Based on the SOA-C02 exam guideReport an error
We have arrived at the end of 12 weeks. The job on the last day is not to cram in new knowledge but to organize what you already have so it is easy to pull out and use. The exam itself is also something to operate: a limited resource called time (180 minutes), a queuing strategy called flagging, and infrastructure called your physical condition. Just as a CloudOps operator handles a system, if you see the exam as a matter of resource allocation and risk management, you stay calm.
This post contains the checklist from D-7 to D-Day, the time allocation and question-solving strategies that actually work in the exam room, and 20 questions for a final condition check. The explanations are written in depth so that you can engrave "why is that the answer" one more time.
💡 Related theory: The reason an AWS exam score is a scaled score rather than "correct answers ÷ total" is exam fairness. Each exam has a different set of questions with slightly different difficulty, and a candidate who got a harder set must not be disadvantaged. So the difficulty of each question is statistically calibrated (the item response theory, IRT, family) and converted to the same standard of 720. As a result, you can pass "even if you get all the easy questions right and miss a few hard ones," and because unscored questions (new questions being validated that do not count toward the score) are mixed in, you must treat every question with equal seriousness, since you cannot tell which ones are unscored.
In operations, changes are made gradually, and the riskier the change, the earlier it is made. Exam prep is the same: finish acquiring new knowledge (risky, high-load) early, and leave only stabilization (review, rest) for the final stretch.
⚠️ Pitfall: Studying a new topic on D-1 is almost always counterproductive. A concept you first saw the day before comes back half-formed in the exam room and shakes answers you actually knew well (interference effect). For the last 24 hours, the standard is "block new input + reinforce the existing + rest." In operations terms, it is like not deploying an unverified change right before an important release: a change freeze.
| Phase | Time | Task |
|---|---|---|
| 1st pass | About 100 min | Go through all 65 questions once: answer the ones you know immediately, flag and skip the ones where you get stuck |
| Review | About 60 min | Re-examine the flagged questions (now without time pressure) |
| Final check | About 20 min | Confirm zero blank answers + a final check |
The key is not to spend more than 90 seconds on any one question in the 1st pass. Just as one slow request in a distributed system ruins overall throughput, clinging to one hard question costs you the time to solve the easy questions that follow. Flagging is an asynchronous strategy of "put this task in a queue and handle it later": do not block on a stuck task, skip past it, and handle it in the Review phase when you have spare resources (time).
| Qualifier | Direction of the answer |
|---|---|
| "MOST cost-effective" | Gateway Endpoint (free) / Compute SP / S3 Intelligent-Tiering / Spot |
| "LEAST operational overhead" | Managed services (AWS Backup / Secrets Manager / Session Manager / Fargate) |
| "automatically" | Auto Scaling / DLM / Lifecycle / Config Remediation |
| "highly available" | Multi-AZ / Multi-Region / Route 53 Failover |
| "auditable" / "track who" | CloudTrail / Config / Audit Manager |
| "fastest recovery" | Multi-Site / Aurora Global → Warm Standby → Pilot Light, in that order |
| "real-time threat" | GuardDuty |
| "encrypt + rotate" | KMS + Secrets Manager |
That "LEAST operational overhead" almost always points to a managed service is no accident; it reflects the philosophy of AWS exams. AWS wants customers to delegate undifferentiated heavy lifting, such as patching, backups, scaling, and HA setup, to AWS and to focus on business logic. So the exam almost always prefers "use a managed service" over "install and operate it yourself on EC2." Self-managed EC2 < RDS < Aurora Serverless, hand-rolled cron < EventBridge Scheduler, bastion < Session Manager. When you see "minimal operational overhead," the most managed option is likely the answer.
Organizing each wrong answer on one sheet in the template below structures your weaknesses. It is important to classify "why I got it wrong" into three types (confusion/qualifier/trap).
[Wrong-answer note #N]
=====================================
📅 Date written: YYYY-MM-DD
📚 Exam domain: Domain X (XX%)
🎯 Topic area: <e.g., CloudWatch Composite Alarm>
📝 Question summary
<1-2 lines of the core scenario>
❌ My answer: <option>
✅ Correct answer: <option>
🔍 Type of mistake (pick one)
□ Service confusion □ Missed the qualifier □ Trap option
💡 Key takeaway (a pattern to remember in one line)
<e.g., "minimal operational overhead" → managed (Session Manager)>
🔗 Related day.md
- weekN/dayM.md
=====================================
Click a choice to reveal the answer and explanation.
Question 1
To connect to EC2 without SSH keys and audit every session through CloudTrail?
Question 2
What is the current standard for protecting an S3 origin with CloudFront?
Question 3
Which guardrail puts a permission ceiling on all accounts in the organization?
Question 4
What is the most flexible commitment that applies to all of EC2, Fargate, and Lambda?
Question 5
To statically diagnose the path between two resources without actual traffic?
Question 6
Which deployment has zero downtime + instant rollback as its key?
Question 7
To automatically detect PII (sensitive information) stored in S3?
Question 8
To deploy the same IaC in bulk to multiple accounts/Regions?
Question 9
To set an alarm on a metric whose normal values change greatly by day of week and time of day?
Question 10
To receive the 2-minute warning before a Spot reclaim and shut down gracefully?
Question 11
What is the commitment discount model for RDS PostgreSQL?
Question 12
Which RDS configuration prepares for a whole-Region failure?
Question 13
What is a characteristic of a Security Group?
Question 14
Which option gives free private connectivity to only S3 and DynamoDB?
Question 15
To receive ML-based Right Sizing recommendations for EC2, EBS, and Lambda?
Question 16
What is the mechanism by which a Config Rule automatically fixes non-compliant resources?
Question 17
To globally accelerate UDP game traffic and need static IPs?
Question 18
To rotate a DB password automatically with zero downtime?
Question 19
To automatically stop EC2 or attach a restrictive SCP when a monthly budget threshold is reached?
Question 20
To automate PCI, SOC, and HIPAA compliance evidence collection and reporting?