--- title: "AWS SysOps Administrator Associate Flashcards (SOA-C02)" description: "Full exam coverage for the AWS Certified SysOps Administrator Associate (SOA-C02) exam using spaced repetition. Covers monitoring, reliability, deployment, security, networking, and cost optimization." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/flashcards/post/aws-sysops-administrator-associate-flashcards --- # AWS SysOps Administrator Associate Flashcards (SOA-C02) ## Flashcards ### 1. What are the default and detailed metric resolutions in CloudWatch? Standard metrics report at 60-second resolution by default. Detailed monitoring (and custom metrics) supports 1-second high-resolution metrics, billed per metric. ### 2. What are the three CloudWatch alarm states? OK (metric is within threshold), ALARM (threshold breached), and INSUFFICIENT_DATA (not enough data points yet, often during startup). ### 3. How do you publish a custom application metric to CloudWatch? Use the PutMetricData API (via SDK, CLI, or the CloudWatch agent). You define the namespace, metric name, dimensions, value, and optional unit. ``` aws cloudwatch put-metric-data \ --namespace "MyApp" \ --metric-name "ActiveUsers" \ --dimensions Environment=prod \ --value 42 \ --unit Count ``` ### 4. What is CloudWatch Logs Insights and what does it use? A purpose-built interactive query service for log data in CloudWatch Logs. It uses its own query language with commands like fields, filter, stats, sort, and limit. ``` # Find the top 10 slowest requests in an API log group fields @timestamp, @message, duration | filter @message like /Request/ | sort duration desc | limit 10 ``` ### 5. How does EventBridge differ from the original CloudWatch Events? EventBridge is the evolution of CloudWatch Events. It adds custom event buses, partner event sources (SaaS integrations), schema discovery, and a schema registry, while keeping full backward compatibility. ### 6. What does AWS Config do? AWS Config records the configuration of supported AWS resources over time and continuously evaluates them against rules (managed or custom Lambda-backed) to track compliance and detect drift. ### 7. What is an SSM Automation runbook? A Systems Manager document (type Automation) that defines a multi-step workflow for operational tasks like patching, AMI updates, or remediation. Steps can call AWS APIs, run scripts, or wait for approvals. ``` # Run an SSM Automation runbook from the CLI aws ssm start-automation-execution \ --document-name "AWS-RestartEC2Instance" \ --parameters "InstanceId=i-0abc1234" ``` ### 8. What is a CloudWatch composite alarm and why use one? A composite alarm combines multiple existing alarms using AND/OR/NOT logic and triggers on the combined state. It reduces alarm noise by alerting only on real incidents rather than every contributing signal. ### 9. How do you collect application logs from EC2 instances? Install the unified CloudWatch agent on the instance, give the instance an IAM role with logs permissions, and configure the agent file with the log paths, log group, and log stream to ship to. ``` # /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json { "logs": { "logs_collected": { "files": { "collect_list": [ { "file_path": "/var/log/app/*.log", "log_group_name": "/my-app/prod", "log_stream_name": "{instance_id}" } ] } } } } ``` ### 10. What is CloudWatch anomaly detection? Anomaly detection trains an ML model on a metric's past behavior to build an expected range. You can alarm when values fall outside that band, which is much smarter than a static threshold for seasonal or trending metrics. ### 11. What is the difference between RDS Multi-AZ and Read Replicas? Multi-AZ is a synchronous standby in another AZ used for high availability and automatic failover (you don't read from it). Read Replicas are asynchronous copies used to scale read traffic, and they can be promoted manually. ### 12. What are Auto Scaling lifecycle hooks? Lifecycle hooks pause an instance in Pending:Wait or Terminating:Wait so you can perform custom actions (warm caches, drain connections, persist logs) before it joins the group or is terminated. ### 13. Define RTO and RPO. RTO (Recovery Time Objective) is the maximum acceptable downtime after an incident. RPO (Recovery Point Objective) is the maximum acceptable amount of recent data loss, measured in time. ### 14. What are the four AWS disaster recovery strategies, from cheapest to most expensive? 1) Backup and Restore (RTO hours), 2) Pilot Light (minimal services always running), 3) Warm Standby (scaled-down full copy), 4) Multi-Site Active-Active (full capacity in all regions, lowest RTO/RPO). ### 15. How do you scale an Auto Scaling Group based on a custom metric? Create a Target Tracking or Step Scaling policy that references the custom CloudWatch metric. Target Tracking adjusts capacity to keep the metric at a target value; Step Scaling reacts to alarm thresholds with defined capacity changes. ``` # Target tracking policy on a custom CloudWatch metric aws autoscaling put-scaling-policy \ --auto-scaling-group-name my-asg \ --policy-name keep-cpu-50 \ --policy-type TargetTrackingScaling \ --target-tracking-configuration file://config.json ``` ### 16. What is an AWS Backup plan? A backup plan groups a schedule, lifecycle (transition to cold, expiration), and backup vault assignment. Resource assignments (by tag or ARN) attach the plan to resources across supported services (EBS, RDS, DynamoDB, EFS, FSx, etc.). ### 17. What does S3 Cross-Region Replication do? CRR asynchronously copies new objects from a source bucket to a destination bucket in a different region. It requires versioning on both buckets and an IAM role that S3 can assume. It does not replicate pre-existing objects by default. ### 18. How does an ALB health check work? The ALB periodically sends an HTTP/HTTPS request to a configured path on each target. After HealthyThresholdCount consecutive successes a target is marked healthy; after UnhealthyThresholdCount failures it is taken out of rotation. ### 19. What is CloudFormation drift detection? Drift detection compares the live configuration of stack resources to the configuration defined in the template. It surfaces any out-of-band changes made directly in the console or API so you can reconcile them. ``` aws cloudformation detect-stack-drift --stack-name my-stack aws cloudformation describe-stack-resource-drifts --stack-name my-stack ``` ### 20. What is a CloudFormation change set? A change set is a preview of how a stack update will affect existing resources before you actually execute it. It shows which resources will be added, modified, or replaced, giving you a chance to review before applying. ### 21. Nested stacks vs cross-stack references, when do you use each? Use nested stacks when one parent stack owns the lifecycle of its children (reusable components within one logical stack). Use cross-stack references (Export / Fn::ImportValue) when independent stacks need to share values like VPC IDs or shared role ARNs. ### 22. What is the AWS CDK? The Cloud Development Kit lets you define infrastructure in real programming languages (TypeScript, Python, Java, Go, .NET). It synthesizes a CloudFormation template, which CDK then deploys, giving you loops, conditionals, and reusable constructs. ``` // TypeScript CDK: an S3 bucket with versioning enabled import { Stack, StackProps } from 'aws-cdk-lib'; import { Bucket } from 'aws-cdk-lib/aws-s3'; export class MyStack extends Stack { constructor(scope: any, id: string, props?: StackProps) { super(scope, id, props); new Bucket(this, 'Data', { versioned: true }); } } ``` ### 23. SSM Parameter Store vs Secrets Manager, which should you pick? Parameter Store is free for standard parameters and great for plain config plus simple secrets you rotate yourself. Secrets Manager costs per secret per month but provides managed automatic rotation, cross-region replication, and built-in integrations for RDS / Redshift / DocumentDB credentials. ``` # Store and retrieve a secret string parameter aws ssm put-parameter --name "/app/db/url" \ --value "postgres://..." --type SecureString aws ssm get-parameter --name "/app/db/url" --with-decryption ``` ### 24. What is EC2 Image Builder? A managed service that builds, tests, and distributes hardened AMIs and container images on a schedule. You define recipes (base image + components), an infrastructure configuration, distribution targets, and a pipeline. ### 25. What are CloudFormation StackSets? StackSets let you deploy a single CloudFormation template across multiple AWS accounts and regions from a central account. Perfect for rolling out baselines like Config rules, IAM roles, or guardrails across an Organization. ### 26. What does SSM Patch Manager do? It automates OS and application patching on managed instances using patch baselines (which patches to approve) and maintenance windows (when to apply them). It supports both Windows and many Linux distributions. ### 27. How does CloudFormation rollback behave on failure? By default, if any resource fails to create or update, CloudFormation rolls the entire stack back to the previous stable state. You can disable rollback (DisableRollback or OnFailure=DO_NOTHING) when you want the failed resources to stay around for debugging. ### 28. What is the core difference between an IAM Role and an IAM User? An IAM User is a long-lived identity with static credentials (access keys, password). An IAM Role is assumed by an entity (EC2, Lambda, a user from another account) and delivers temporary, rotated credentials via STS. Prefer roles over users wherever possible. ### 29. What are Service Control Policies (SCPs)? Organization-wide guardrails that define the maximum permissions any account or OU can use. SCPs don't grant access on their own; they restrict what IAM identities in the affected accounts are allowed to do, no matter what their own policies say. ``` // Deny launching EC2 outside specific regions { "Version": "2012-10-17", "Statement": [{ "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "StringNotEquals": { "aws:RequestedRegion": ["us-east-1", "eu-west-1"] } } }] } ``` ### 30. Customer-managed KMS keys vs AWS-managed keys? AWS-managed keys (aws/service-name) are created automatically per service in your account, with limited control. Customer-managed keys give you full control over the key policy, grants, manual or automatic yearly rotation, cross-account sharing, and deletion scheduling. ### 31. How does Secrets Manager rotation work for RDS? Secrets Manager runs a Lambda rotation function on a schedule (e.g. every 30 days). The function creates a new password, updates the database user with the new credential, then atomically promotes the new version of the secret so applications pick it up on their next fetch. ### 32. What does GuardDuty detect and what data sources does it use? GuardDuty is a managed threat-detection service. It continuously analyzes VPC Flow Logs, CloudTrail management and S3 data events, DNS query logs, EKS audit logs, and runtime telemetry, then flags suspicious behavior using ML and threat intelligence feeds. ### 33. What is AWS Security Hub? A central dashboard that aggregates security findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and partner tools. It also runs automated checks against standards like CIS AWS Foundations, PCI DSS, and AWS Foundational Security Best Practices. ### 34. What is an IAM permissions boundary? A managed policy attached to an IAM user or role that sets the maximum permissions that identity can ever have. Even if its identity-based policy grants more, the effective permission is the intersection of the policy and the boundary. ### 35. What is an Organizational Unit (OU) in AWS Organizations? A container for grouping AWS accounts inside an Organization. OUs can be nested up to five levels deep. SCPs attach to OUs (or directly to accounts or the root), and apply to every account beneath them. ### 36. What is in the default route table of a brand-new VPC? One local route covering the VPC's CIDR block (e.g. 10.0.0.0/16 → local). There is no route to the internet until you attach an Internet Gateway and add a 0.0.0.0/0 route, or set up a NAT for private subnets. ### 37. Internet Gateway vs NAT Gateway? An Internet Gateway is a horizontally scaled VPC component that enables bidirectional internet traffic for resources in public subnets. A NAT Gateway lets instances in private subnets initiate outbound internet traffic but blocks unsolicited inbound connections from the internet. ### 38. What are the two types of VPC endpoints? Interface endpoints use an ENI in your subnet with a private IP, powered by AWS PrivateLink, they work with most AWS services. Gateway endpoints add an entry to your route table for S3 and DynamoDB, with no ENI required and no extra cost. ### 39. Name the Route 53 routing policies and what each does. Simple (one record), Weighted (split traffic by weight), Latency (lowest-latency region), Failover (primary/secondary with health checks), Geolocation (by user country), Geoproximity (by lat/long with bias), and Multivalue Answer (up to 8 healthy records returned). ### 40. How do you serve a static site over HTTPS with CloudFront? Store assets in S3, create a CloudFront distribution with the S3 bucket as origin (use Origin Access Control to keep the bucket private), attach an ACM TLS certificate (must be in us-east-1) for your custom domain, and add a Route 53 alias to the distribution. ``` # High-level CLI sketch aws s3api put-bucket-policy --bucket my-site --policy file://oac-policy.json aws cloudfront create-distribution --distribution-config file://dist.json aws route53 change-resource-record-sets \ --hosted-zone-id Z123 --change-batch file://alias.json ``` ### 41. Transit Gateway vs VPC Peering? VPC Peering is point-to-point between two VPCs and is non-transitive (A↔B and B↔C does not give A↔C). Transit Gateway is a hub-and-spoke router that supports transitive routing across many VPCs, on-prem VPNs, and Direct Connect, and scales to thousands of attachments. ### 42. What does AWS PrivateLink do? PrivateLink exposes a service privately to consumers in other VPCs or accounts via interface endpoints, without traversing the public internet, an Internet Gateway, or a NAT. A common use case is SaaS providers exposing their service to customer VPCs. ### 43. Direct Connect vs Site-to-Site VPN? Direct Connect is a dedicated private fiber link from your data center to AWS via a DX location, consistent latency and high bandwidth, but slower to provision and more expensive. Site-to-Site VPN runs IPsec over the public internet, quick to set up, encrypted, but subject to internet variability. ### 44. What are VPC Flow Logs and where do they go? VPC Flow Logs capture metadata about IP traffic going to and from network interfaces (source/dest IP and port, protocol, accept/reject, bytes). You can publish them to CloudWatch Logs, S3, or Kinesis Data Firehose for analysis. ``` aws ec2 create-flow-logs \ --resource-type VPC \ --resource-ids vpc-0abc1234 \ --traffic-type ALL \ --log-destination-type cloud-watch-logs \ --log-group-name /vpc/flowlogs \ --deliver-logs-permission-arn arn:aws:iam::111122223333:role/flowlogs-role ``` ### 45. Reserved Instances vs Savings Plans, which gives you more flexibility? Compute Savings Plans give the most flexibility, since they apply automatically across instance family, size, region, OS, tenancy, and even Fargate and Lambda. EC2 Instance Savings Plans and Reserved Instances are cheaper but lock you to a specific family in a specific region. ### 46. What does AWS Compute Optimizer do? It uses machine learning on CloudWatch utilization data to recommend right-sized resources for EC2 instances, Auto Scaling groups, EBS volumes, Lambda functions, and ECS services on Fargate, including projected cost and performance impact. ### 47. What is Cost Explorer and what can it do? Cost Explorer is a visual tool for analyzing AWS spend over time. It supports filters and groupings by service, account, tag, region, etc., provides up to 12 months of forecast, and lets you create custom Cost & Usage reports. ``` # Programmatic access via the Cost Explorer API aws ce get-cost-and-usage \ --time-period Start=2026-05-01,End=2026-05-28 \ --granularity DAILY \ --metrics "UnblendedCost" \ --group-by Type=DIMENSION,Key=SERVICE ``` ### 48. Name the five Trusted Advisor categories. Cost Optimization, Performance, Security, Fault Tolerance, and Service Limits. Business and Enterprise Support unlock the full set of checks across all categories. ### 49. EC2 purchasing options ranked from cheapest to most expensive? Spot (up to ~90% off, can be interrupted with a 2-minute warning) → Savings Plans / Reserved Instances (1 or 3 year commitment) → On-Demand (pay per second, no commitment) → Dedicated Hosts (whole physical host, mostly for licensing). ### 50. Name the S3 storage classes and when to use each. Standard (frequent access), Intelligent-Tiering (unknown patterns, auto-tiers), Standard-IA (infrequent, multi-AZ), One Zone-IA (infrequent, single AZ, cheaper), Glacier Instant Retrieval (archive, millisecond access), Glacier Flexible Retrieval (minutes-to-hours retrieval), and Glacier Deep Archive (cheapest, 12+ hour retrieval).