Based on the SOA-C02 exam guideReport an error

SOA-C02· AssociateWeek 12 · Day 4~60 min read

Day 4 - The Full 50-Question Mock Exam, and What Your Wrong Answers Tell You

The value of a mock exam is not the score but the pattern in your wrong answers. The ways people miss questions on SOA-C02 are consistent: confusing two similar services (CloudTrail/Config, SG/NACL), overlooking a qualifier ("MOST cost-effective", "LEAST operational overhead"), or failing to tell apart an option that "works" from the option that is "the most suitable." These 50 questions deliberately lay out those traps. Do not just get them right and move on; check which pattern each missed question falls into. The short note at the start of each domain group points to "where wrong answers cluster."

🧩 Exam-Taking Guide

Recommended time: 90 minutes (half the pace of the real 180 minutes). Scoring: correct/50×100, with around 80% as the sense of a passing line
Marking: if you are unsure, mark with a star (★) and review later, which practices the real exam's flag feature. Handling wrong answers: classify each missed question as "confusion / missed qualifier / trap" and record it

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

How do you collect the EC2 memory utilization metric?

Question 2

Which feature combines multiple alarms to prevent an alarm storm?

Question 3

Which service tracks the history of API calls?

Question 4

How do you view the change history of a security group in chronological order?

Question 5

Which query in Logs Insights aggregates a specific error log in 5-minute buckets?

Question 6

How can a Config Rule automatically fix a non-compliant resource?

Question 7

How do you set an alarm on a metric where a static threshold is hard to define (strong day-of-week and time-of-day patterns)?

Question 8

How do you view CloudWatch metrics and logs from multiple accounts on a single dashboard?

Question 9

How do you turn the number of occurrences of the word "ERROR" in a Log Group into a metric and set an alarm on it?

Question 10

What is the purpose of CloudTrail Lake?

Question 11

What is the main purpose of RDS Multi-AZ?

Question 12

How do you scale RDS read performance?

Question 13

What is the global Aurora deployment for protection against a Region failure?

Question 14

What is the lightest way to implement daily automatic EBS snapshots with a retention policy?

Question 15

Which DR strategy has an RTO in the minutes range with moderate cost?

Question 16

How do you automatically replicate S3 objects to another Region?

Question 17

In Route 53, which gives an Active/Passive setup (Primary normally, Secondary on failure)?

Question 18

What is the purpose of AWS Backup Vault Lock?

Question 19

How do you review changes before applying them in CloudFormation?

Question 20

How do you deploy the same IaC to multiple accounts/Regions in bulk?

Question 21

Which deployment offers zero downtime and instant rollback if there is a problem?

Question 22

How do you automatically apply OS patches to 100 EC2 instances on a monthly schedule with SSM?

Question 23

How do you connect to EC2 securely without SSH keys or port 22?

Question 24

How do you automatically rotate a DB master password periodically with no downtime?

Question 25

How do you detect differences between a CloudFormation template and the actual resources?

Question 26

How do you let users safely self-service deploy approved IaC?

Question 27

How do you immediately run a one-time command on 100 EC2 instances?

Question 28

How do you apply a permission guardrail to all accounts at the organization (Organizations) level?

Question 29

How do you individually set a ceiling on the maximum permissions an IAM role or user can have?

Question 30

How do you automatically detect PII (sensitive information) stored in S3?

Question 31

How do you scan EC2, ECR images, and Lambda for known vulnerabilities (CVEs)?

Question 32

How do you detect in-progress threats by analyzing VPC Flow Logs, DNS, and CloudTrail?

Question 33

How do you collect findings from multiple security services in one place and score them against standards (CIS, PCI)?

Question 34

How do you automatically detect IAM and resource access that is unintentionally exposed externally (other accounts or the public)?

Question 35

How do you automate evidence collection and report generation for PCI-DSS, SOC, and HIPAA compliance?

Question 36

What is a characteristic of a Security Group?

Question 37

Which option gives free private connectivity to S3 and DynamoDB only?

Question 38

How do you statically analyze the network path between two resources without actual traffic?

Question 39

How do you accelerate UDP game traffic globally?

Question 40

What is the current standard for blocking direct S3 access in CloudFront?

Question 41

How do you connect many VPCs in a hub-and-spoke topology?

Question 42

How do you route users to the nearest (lowest-latency) Region?

Question 43

What is a limitation of VPC Flow Logs?

Question 44

What is commonly used as a backup connection for Direct Connect?

Question 45

Which is the most flexible commitment, applying to all of EC2, Fargate, and Lambda?

Question 46

How do you shut down gracefully in response to the 2-minute Spot interruption notice?

Question 47

How do you get ML-based right-sizing recommendations for EC2, EBS, and Lambda?

Question 48

How do you automatically detect abnormal spikes in cost with ML?

Question 49

How do you guarantee capacity for a new instance type in a specific AZ (no discount needed)?

Question 50

How do you automatically stop EC2 or attach a restrictive SCP when a monthly budget threshold is reached?

📊 Scoring and Weakness Analysis

💡 Related theory: Per-domain accuracy must be read together with the weighting: 5 questions in 20% Domain 1 and 5 questions in 12% Domain 6 carry different score weight. Prioritize weaknesses by "number missed × weighting."

Per-Domain Accuracy Record

Domain	Questions	Correct	Accuracy	Weight
Domain 1 (Monitoring, Logging)	10	__/10	__ %	20%
Domain 2 (Reliability, BCP)	8	__/8	__ %	16%
Domain 3 (Deployment, Automation)	9	__/9	__ %	18%
Domain 4 (Security, Compliance)	8	__/8	__ %	16%
Domain 5 (Networking)	9	__/9	__ %	18%
Domain 6 (Cost, Performance)	6	__/6	__ %	12%
Total	50	__/50	__ %	100%

Diagnosis by Score Band

Accuracy	Diagnosis	Prescription
≥ 90%	Solid pass range	Time management + review only the trap questions
80-89%	Passing line	Re-read the day.md files of your weak domains
70-79%	At risk	Focus on 2 weak domains + extra questions
< 70%	Insufficient	Quickly re-read the key points of weeks 1 to 12

Self-Diagnosis by Type of Wrong Answer

Classify missed questions into the three types below and the nature of your weakness becomes visible:

Wrong-answer type	Symptom	Prescription
Service confusion	Swapping two similar ones (CloudTrail/Config, etc.)	Organize the confusing pairs in a table and memorize the "reason" for the difference
Missed qualifier	Ignoring a condition like "MOST cost-effective"	The habit of reading the question to the end and underlining qualifiers
Trap option	Choosing an option that "works but is not the best"	Re-evaluate every option not as "is it possible" but as "is it the most suitable"

Prescriptions by Weak Domain

Weak in Domain 1 → Re-read Weeks 2, 3, 4 + this week's Day 1, and the data-model differences among CloudWatch/CloudTrail/Config
Weak in Domain 2 → Week 10 + Day 1, RDS Multi-AZ (synchronous) / Read Replica (asynchronous) / Aurora Global + the RTO/RPO coordinates of the 4 DR strategies
Weak in Domain 3 → Weeks 5, 6, 7 + Day 2, declarative IaC + deployment policy trade-offs + the 7 major SSM components
Weak in Domain 4 → Weeks 1 and 9 + Day 2, the IAM decision tree (explicit Deny wins) + "what does it look at" for security services
Weak in Domain 5 → Week 8 + Day 3, packet inspection order + stateful/stateless + Endpoint types
Weak in Domain 6 → Week 11 + Day 3, commitment flexibility versus discount + the role split among cost tools

📌 Today's Summary

Read a mock exam not by the score but by the pattern of wrong answers, classified into three types: service confusion / missed qualifier / trap option
Prioritize weaknesses by "number missed × domain weighting"; Domain 1 at 20% and Domain 6 at 12% carry different weight
The most frequent confusion pairs: CloudTrail (actions) / Config (state), SG (stateful) / NACL (stateless), Multi-AZ (synchronous) / Read Replica (asynchronous), SP (flexible) / RI (discount)
Scenario qualifiers ("MOST cost-effective", "LEAST operational overhead", "automatically") are clues to the answer, so read the question to the end
Tomorrow (Day 5), adjust your condition with the D-Day checklist + a short 20-question mock exam

Official references

Day 4 - The Full 50-Question Mock Exam, and What Your Wrong Answers Tell You

🧩 Exam-Taking Guide

Recommended time: 90 minutes (half the pace of the real 180 minutes). Scoring: correct/50×100, with around 80% as the sense of a passing line

Marking: if you are unsure, mark with a star (★) and review later, which practices the real exam's flag feature. Handling wrong answers: classify each missed question as "confusion / missed qualifier / trap" and record it

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

How do you collect the EC2 memory utilization metric?

Question 2

Which feature combines multiple alarms to prevent an alarm storm?

Question 3

Which service tracks the history of API calls?

Question 4

How do you view the change history of a security group in chronological order?

Question 5

Which query in Logs Insights aggregates a specific error log in 5-minute buckets?

Question 6

How can a Config Rule automatically fix a non-compliant resource?

Question 7

How do you set an alarm on a metric where a static threshold is hard to define (strong day-of-week and time-of-day patterns)?

Question 8

How do you view CloudWatch metrics and logs from multiple accounts on a single dashboard?

Question 9

How do you turn the number of occurrences of the word "ERROR" in a Log Group into a metric and set an alarm on it?

Question 10

What is the purpose of CloudTrail Lake?

Question 11

What is the main purpose of RDS Multi-AZ?

Question 12

How do you scale RDS read performance?

Question 13

What is the global Aurora deployment for protection against a Region failure?

Question 14

What is the lightest way to implement daily automatic EBS snapshots with a retention policy?

Question 15

Which DR strategy has an RTO in the minutes range with moderate cost?

Question 16

How do you automatically replicate S3 objects to another Region?

Question 17

In Route 53, which gives an Active/Passive setup (Primary normally, Secondary on failure)?

Question 18

What is the purpose of AWS Backup Vault Lock?

Question 19

How do you review changes before applying them in CloudFormation?

Question 20

How do you deploy the same IaC to multiple accounts/Regions in bulk?

Question 21

Which deployment offers zero downtime and instant rollback if there is a problem?

Question 22

How do you automatically apply OS patches to 100 EC2 instances on a monthly schedule with SSM?

Question 23

How do you connect to EC2 securely without SSH keys or port 22?

Question 24

How do you automatically rotate a DB master password periodically with no downtime?

Question 25

How do you detect differences between a CloudFormation template and the actual resources?

Question 26

How do you let users safely self-service deploy approved IaC?

Question 27

How do you immediately run a one-time command on 100 EC2 instances?

Question 28

How do you apply a permission guardrail to all accounts at the organization (Organizations) level?

Question 29

How do you individually set a ceiling on the maximum permissions an IAM role or user can have?

Question 30

How do you automatically detect PII (sensitive information) stored in S3?

Question 31

How do you scan EC2, ECR images, and Lambda for known vulnerabilities (CVEs)?

Question 32

How do you detect in-progress threats by analyzing VPC Flow Logs, DNS, and CloudTrail?

Question 33

How do you collect findings from multiple security services in one place and score them against standards (CIS, PCI)?

Question 34

How do you automatically detect IAM and resource access that is unintentionally exposed externally (other accounts or the public)?

Question 35

How do you automate evidence collection and report generation for PCI-DSS, SOC, and HIPAA compliance?

Question 36

What is a characteristic of a Security Group?

Question 37

Which option gives free private connectivity to S3 and DynamoDB only?

Question 38

How do you statically analyze the network path between two resources without actual traffic?

Question 39

How do you accelerate UDP game traffic globally?

Question 40

What is the current standard for blocking direct S3 access in CloudFront?

Question 41

How do you connect many VPCs in a hub-and-spoke topology?

Question 42

How do you route users to the nearest (lowest-latency) Region?

Question 43

What is a limitation of VPC Flow Logs?

Question 44

What is commonly used as a backup connection for Direct Connect?

Question 45

Which is the most flexible commitment, applying to all of EC2, Fargate, and Lambda?

Question 46

How do you shut down gracefully in response to the 2-minute Spot interruption notice?

Question 47

How do you get ML-based right-sizing recommendations for EC2, EBS, and Lambda?

Question 48

How do you automatically detect abnormal spikes in cost with ML?

Question 49

How do you guarantee capacity for a new instance type in a specific AZ (no discount needed)?

Question 50

How do you automatically stop EC2 or attach a restrictive SCP when a monthly budget threshold is reached?

📊 Scoring and Weakness Analysis

💡 Related theory: Per-domain accuracy must be read together with the weighting: 5 questions in 20% Domain 1 and 5 questions in 12% Domain 6 carry different score weight. Prioritize weaknesses by "number missed × weighting."

Domain	Questions	Correct	Accuracy	Weight
Domain 1 (Monitoring, Logging)	10	__/10	__ %	20%
Domain 2 (Reliability, BCP)	8	__/8	__ %	16%
Domain 3 (Deployment, Automation)	9	__/9	__ %	18%
Domain 4 (Security, Compliance)	8	__/8	__ %	16%
Domain 5 (Networking)	9	__/9	__ %	18%
Domain 6 (Cost, Performance)	6	__/6	__ %	12%
Total	50	__/50	__ %	100%

Accuracy	Diagnosis	Prescription
≥ 90%	Solid pass range	Time management + review only the trap questions
80-89%	Passing line	Re-read the day.md files of your weak domains
70-79%	At risk	Focus on 2 weak domains + extra questions
< 70%	Insufficient	Quickly re-read the key points of weeks 1 to 12

Classify missed questions into the three types below and the nature of your weakness becomes visible:

Wrong-answer type	Symptom	Prescription
Service confusion	Swapping two similar ones (CloudTrail/Config, etc.)	Organize the confusing pairs in a table and memorize the "reason" for the difference
Missed qualifier	Ignoring a condition like "MOST cost-effective"	The habit of reading the question to the end and underlining qualifiers
Trap option	Choosing an option that "works but is not the best"	Re-evaluate every option not as "is it possible" but as "is it the most suitable"

Weak in Domain 1 → Re-read Weeks 2, 3, 4 + this week's Day 1, and the data-model differences among CloudWatch/CloudTrail/Config

Weak in Domain 2 → Week 10 + Day 1, RDS Multi-AZ (synchronous) / Read Replica (asynchronous) / Aurora Global + the RTO/RPO coordinates of the 4 DR strategies

Weak in Domain 3 → Weeks 5, 6, 7 + Day 2, declarative IaC + deployment policy trade-offs + the 7 major SSM components

Weak in Domain 4 → Weeks 1 and 9 + Day 2, the IAM decision tree (explicit Deny wins) + "what does it look at" for security services

Weak in Domain 5 → Week 8 + Day 3, packet inspection order + stateful/stateless + Endpoint types

Weak in Domain 6 → Week 11 + Day 3, commitment flexibility versus discount + the role split among cost tools

📌 Today's Summary

Read a mock exam not by the score but by the pattern of wrong answers, classified into three types: service confusion / missed qualifier / trap option

Prioritize weaknesses by "number missed × domain weighting"; Domain 1 at 20% and Domain 6 at 12% carry different weight

The most frequent confusion pairs: CloudTrail (actions) / Config (state), SG (stateful) / NACL (stateless), Multi-AZ (synchronous) / Read Replica (asynchronous), SP (flexible) / RI (discount)

Scenario qualifiers ("MOST cost-effective", "LEAST operational overhead", "automatically") are clues to the answer, so read the question to the end

Tomorrow (Day 5), adjust your condition with the D-Day checklist + a short 20-question mock exam