Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 1:

  A CloudOps engineer needs historical visibility into configuration changes for AWS resources. Which service provides this capability?

  A. AWS CloudTrail
  B. AWS Config
  C. Amazon CloudWatch
  D. Amazon GuardDuty
  B. AWS Config

  ---

  explanation:

  AWS Config records configuration history and relationships, enabling auditing and troubleshooting of configuration changes over time. Reference: AWS Config - Resource History

• Question 2:

  A CloudOps engineer needs to automate patching across EC2 instances. Which AWS feature should be used?

  A. AWS Systems Manager Patch Manager
  B. AWS Config
  C. Amazon Inspector
  D. AWS Backup
  A. AWS Systems Manager Patch Manager

  ---

  explanation:

  Patch Manager automates OS patching using maintenance windows and patch baselines, reducing manual effort. Reference: Systems Manager - Patch Manager

• Question 3:

  A company wants to reduce latency for users accessing global content. Which AWS service should be used?

  A. Amazon Route 53
  B. Amazon CloudFront
  C. AWS Direct Connect
  D. Application Load Balancer
  B. Amazon CloudFront

  ---

  explanation:

  CloudFront caches content at edge locations globally, significantly reducing latency for end users. Reference: Amazon CloudFront - Global Content Delivery

• Question 4:

  A CloudOps engineer needs to ensure that only approved AMIs are used to launch EC2 instances. Which solution will enforce this?

  A. AWS Config rules
  B. IAM policies only
  C. AWS Trusted Advisor
  D. EC2 Auto Scaling
  A. AWS Config rules

  ---

  explanation:

  AWS Config rules can evaluate AMI IDs against approved lists and trigger remediation for noncompliant launches. Reference: AWS Config - AMI Compliance

• Question 5:

  A company wants to automatically restart a failed application process on EC2 instances. Which AWS service enables this with minimal configuration?

  A. AWS Lambda
  B. Systems Manager Automation
  C. CloudWatch alarms with EC2 recovery actions
  D. Amazon ECS
  C. CloudWatch alarms with EC2 recovery actions

  ---

  explanation:

  CloudWatch alarms can directly trigger EC2 recovery or reboot actions when metrics breach thresholds, enabling fast remediation. Reference: Amazon CloudWatch - EC2 Recovery Actions

• Question 6:

  A CloudOps engineer needs organization-wide visibility into security best-practice violations. Which service should be used?

  A. Amazon GuardDuty
  B. AWS Security Hub
  C. AWS Config
  D. Amazon Inspector
  B. AWS Security Hub

  ---

  explanation:

  AWS Security Hub aggregates security findings from multiple AWS services and provides centralized visibility and compliance reporting. Reference: AWS Security Hub - Centralized Security

• Question 7:

  A company wants to prevent accidental deletion of CloudFormation stacks. Which feature should be enabled?

  A. Stack policies
  B. Termination protection
  C. Rollback configuration
  D. Change sets
  B. Termination protection

  ---

  explanation:

  Termination protection prevents stacks from being deleted until the protection is explicitly disabled, safeguarding critical infrastructure. Reference: AWS CloudFormation - Termination Protection

• Question 8:

  A CloudOps engineer needs secure, keyless access to EC2 instances without opening inbound ports. Which solution meets this requirement?

  A. EC2 Instance Connect
  B. Systems Manager Session Manager
  C. Bastion hosts
  D. VPN access
  B. Systems Manager Session Manager

  ---

  explanation:

  Session Manager provides secure shell access over AWS APIs without SSH keys or inbound ports, with full audit logging. Reference: AWS Systems Manager - Session Manager

• Question 9:

  A company wants to monitor the p95 latency of an application based on log data. Which CloudWatch feature should be used?

  A. Contributor Insights
  B. Metric filters
  C. Subscription filters
  D. Anomaly detection
  B. Metric filters

  ---

  explanation:

  Metric filters extract numerical values from logs and publish them as CloudWatch metrics, enabling percentile statistics such as p95. Reference: CloudWatch Logs - Metric Filters

• Question 10:

  A CloudOps engineer must ensure that S3 objects cannot be deleted for a defined retention period. Which solution should be used?

  A. S3 Versioning
  B. S3 Object Lock in compliance mode
  C. IAM deny policies
  D. S3 Lifecycle rules
  B. S3 Object Lock in compliance mode

  ---

  explanation:

  S3 Object Lock in compliance mode enforces WORM protection, preventing deletion even by the root user until the retention period expires. Reference: Amazon S3 - Object Lock