Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 1:

  A company has users that deploy Amazon EC2 instances with more Amazon EBS performance capacity than required. A CloudOps engineer must review all EBS volumes and create cost optimization recommendations based on IOPS and throughput .

  What should the CloudOps engineer do in the MOST operationally efficient way?

  A. Review EC2 console monitoring graphs manually.
  B. Change instance types to EBS-optimized.
  C. Opt in to AWS Compute Optimizer and review EBS volume recommendations.
  D. Run fio benchmarks on each instance.
  C. Opt in to AWS Compute Optimizer and review EBS volume recommendations.

  ---

  Explanation

  AWS Compute Optimizer analyzes historical utilization metrics and provides rightsizing recommendations for EBS volumes, including IOPS and throughput. It is fully managed, continuously updated, and requires minimal operational effort.

  Manual reviews and benchmarking do not scale. Changing instance types does not address EBS overprovisioning.

  Therefore, AWS Compute Optimizer is the best solution.

• Question 2:

  A company needs to ensure that an Application Load Balancer is protected against common web exploits and that rules can be centrally managed across multiple accounts.

  Which solution will meet these requirements?

  A. Deploy AWS WAF on each ALB and manage rules individually per account.
  B. Use AWS Firewall Manager to centrally manage AWS WAF policies across accounts and apply them to ALBs.
  C. Enable AWS Shield Standard and configure SQL injection rules.
  D. Use Security Groups to block SQL injection strings.
  B. Use AWS Firewall Manager to centrally manage AWS WAF policies across accounts and apply them to ALBs.

  ---

  Explanation

  AWS WAF provides application-layer protections, but the requirement includes centralized multi-account management. AWS Firewall Manager is designed to centrally configure and enforce security policies (including AWS WAF rule groups) across multiple accounts in an organization. This ensures consistent protection, reduces configuration drift, and minimizes per-account operational overhead.

• Question 3:

  A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB).

  The company must tolerate the loss of an Availability Zone with minimal downtime and without changing the application's endpoint.

  Which solution will meet these requirements?

  A. Deploy the instances in a single Availability Zone and enable EC2 instance recovery.
  B. Deploy the instances in an Auto Scaling group that spans multiple Availability Zones and register the group with an ALB target group.
  C. Use a spread placement group in one Availability Zone.
  D. Create an AMI and manually launch replacement instances in a different Availability Zone if needed.
  B. Deploy the instances in an Auto Scaling group that spans multiple Availability Zones and register the group with an ALB target group.

  ---

  Explanation

  To tolerate an Availability Zone failure, the workload must run across multiple Availability Zones and have automated capacity replacement. An Auto Scaling group that spans multiple Availability Zones provides automated instance replacement and balancing across AZs. When integrated with an ALB target group, the ALB continues to serve traffic using the same DNS name (endpoint), routing only to healthy targets, and the Auto Scaling group replaces unhealthy or lost capacity automatically. Instance recovery addresses underlying host impairment for a single instance and does not provide AZ- level resilience. Placement groups in one AZ do not provide AZ fault tolerance. Manual processes are slow and do not meet minimal downtime requirements.

  Amazon EC2 Auto Scaling + Elastic Load Balancing - Multi-AZ high availability

• Question 4:

  A company asks a SysOps administrator to provision an additional environment for an application in four additional AWS Regions. The application is running on more than 100 Amazon EC2 instances in the us- east- 1 Region, using fully configured Amazon Machine Images (AMIs). The company has an AWS CloudFormation template to deploy resources in us-east-1.

  What should the SysOps administrator do to provision the application in the MOST operationally efficient manner?

  A. Copy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs.
  B. Create a snapshot of the running instance. Copy the snapshot to the other Regions. Create an AMI from the snapshots. Update the CloudFormation template for each Region to use the new AMI.
  C. Run the existing CloudFormation template in each additional Region based on the success of the template that is used currently in us-east-1.
  D. Update the CloudFormation template to include the additional Regions in the Auto Scaling group. Update the existing stack in us-east-1.
  A. Copy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs.

  ---

  Explanation

  The most operationally efficient approach is A: copy the AMI to each target Region using copy-image and update the CloudFormation template to reference the correct AMI IDs per Region (commonly via Mappings or parameters). AMIs are regional resources, so an AMI built in us-east-1 cannot be launched directly in other Regions without copying. The copy-image operation is the standard, supported method to replicate an AMI across Regions while preserving the image configuration and backing snapshots in the destination Region.

  Once AMIs exist in each Region, CloudFormation can be executed in each Region using the same template logic. Adding mappings for AMI IDs keeps the deployment consistent and repeatable, aligning with Infrastructure as Code practices and minimizing manual steps.

  Option B is more work than necessary because copying snapshots and re-creating AMIs adds extra steps and increases the chance of inconsistency. Option C is incomplete because the template will fail or launch incorrect resources if it references an AMI ID that does not exist in the target Region. Option D is not feasible because an Auto Scaling group is a regional construct and cannot span multiple Regions from a single stack update in us-east-1.

• Question 5:

  A CloudOps engineer must manage the security of an AWS account. Recently, an IAM user's access key was mistakenly uploaded to a public code repository. The engineer must identify everything that was changed using this compromised key.

  How should the CloudOps engineer meet these requirements?

  A. Create an Amazon EventBridge rule to send all IAM events to an AWS Lambda function for analysis.
  B. Query Amazon EC2 logs by using Amazon CloudWatch Logs Insights for all events initiated with the compromised access key within the suspected timeframe.
  C. Search AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe.
  D. Search VPC Flow Logs for all events initiated with the compromised access key within the suspected timeframe.
  C. Search AWS CloudTrail event history for all events initiated with the compromised access key within the suspected timeframe.

  ---

  Explanation

  AWS Cloud Operations and Security documentation AWS CloudTrail is the authoritative service for recording API activity across all AWS services within an account. When an access key is compromised, CloudTrail logs all API requests made using that key, including details such as:

  The user identity (access key ID) that made the request, The service operation, resource, and timestamp affected, and The source IP address and region of the request. By searching the CloudTrail event history for the specific access key ID, the CloudOps engineer can identify every action performed by that key during the suspected breach window.

  Other options are incorrect:

  EventBridge (A) is event-driven, not historical.

  CloudWatch Logs (B) monitors system logs, not AWS API activity. VPC Flow Logs (D) track network-level traffic, not API calls. Therefore, the correct solution is Option C - using AWS CloudTrail event history to audit and trace all actions executed via the compromised access key.

  AWS Cloud Operations & Security Management Guide - Investigating Compromised Access Keys Using AWS CloudTrail

• Question 6:

  A company builds golden AMIs for production. The CloudOps engineer must automate image creation, include hardening steps, and run validation tests before AMIs are used.

  Which solution will meet these requirements?

  A. Use EC2 Image Builder pipelines with components for hardening and testing.
  B. Use Amazon Inspector to build AMIs from findings.
  C. Use CloudTrail to generate a new AMI when API calls occur.
  D. Use AWS Config to create AMIs when a rule becomes noncompliant.
  A. Use EC2 Image Builder pipelines with components for hardening and testing.

  ---

  Explanation

  EC2 Image Builder is designed to automate the full lifecycle of image creation: defining build components, applying hardening configurations, validating with tests, and distributing approved images. This ensures consistency and reduces the risk of drift or unapproved software. It also aligns with operational excellence by turning manual image maintenance into a repeatable pipeline with documented steps and predictable outcomes.

  Inspector evaluates vulnerabilities but does not orchestrate AMI build pipelines. CloudTrail records API activity, not image build workflows. AWS Config can detect noncompliance, but it is not a dedicated image build and test service.

  EC2 Image Builder - Automated AMI build, hardening, and validation pipelines

• Question 7:

  A company runs an application that logs user data to an Amazon CloudWatch Logs log group. The company discovers that personal information the application has logged is visible in plain text in the CloudWatch logs.

  The company needs a solution to redact personal information in the logs by default. Unredacted information must be available only to the company's security team.

  Which solution will meet these requirements?

  A. Create an Amazon S3 bucket. Create an export task from appropriate log groups in CloudWatch. Export the logs to the S3 bucket. Configure an Amazon Macie scan to discover personal data in the S3 bucket. Invoke an AWS Lambda function to move identified personal data to a second S3 bucket. Update the S3 bucket policies to grant only the security team access to both buckets.
  B. Create a customer managed AWS KMS key. Configure the KMS key policy to allow only the security team to perform decrypt operations. Associate the KMS key with the application log group.
  C. Create an Amazon CloudWatch data protection policy for the application log group. Configure data identifiers for the types of personal information that the application logs. Ensure that the security team has permission to call the unmask API operation on the application log group.
  D. Create an OpenSearch domain. Create an AWS Glue workflow that runs a Detect PII transform job and streams the output to the OpenSearch domain. Configure the CloudWatch log group to stream the logs to AWS Glue. Modify the OpenSearch domain access policy to allow only the security team to access the domain.
  C. Create an Amazon CloudWatch data protection policy for the application log group. Configure data identifiers for the types of personal information that the application logs. Ensure that the security team has permission to call the unmask API operation on the application log group.

  ---

  Explanation

  CloudWatch Logs data protection provides native redaction/masking of sensitive data at ingestion and query. AWS documentation states it can "detect and protect sensitive data in logs" using data identifiers, and that authorized users can "use the unmask action to view the original data." Creating a data protection policy on the log group masks PII by default for all viewers, satisfying the requirement to redact personal information. Granting only the security team permission to invoke the unmask API operation ensures that unredacted content is restricted. Option B (KMS) encrypts at rest but does not redact fields; encryption alone does not prevent plaintext visibility to authorized readers. Options A and D add complexity and latency, move data out of CloudWatch, and do not provide default inline redaction/unmask controls in CloudWatch itself. Therefore, the CloudOps-aligned, managed solution is to use CloudWatch Logs data protection with appropriate data identifiers and unmask permissions limited to the

  security team.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Monitoring & Logging Amazon CloudWatch Logs - Data Protection (masking/redaction with data identifiers) CloudWatch Logs - Permissions for masking and unmasking sensitive data AWS Well-Architected Framework - Security and Operational Excellence (sensitive data handling)

• Question 8:

  A SysOps administrator is configuring an Auto Scaling group of Amazon EC2 instances for an application. The average CPU utilization of the instances in the Auto Scaling group must remain at approximately 40% when the load on the application changes.

  Which solution will meet this requirement in the MOST operationally efficient manner?

  A. Create a scheduled scaling action. Configure the action to run at times when the application typically experiences an increase in traffic.
  B. Configure a simple scaling policy. Create an Amazon CloudWatch alarm that enters ALARM state when CPU utilization is greater than 40%. Associate the alarm with the scaling policy.
  C. Configure a step scaling policy. Create an Amazon CloudWatch alarm that enters ALARM state when CPU utilization is greater than 40%. Associate the alarm with the scaling policy.
  D. Configure a target tracking scaling policy. Specify a target value of 40 for average CPU utilization.
  D. Configure a target tracking scaling policy. Specify a target value of 40 for average CPU utilization.

  ---

  Explanation

  The correct answer is D because target tracking scaling policies are designed to automatically maintain a specific metric at a desired target value with the least administrative effort. AWS CloudOps documentation states that target tracking works like a thermostat, continuously adjusting capacity to keep the selected metric close to the defined target.

  By specifying a target value of 40% average CPU utilization, the Auto Scaling group automatically scales out or in based on real-time demand without requiring manual thresholds, multiple alarms, or predefined scaling steps. This approach is fully managed by AWS and is the most operationally efficient option.

  Option A is incorrect because scheduled scaling is based on predictable traffic patterns and cannot respond dynamically to real-time load changes. Option B is incorrect because simple scaling reacts only after an alarm is triggered and does not continuously maintain a target value. Option C is less efficient because step scaling requires additional configuration and tuning of scaling steps.

  AWS CloudOps best practices clearly recommend target tracking scaling policies for maintaining steady performance metrics with minimal operational overhead.

• Question 9:

  A CloudOps engineer needs to automatically restart a failed application process when specific error patterns appear in application logs stored in CloudWatch Logs.

  Which architecture aligns with AWS recommended operational best practices?

  A. CloudWatch Logs subscription filter --- Lambda --- restart process
  B. CloudWatch metric filter --- alarm --- EventBridge --- Systems Manager Automation
  C. CloudTrail Insights --- Lambda remediation
  D. GuardDuty findings --- SNS notification
  B. CloudWatch metric filter --- alarm --- EventBridge --- Systems Manager Automation

  ---

  Explanation

  AWS promotes event-driven remediation using CloudWatch metric filters to detect log patterns, alarms to represent state, EventBridge for routing, and Systems Manager Automation for controlled remediation. Subscription filters stream logs but do not represent state. CloudTrail and GuardDuty are unrelated to application log errors.

  AWS Systems Manager - Automated Remediation Patterns

• Question 10:

  A company uses AWS Organizations to manage its AWS environment. The company implements a process that uses prebuilt Amazon Machine Images (AMIs) to launch instances as a security measure. All AMIs are tagged automatically with a key named ApprovedAMI.

  The company wants to ensure that employees can use only the approved prebuilt AMIs to launch new instances.

  Which solution will meet this requirement?

  A. Implement a tag policy for the company's organization to require users to set the ApprovedAMI tag to launch new EC2 instances.
  B. Implement an IAM policy that includes an aws:ResourceTag/ApprovedAMI condition.
  C. Set up an AWS Config required-tags rule to prevent users from launching any nonapproved AMIs.
  D. Use Amazon GuardDuty to constantly monitor DefenseEvasion:EC2/UnusualDoHActivity findings.
  B. Implement an IAM policy that includes an aws:ResourceTag/ApprovedAMI condition.

  ---

  Explanation

  To ensure users can launch instances only from approved AMIs, the control must be enforced at authorization time, not after the fact. An IAM policy with a condition that evaluates the resource tags on the AMI is the correct method. By using an aws:ResourceTag/ApprovedAMI condition (paired with allowing ec2: RunInstances only when the chosen AMI has the required tag/value), the organization can prevent launches from untagged or unapproved images. This implements preventative control and aligns with least privilege.

  Option A (Organizations tag policy) is not an enforcement mechanism for EC2 API authorization; tag policies primarily help standardize tagging and report compliance rather than block API calls. Option C (AWS Config required-tags) evaluates resources for compliance after creation and cannot reliably prevent a launch at the time of the API call. Option D is unrelated; GuardDuty detections do not enforce AMI usage policy.