Jeff’s Note #
Unlike generic exam dumps, ADH analyzes this scenario through the lens of a Real-World Site Reliability Engineer.
For SOA-C02 candidates, the confusion often lies in which AWS tool best reports resource usage against limits. In production, this is about knowing exactly how to monitor current IAM policy usage relative to service quotas to avoid unexpected outages or governance violations. Let’s drill down.
The Certification Drill (Simulated Question) #
Scenario #
Zenith Innovations runs a highly regulated SaaS platform on AWS. The security team recently raised concerns: the number of AWS Identity and Access Management (IAM) policies in use is increasing rapidly across their AWS accounts. The site reliability engineering team needs to provide leadership with a clear report detailing how many IAM policies are currently being used versus the maximum policies allowed by AWS service quotas.
The Requirement: #
Identify the AWS service that the SRE team should use to check the current number of IAM policies in use compared against the account’s maximum allowed policies.
The Options #
- A) AWS Trusted Advisor
- B) Amazon Inspector
- C) AWS Config
- D) AWS Organizations
Google adsense #
leave a comment:
Correct Answer #
A) AWS Trusted Advisor
Quick Insight: The SOA-C02 Imperative #
The key to this scenario is leveraging a service that reports real-time usage against service limits. Trusted Advisor specializes in resource checks for limits and security but does not perform configuration evaluations like Config or vulnerability scans like Inspector.
Content Locked: The Expert Analysis #
You’ve identified the answer. But do you know the implementation details that separate a Junior from a Senior?
The Expert’s Analysis #
Correct Answer #
Option A) AWS Trusted Advisor
The Winning Logic #
AWS Trusted Advisor provides built-in checks including Service Limits checks that track your usage of IAM policies and compare this usage against preset account limits. It can report how many managed policies exist currently and alert if usage approaches limits, empowering SREs to proactively manage resource constraints.
- AWS Config monitors configuration changes to resources and compliance, but it doesn’t track service quota usage.
- Amazon Inspector focuses on vulnerability assessments and security findings, not resource limits.
- AWS Organizations manages multiple accounts but does not provide usage vs. quota reporting for individual services.
The Trap (Distractor Analysis): #
-
Why not B) Amazon Inspector?
It’s a security assessment tool; it doesn’t track resource limits or policy counts. -
Why not C) AWS Config?
Config tracks resource state changes and compliance rules but lacks quota reporting functionality. -
Why not D) AWS Organizations?
While useful for multi-account governance, Organizations does not provide insight into IAM policy count or service limits.
The Technical Blueprint #
# Example CLI check to retrieve Trusted Advisor limits checks
aws support describe-trusted-advisor-checks --language en
# To get service limits, you also can use:
aws support describe-trusted-advisor-check-result --check-id <CheckId>
The Comparative Analysis #
| Option | Operational Overhead | Automation Level | Impact on Monitoring IAM Limits |
|---|---|---|---|
| AWS Trusted Advisor | Low – built-in console and API support | Moderate – requires polling / integration | Direct reports of service limits and usage |
| Amazon Inspector | Medium – config required | Low – on-demand scans | No relevance to IAM policy count |
| AWS Config | High – custom rules needed | High – continuous monitoring | Tracks configuration, no service limit info |
| AWS Organizations | Low – account governance | Low | No tracking of resource quotas |
Real-World Application (Practitioner Insight) #
Exam Rule #
“For the exam, always pick AWS Trusted Advisor when you see the keyword ‘service limits’ or ‘resource usage against quotas.’”
Real World #
“In reality, service quotas can also be monitored using AWS Service Quotas service, which provides a more granular and customizable view. But Trusted Advisor is the faster built-in tool for essential limit checks and is commonly tested in the SOA-C02 exam context.”
(CTA) Stop Guessing, Start Mastering #
Disclaimer
This is a study note based on simulated scenarios for the SOA-C02 exam.