch metric for EC2; install the CloudWatch Agent on the instances to collect memory metrics ✓

   AWS does not have access to the EC2 operating system internals by default. Memory, disk utilization, and swap are OS-level metrics that require the CloudWatch Agent (or the legacy collectd/StatsD integration) to collect and publish to CloudWatch as custom metrics.
2. Memory metrics appear only for instances that run inside a VPC, so confirm that these instances were not launched into the legacy EC2-Classic platform

   Memory metrics are unrelated to VPC vs EC2-Classic networking. Regardless of network placement, OS-level memory data requires the CloudWatch Agent to be installed and configured.
3. Create a CloudWatch alarm on CPUUtilization and rely on it as a proxy, since memory pressure always drives the reported CPU higher

   CPU and memory are independent metrics; high memory usage does not reliably raise CPU. The correct fix is to install the CloudWatch Agent to capture actual memory metrics.
4. Enable detailed monitoring on the EC2 instances, which surfaces operating-system memory metrics alongside CPU at a one-minute collection granularity

   Detailed monitoring reduces the collection interval from 5 minutes to 1 minute for standard EC2 metrics (CPU, network, disk I/O at the hypervisor level). It does NOT add memory, disk utilization, or OS-level metrics; those require the CloudWatch Agent regardless of monitoring mode.

All 100 Monitoring, Logging, and Remediation questions →

The Subnet-A instance can both initiate outbound: Which statement correctly describes the network behavior?

1. A public IP address by itself lets an instance reach the internet, so the route table configuration of its subnet has no real bearing on connectivity

   A public IP is necessary but not sufficient for internet communication. The subnet's route table must also have a route to an internet gateway. Without the route, the public IP cannot be used for internet communication.
2. The instance in Subnet-B can start outbound internet connections through its private IP address but is unable to accept any inbound internet connections

   Without a route to an internet gateway or NAT gateway, instances in Subnet-B cannot initiate outbound internet connections either. Outbound internet access for private subnets requires a NAT gateway in a public subnet.
3. The Subnet-A instance can both initiate outbound and accept inbound internet connections, while the Subnet-B instance cannot reach the internet at all ✓

   A subnet is public when its route table has a route to an internet gateway (0.0.0.0/0 → igw-xxx). The EC2 instance in Subnet-A has both a public IP and a route to the internet gateway, enabling bidirectional internet communication. Subnet-B has no internet gateway route, making it a private subnet — instances cannot reach the internet or be reached from the internet.
4. Both instances can accept inbound connections from the internet because they share the same VPC and therefore inherit the same reachability

   Being in the same VPC enables intra-VPC communication, but internet accessibility requires a public IP and a route to the internet gateway. Subnet-B has neither, so its instance is not accessible from the internet.

All 90 Networking and Content Delivery questions →

Apply a stack policy that denies Update: Which CloudFormation feature provides this protection?

1. Apply a stack policy that denies Update:Replace and Update:Delete actions on the RDS resource ✓

   CloudFormation stack policies define allowed update actions per resource. Denying Update:Replace and Update:Delete on the RDS logical ID prevents accidental replacement or deletion during stack updates while allowing all other resources to be updated.
2. Add a DeletionPolicy: Retain attribute to the RDS logical resource in the CloudFormation template

   DeletionPolicy: Retain preserves the physical resource when it is removed from the stack, but it does not block replacement during an update.
3. Attach an IAM policy that denies the cloudformation:UpdateStack action on the stack ARN

   Denying cloudformation:UpdateStack would block every update to the entire stack, not just changes to the RDS instance; stack policies give per-resource control.
4. Enable CloudFormation drift detection on the stack to alert on configuration changes

   Drift detection reports when live configuration diverges from the template, but it never prevents an update action from executing.

All 89 Deployment, Provisioning, and Automation questions →

Target tracking scaling policy with a target value of 50%: Which scaling policy type is most appropriate?

1. Target tracking scaling policy with a target value of 50% for the average CPUUtilization metric, which automatically creates and manages both the scale-out and scale-in CloudWatch alarms. ✓

   Target tracking policies maintain a metric at a specified target value. Auto Scaling automatically creates and manages the underlying CloudWatch alarms and adjusts instance count to keep average CPU near 50%. No separate scale-in/scale-out alarm configuration is needed.
2. Scheduled scaling that uses a recurring cron expression to set a fixed desired capacity derived from historical CPU patterns, adjusting the instance count on a predetermined daily timetable.

   Scheduled scaling applies fixed capacity at set times and cannot react to real-time CPU utilization, so it will not converge on a 50% average. Target tracking adapts continuously to the metric.
3. Simple scaling policy tied to a single CloudWatch alarm at 50% CPU that adds one instance whenever the threshold is breached and then waits out a cooldown period before evaluating again.

   Simple scaling reacts to one threshold with a cooldown and needs separate policies to scale in; it does not continuously drive average utilization toward a target. Target tracking handles both directions automatically.
4. Step scaling policy with manually defined steps at 40% and 60% CPU that adds instances above 60% and removes instances below 40%, using separate scale-out and scale-in step adjustments.

   Step scaling requires hand-defining steps and separate scale-in and scale-out policies. Target tracking reaches the same outcome automatically from a single target value of 50%.

All 80 Reliability and Business Continuity questions →

Access is denied: What is the result when the user attempts to access the bucket?

1. Access is allowed, because identity-based policies are evaluated with precedence over the resource-based bucket policy here

   There is no precedence between identity-based and resource-based policies. An explicit Deny from any source wins regardless of policy type.
2. Access depends on whether the user had MFA active at the exact moment the object read request was made

   MFA would need to be an explicit condition key in the policy. There is no automatic MFA override of a Deny statement.
3. Access is denied, because an explicit Deny in any applicable policy always overrides an Allow from any other source ✓

   In IAM policy evaluation, an explicit Deny in any applicable policy (identity-based, resource-based, SCP, permission boundary) always overrides any Allow. The bucket policy's explicit Deny supersedes the identity policy's Allow.
4. Access is allowed, because the Allow granted in the user's identity-based policy is enough to satisfy the request

   An Allow in an identity-based policy is insufficient when a resource-based policy has an explicit Deny. The Deny is evaluated and terminates the decision.

All 79 Security and Compliance questions →

AWS Cost Explorer: Which AWS tool provides this capability?

1. AWS Cost Explorer — provides interactive charts and filtering to analyze costs by service, instance type, region, account, and tags over custom date ranges ✓

   AWS Cost Explorer provides detailed cost visualization and filtering. Costs can be filtered and grouped by service, instance type, resource tag, region, and linked account. It supports up to 13 months of historical data.
2. AWS Trusted Advisor — identifies underutilized EC2 instances and provides cost optimization recommendations to help reduce spend across all accounts over time

   Trusted Advisor identifies cost savings opportunities (e.g., idle instances) but does not provide historical spend analysis or cost breakdown by instance type. Cost Explorer is the appropriate tool for spend analysis.
3. AWS Budgets — tracks current and forecasted spend against configured budget thresholds and sends alerts when EC2 costs approach the defined limits

   AWS Budgets tracks spend against budget thresholds and sends alerts. It provides high-level spend tracking, not the granular interactive cost analysis and instance-type breakdown available in Cost Explorer.
4. AWS CloudWatch — provides per-instance EC2 billing metrics and dashboards that can be filtered by instance type for historical cost analysis

   CloudWatch provides operational metrics (CPU, network, etc.) and billing alerts but does not provide the interactive cost breakdown and filtering capabilities of Cost Explorer.

All 60 Cost and Performance Optimization questions →

AWS migrates the instance to healthy hardware: Which statement accurately describes what happens to the instan

1. AWS terminates the failed instance and launches a fresh, identical replacement from the source AMI, assigning it a brand-new instance ID and instance metadata

   Recovery does not terminate the instance or create a new one. It migrates the existing instance to healthy hardware, preserving the instance ID and all associated attributes.
2. AWS migrates the instance to healthy hardware; the instance retains the same instance ID, Elastic IP, instance metadata, and private/public IP addresses ✓

   The EC2 recover action moves the instance to healthy underlying hardware while preserving the instance ID, Elastic IP (if associated), private IP, and instance metadata. It is different from a reboot; the instance gets new physical hardware but maintains its identity. Instance store data is not preserved.
3. AWS reboots the instance in place on the same underlying host hardware, which often fails to clear the original system status check failure

   Recovery is distinct from reboot. Recovery moves to healthy hardware specifically to address system-level failures (hypervisor, hardware, power, network). A reboot on the same failing hardware would not fix a hardware-level issue.
4. All instance store volume data survives the recover action because the original instance is migrated to new hardware rather than being terminated in the process

   Instance store volumes are ephemeral and tied to the underlying physical host. During EC2 recovery (migration to new hardware), instance store data is LOST. Only EBS-backed data is preserved.

All 100 Monitoring, Logging, and Remediation questions →

Deploy a NAT gateway in a public subnet and point: Which solution is most appropriate?

1. Deploy an EC2 NAT instance inside the private subnet, enable IP forwarding on it, and route all outbound traffic through it for internet software updates

   NAT instances must be deployed in PUBLIC subnets (with IGW route), not private subnets. Additionally, NAT instances require manual management (patching, HA) — the question asks for a managed solution.
2. Create a VPC peering connection to a VPC that has internet access and route the private instances' internet-bound traffic through that peer

   VPC peering does not support transitive routing. You cannot route internet traffic through a peered VPC's internet gateway. Each VPC must have its own internet access mechanism.
3. Assign Elastic IP addresses directly to the private-subnet EC2 instances so they can send outbound requests to the internet for updates

   Elastic IPs require the instances to be in a public subnet (with IGW route) to communicate with the internet. Assigning an EIP to an instance in a private subnet (with no IGW route) does not enable internet access.
4. Deploy a NAT gateway in a public subnet and point the private subnet route tables' 0.0.0.0/0 default route at that NAT gateway for outbound traffic ✓

   AWS NAT gateway is a fully managed service that enables instances in private subnets to initiate outbound connections to the internet while preventing inbound connections from the internet. It is placed in a public subnet and scales automatically. Private subnet route tables are updated to route 0.0.0.0/0 traffic to the NAT gateway.

All 90 Networking and Content Delivery questions →

AWS SysOps exam: the facts

How many questions are on the AWS SysOps exam?

65, as published by the exam vendor.

How long is the AWS SysOps exam?

130 minutes. Across 65 questions that is about 120 seconds per question.

What topics does the AWS SysOps exam cover?

6 domains: Monitoring, Logging, and Remediation, Networking and Content Delivery, Deployment, Provisioning, and Automation, Reliability and Business Continuity, Security and Compliance, Cost and Performance Optimization. Weights: Monitoring, Logging, and Remediation 0.2%, Networking and Content Delivery 0.18%, Deployment, Provisioning, and Automation 0.18%, Reliability and Business Continuity 0.16%, Security and Compliance 0.16%, Cost and Performance Optimization 0.12%.

How many AWS SysOps practice questions does Certsqill have?

498, spread across 6 exam domains. Every one shows all options, which is correct, and why each of the others is not.