AWS Certified SysOps Administrator – Associate Practice Test
Frequently asked questions
How many AWS Certified SysOps Administrator – Associate practice questions are here?+
A full bank of original AWS Certified SysOps Administrator – Associate practice questions across the official content areas, weighted like the real exam, with explanations. Free, no signup.
What is the AWS Certified SysOps Administrator – Associate exam like?+
A multiple-choice exam, 130 minutes, and you need 720 / 1000% to pass. Practice by topic here, then take the full timed mock exam to gauge readiness.
Are these the real exam questions?+
No. Every question is 100% original, written from public primary sources with explanations. We never copy real exam questions or paid prep material.
Can I study in Chinese or Spanish?+
PrepPass practice is in English, 中文 and Español. The official exam is in English — switch the question language to English any time to rehearse the exact terminology you'll see on test day.
Sample practice questions
A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.
- 1. Monitoring, Logging, and Remediation
An administrator needs per-minute CPU metrics from EC2 instances instead of the default interval. What should they enable?
- a.The CloudWatch agent for CPU
- b.A custom metric filter
- c.Detailed monitoring on the instances
- d.AWS CloudTrail data events
Answer: c
Explanation: Enabling detailed monitoring reports EC2 metrics every one minute instead of the default five-minute basic monitoring. The CloudWatch agent is needed for memory and disk metrics, not CPU frequency, metric filters extract metrics from logs, and CloudTrail records API activity.
- 2. Monitoring, Logging, and Remediation
Which service should an administrator use to determine which IAM principal deleted a security group last week?
- a.Amazon CloudWatch metrics
- b.AWS Config only
- c.VPC Flow Logs
- d.AWS CloudTrail
Answer: d
Explanation: CloudTrail records management API calls including who made them and when, so it identifies the principal that deleted the security group. CloudWatch tracks operational metrics, Config tracks configuration state changes over time, and VPC Flow Logs capture network traffic, not API identity.
- 3. Monitoring, Logging, and Remediation
How can an administrator turn a recurring error string in application logs into something they can alarm on?
- a.Export logs to S3 nightly
- b.Enable detailed monitoring
- c.Create a CloudWatch Logs metric filter that counts the pattern, then alarm on the metric
- d.Increase log retention
Answer: c
Explanation: A metric filter scans a log group for a pattern and publishes a numeric CloudWatch metric that an alarm can watch. Exporting to S3 or extending retention stores logs but does not create alarms, and detailed monitoring only affects metric frequency.
- 4. Reliability and Business Continuity
To protect a production database against an Availability Zone failure with automatic failover, which RDS option should be used?
- a.Multi-AZ deployment with a synchronous standby
- b.A single-AZ instance with frequent snapshots
- c.A read replica in the same AZ
- d.Larger instance class
Answer: a
Explanation: RDS Multi-AZ maintains a synchronous standby in another Availability Zone and fails over automatically if the primary fails. Snapshots aid recovery but do not provide automatic failover, a same-AZ read replica does not survive that AZ's failure, and a larger instance does not add availability.
- 5. Reliability and Business Continuity
A business states it can tolerate at most 15 minutes of data loss during a disaster. Which metric does this define?
- a.RTO (recovery time objective)
- b.SLA
- c.RPO measured in dollars
- d.RPO (recovery point objective)
Answer: c
Explanation: The recovery point objective is the maximum acceptable amount of data loss measured in time, so 15 minutes is an RPO. RTO defines acceptable downtime, an SLA is a service commitment, and RPO is measured in time, not dollars.
- 6. Deployment, Provisioning, and Automation
To apply operating-system security patches to a fleet of EC2 instances on a defined schedule, which Systems Manager capability is appropriate?
- a.Session Manager
- b.Parameter Store
- c.Patch Manager
- d.Cost Explorer
Answer: c
Explanation: Patch Manager scans and applies OS and application patches to managed instances on a maintenance-window schedule. Session Manager provides shell access, Parameter Store holds configuration, and Cost Explorer analyzes spend.
- 7. Deployment, Provisioning, and Automation
What is the recommended way to store a database password used by Systems Manager automation and CloudFormation without hard-coding it?
- a.A plaintext String parameter
- b.A SecureString parameter in Parameter Store encrypted with KMS
- c.An environment variable in the template
- d.A public S3 object
Answer: b
Explanation: A SecureString parameter encrypts the value with KMS and can be referenced by automation and CloudFormation, keeping secrets out of templates. A plaintext parameter or template variable exposes the value, and a public S3 object leaks it.
- 8. Security and Compliance
Which tool helps identify S3 buckets or IAM roles that are shared with external accounts so an administrator can tighten access?
- a.Amazon Inspector
- b.AWS Shield
- c.IAM Access Analyzer
- d.Amazon Athena
Answer: c
Explanation: IAM Access Analyzer evaluates resource policies and reports where resources grant access to external principals, helping enforce least privilege. Inspector scans for software vulnerabilities, Shield protects against DDoS, and Athena queries data in S3.
- 9. Networking, Content Delivery, and Cost
Instances in a private subnet must download OS updates from the internet but must not be reachable from it. What should the administrator add?
- a.An internet gateway route from the private subnet
- b.A public IP on each instance
- c.A VPC peering connection
- d.A NAT gateway with the private subnet routing to it
Answer: d
Explanation: A NAT gateway lets private-subnet instances make outbound internet connections while remaining unreachable inbound. Routing the private subnet to an internet gateway or assigning public IPs would make instances reachable, and VPC peering connects VPCs rather than providing internet egress.
- 10. Networking, Content Delivery, and Cost
A global application needs to route users to the AWS Region with the lowest latency. Which Route 53 routing policy should be used?
- a.Weighted routing
- b.Failover routing
- c.Latency-based routing
- d.Simple routing
Answer: c
Explanation: Latency-based routing sends users to the Region that provides the lowest network latency for them. Weighted routing splits traffic by proportion, failover routing is for active/passive DR, and simple routing returns a single record without latency awareness.