Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 91:

  A company wants to ensure that Amazon EC2 instances are automatically replaced if the underlying hardware fails.

  Which solution will meet this requirement with minimal operational effort?

  A. Enable EC2 instance recovery for the instances.
  B. Create a Lambda function to monitor instance status checks.
  C. Use AWS Backup to restore instances automatically.
  D. Enable termination protection on the instances.
  A. Enable EC2 instance recovery for the instances.

  ---

  Explanation

  EC2 instance recovery automatically restarts an instance on new hardware if a system status check fails, preserving instance metadata, private IPs, and EBS volumes. This is a managed, native solution that requires minimal configuration. Options B and C add unnecessary complexity, and termination protection does not provide recovery functionality.

  Amazon EC2 - Instance Recovery

• Question 92:

  A CloudOps engineer operates workloads in multiple AWS accounts. The engineer needs a single dashboard in one account to visualize Amazon CloudWatch metrics from production accounts in two other AWS Regions. The solution must minimize duplicated dashboard maintenance across accounts.

  Which solution will meet these requirements?

  A. Export metrics from each account to Amazon S3. Use Amazon Athena to visualize data.
  B. Use CloudWatch cross-account observability. Create a single dashboard in the monitoring account that references linked source accounts and Regions.
  C. Enable AWS Config aggregators for all accounts and build dashboards from AWS Config.
  D. Stream CloudWatch metrics to Amazon OpenSearch Service and build a dashboard there.
  B. Use CloudWatch cross-account observability. Create a single dashboard in the monitoring account that references linked source accounts and Regions.

  ---

  Explanation

  CloudWatch cross-account observability is designed to centralize monitoring across multiple AWS accounts while keeping the dashboard defined once in a monitoring account. After linking source accounts, the monitoring account can query and visualize metrics (and related telemetry) across those accounts and across multiple Regions, avoiding the operational overhead of duplicating dashboards or deploying templates separately per account/Region.

  Options A and D introduce unnecessary data pipelines and additional operational components that are not required to meet the "single dashboard" and "minimal maintenance" requirements. Option C (AWS Config) is intended for configuration compliance and history, not near-real-time metric visualization.

  Amazon CloudWatch - Cross-account observability and dashboards

• Question 93:

  A company requires immutable backups stored in Amazon S3 for 6 months.

  Which solution meets compliance requirements?

  A. S3 Versioning
  B. S3 Lifecycle rules
  C. S3 Object Lock compliance mode
  D. KMS encryption
  C. S3 Object Lock compliance mode

  ---

  Explanation

  Only S3 Object Lock in compliance mode enforces time-based immutability that cannot be bypassed.

  Amazon S3 - WORM Protection

• Question 94:

  A company runs a website on Amazon EC2 instances. Users can upload images to an Amazon S3 bucket and publish the images to the website. The company wants to deploy a serverless image-processing application that uses an AWS Lambda function to resize the uploaded images.

  The company's development team has created the Lambda function. A CloudOps engineer must implement a solution to invoke the Lambda function when users upload new images to the S3 bucket.

  Which solution will meet this requirement?

  A. Configure an Amazon Simple Notification Service (Amazon SNS) topic to invoke the Lambda function when a user uploads a new image to the S3 bucket.
  B. Configure an Amazon CloudWatch alarm to invoke the Lambda function when a user uploads a new image to the S3 bucket.
  C. Configure S3 Event Notifications to invoke the Lambda function when a user uploads a new image to the S3 bucket.
  D. Configure an Amazon Simple Queue Service (Amazon SQS) queue to invoke the Lambda function when a user uploads a new image to the S3 bucket.
  C. Configure S3 Event Notifications to invoke the Lambda function when a user uploads a new image to the S3 bucket.

  ---

  Explanation

  Comprehensive and Detailed From Exact Extract of AWS CloudOps Doocuments: Use Amazon S3 Event Notifications with AWS Lambda to trigger image processing on object creation. S3 natively supports invoking Lambda for events such as s3:ObjectCreated:*, providing a serverless, low- latency pipeline without managing additional services. AWS operational guidance states that "Amazon S3 can directly invoke a Lambda function in response to object-created events," allowing you to pass event metadata (bucket/key) to the function for resizing and writing results back to S3. This approach minimizes operational overhead, scales automatically with upload volume, and integrates with standard retry semantics. SNS or SQS can be added for fan-out or buffering patterns, but they are not required when the requirement is simply "invoke the Lambda function on upload." CloudWatch alarms do not detect individual S3 object uploads and cannot directly satisfy per-object triggers. Therefore, configuring S3 # Lambda event notifications meets the requirement most directly and aligns with

  CloudOps best practices for event- driven, serverless automation.

  References (AWS CloudOps Documents / Study Guide):

  Using AWS Lambda with Amazon S3 (Lambda Developer Guide) Amazon S3 Event Notifications (S3 User Guide) AWS Well-Architected - Serverless Applications (Operational Excellence)

• Question 95:

  A company needs to monitor its website's availability to end users. The company needs a solution to provide an Amazon Simple Notification Service (Amazon SNS) notification if the website's uptime decreases to less than 99%. The monitoring must provide an accurate view of the user experience on the website.

  Which solution will meet these requirements?

  A. Create an Amazon CloudWatch alarm that is based on the website's logs that are published to a CloudWatch Logs log group. Configure the alarm to publish an SNS notification if the number of HTTP 4xx and 5xx errors exceeds a specified threshold.
  B. Create an Amazon CloudWatch alarm that is based on the website's published metrics in CloudWatch. Configure the alarm to publish an SNS notification based on anomaly detection.
  C. Create an Amazon CloudWatch Synthetics heartbeat monitoring canary . Associate the canary with the website's URL. Create a CloudWatch alarm for the canary. Configure the alarm to publish an SNS notification if the value of the SuccessPercent metric is less than 99%.
  D. Create an Amazon CloudWatch Synthetics broken link checker monitoring canary. Associate the canary with the website's URL. Create a CloudWatch alarm for the canary. Configure the alarm to publish an SNS notification if the value of the SuccessPercent metric is less than 99%.
  C. Create an Amazon CloudWatch Synthetics heartbeat monitoring canary . Associate the canary with the website's URL. Create a CloudWatch alarm for the canary. Configure the alarm to publish an SNS notification if the value of the SuccessPercent metric is less than 99%.

  ---

  Explanation

  Amazon CloudWatch Synthetics heartbeat canaries actively test a website by sending periodic requests from AWS-managed locations, closely simulating real user access. This provides an accurate measurement of availability from an end- user perspective, which is a key requirement.

  The SuccessPercent metric represents the percentage of successful executions over time and directly maps to website uptime. Creating a CloudWatch alarm on this metric allows the CloudOps engineer to receive SNS notifications when availability drops below the 99% threshold.

  Log-based or anomaly-detection approaches do not reliably represent user experience, and broken link checkers focus on content integrity rather than availability. Therefore, a heartbeat canary is the correct solution.

• Question 96:

  A company uses Amazon Aurora PostgreSQL. A developer accidentally deletes critical data. The CloudOps engineer must restore the database to the exact state from 30 minutes earlier.

  Which approach is REQUIRED?

  A. Aurora Backtrack
  B. Restore from automated snapshot in place
  C. Point-in-time restore to a new cluster
  D. Restore from an S3 export
  C. Point-in-time restore to a new cluster

  ---

  Explanation

  Aurora PostgreSQL does not support Backtrack. Point-in-time recovery always restores to a new cluster, preserving the original cluster state.

  In-place restoration is not supported, and S3 exports are not recovery mechanisms.

  Amazon Aurora - Point-in-Time Recovery

• Question 97:

  A CloudOps engineer needs organization-wide visibility into security best-practice violations.

  Which service should be used?

  A. Amazon GuardDuty
  B. AWS Security Hub
  C. AWS Config
  D. Amazon Inspector
  B. AWS Security Hub

  ---

  Explanation

  AWS Security Hub aggregates security findings from multiple AWS services and provides centralized visibility and compliance reporting.

  AWS Security Hub - Centralized Security

• Question 98:

  A CloudOps engineer wants to standardize and harden AMIs used across environments with automated testing.

  Which AWS service is purpose-built for this task?

  A. AWS Systems Manager
  B. EC2 Image Builder
  C. Amazon Inspector
  D. AWS CloudFormation
  B. EC2 Image Builder

  ---

  Explanation

  EC2 Image Builder automates AMI creation, testing, validation, and lifecycle management, ensuring consistency and security.

  EC2 Image Builder - AMI Pipelines

• Question 99:

  A company has deployed Amazon EC2 instances from custom AMIs in two AWS Regions. All instances are registered with AWS Systems Manager. The company discovers a critical zero-day OS exploit but does not know which instances are affected.

  A CloudOps engineer must deploy operating system patches with the LEAST operational overhead.

  Which solution will meet this requirement?

  A. Define a patch baseline in Systems Manager Patch Manager. Run a scan to identify affected instances and use Patch Now in each Region.
  B. Use AWS Config to identify affected instances and then patch them.
  C. Use EventBridge to trigger patching automatically.
  D. Update the AMIs and manually replace instances.
  A. Define a patch baseline in Systems Manager Patch Manager. Run a scan to identify affected instances and use Patch Now in each Region.

  ---

  Explanation

  AWS Systems Manager Patch Manager provides a centralized and automated way to scan, identify, and remediate missing patches across managed instances. Patch baselines define which patches are approved, and scan operations identify affected instances without applying changes.

  Using Patch Now allows immediate remediation across Regions with minimal setup. Other options introduce unnecessary complexity or require manual intervention.

  Therefore, Patch Manager with scan and Patch Now is the least operationally intensive solution.

• Question 100:

  A company runs mission-critical workloads on Amazon EC2 instances in multiple Availability Zones. The instances are managed by AWS Systems Manager.

  During a security audit, the company discovers that some instances intermittently stop responding to Systems Manager commands, even though the SSM Agent is running and the IAM role is correctly attached. The instances are in private subnets with no internet access.

  Which action will MOST LIKELY resolve the issue?

  A. Attach the AmazonSSMManagedInstanceCore policy again to the instance role.
  B. Create interface VPC endpoints for ssm, ec2messages, and ssmmessages.
  C. Enable VPC Flow Logs to troubleshoot dropped traffic.
  D. Configure a NAT gateway in each Availability Zone.
  B. Create interface VPC endpoints for ssm, ec2messages, and ssmmessages.

  ---

  Explanation

  When EC2 instances are in private subnets without internet access, Systems Manager requires private connectivity through interface VPC endpoints. Specifically, Session Manager and Run Command depend on three endpoints: ssm, ec2messages, and ssmmessages.

  Without these endpoints, the agent can run locally but cannot establish persistent control and messaging channels with the Systems Manager service, leading to intermittent command failures. Reattaching IAM policies does not address network connectivity. NAT gateways are not required when private endpoints are used, and Flow Logs only provide visibility, not remediation.

  AWS Systems Manager - VPC Endpoints for Private Connectivity