Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 101:

  A SysOps administrator creates a custom Amazon Machine Image (AMI) in the eu-west-2 Region and uses the AMI to launch Amazon EC2 instances. The SysOps administrator needs to use the same AMI to launch EC2 instances in two other Regions: us-east-1 and us-east-2.

  What must the SysOps administrator do to use the custom AMI in the additional Regions?

  A. Copy the AMI to the additional Regions
  B. Make the AMI public in the Community AMIs section of the AWS Management Console
  C. Share the AMI to the additional Regions. Assign the required access permissions.
  D. Copy the AMI to a new Amazon S3 bucket. Assign access permissions to the AMI for the additional Regions
  A. Copy the AMI to the additional Regions

  ---

  Explanation

  Amazon Machine Images (AMIs) are Region-specific resources. AWS CloudOps documentation explicitly states that an AMI created in one Region cannot be used to launch instances in another Region unless it is copied to the target Region.

  Therefore, the SysOps administrator must copy the AMI to both us-east-1 and us- east-2.

  The AMI copy process creates a new AMI in each destination Region and automatically copies the underlying snapshots. Once the AMIs exist in the target Regions, they can be referenced in launch templates, Auto Scaling groups, or AWS CloudFormation templates for consistent multi-Region deployments.

  Option B is incorrect because making an AMI public does not replicate it across Regions. Option C is incorrect because sharing an AMI only grants account-level access within the same Region. Option D is incorrect because AMIs cannot be launched from Amazon S3 directly.

  This approach aligns with AWS CloudOps automation practices for multi-Region application deployment and disaster recovery readiness.

• Question 102:

  A company must ensure that secrets used by applications are rotated automatically and that applications can retrieve secrets securely at runtime.

  Which solution will meet these requirements?

  A. Store credentials in an AMI and rebuild the AMI monthly.
  B. Store credentials in AWS Secrets Manager and configure rotation.
  C. Store credentials in Amazon S3 with bucket encryption enabled.
  D. Store credentials in CloudWatch Logs and restrict access.
  B. Store credentials in AWS Secrets Manager and configure rotation.

  ---

  Explanation

  Secrets Manager is purpose-built to store, retrieve, and rotate secrets securely. Rotation reduces long- lived credential risk, and applications can retrieve secrets at runtime using IAM-controlled access. This meets both secure retrieval and automated rotation requirements while reducing operational risk compared with manual credential distribution.

  Embedding secrets in AMIs increases exposure and complicates rotation. S3 and CloudWatch Logs are not designed as secret stores and introduce unacceptable security risk even with access controls.

  AWS Secrets Manager - Secure storage and automatic rotation of secrets

• Question 103:

  A company requires that backups of critical workloads be copied to another AWS account for protection against accidental deletion and insider risk. The CloudOps engineer wants a managed approach.

  Which solution will meet these requirements?

  A. Use AWS Backup to copy recovery points to a backup vault in a different AWS account.
  B. Enable S3 Object Lock for all EC2 instances.
  C. Use CloudWatch alarms to detect deletions and then re-create backups.
  D. Use AWS Config to prevent backup deletion automatically.
  A. Use AWS Backup to copy recovery points to a backup vault in a different AWS account.

  ---

  Explanation

  AWS Backup supports cross-account backup strategies by allowing organizations to copy recovery points to backup vaults in other accounts, improving isolation and reducing the risk that a single compromised account can delete both primary resources and backups. This is a managed capability with centralized policy control, auditability, and standard restore procedures. S3 Object Lock applies to S3 objects, not EC2 instance backups as a general mechanism. CloudWatch alarms are reactive and do not guarantee restore points. AWS Config can evaluate compliance but is not a primary mechanism to perform cross-account backup copies.

  AWS Backup - Cross-account backup copy and vault strategies

• Question 104:

  A CloudOps engineer is examining the following AWS CloudFormation template:

  AWSTemplateFormatVersion: '2010-09-09'

  Description: 'Creates an EC2 Instance'

  Resources:

  EC2Instance:

  Type: AWS::EC2::Instance

  Properties:

  ImageId: ami-79fd7eee

  InstanceType: m5n.large

  SubnetId: subnet-1abc3d3fg

  PrivateDnsName: ip-10-24-34-0.ec2.internal

  Tags:

  - Key: Name

  Value: !

  Sub "${AWS::StackName} Instance" Why will the stack creation fail?

  A. The Outputs section of the CloudFormation template was omitted.
  B. The Parameters section of the CloudFormation template was omitted.
  C. The PrivateDnsName cannot be set from a CloudFormation template.
  D. The VPC was not specified in the CloudFormation template.
  C. The PrivateDnsName cannot be set from a CloudFormation template.

  ---

  Explanation

  The PrivateDnsName attribute of an EC2 instance is automatically assigned by AWS at launch time and is a read-only property. CloudFormation does not allow users to specify this value manually. Including PrivateDnsName in the EC2 instance properties causes validation to fail during stack creation. Outputs and Parameters sections are optional, and the VPC is implicitly defined through the subnet ID.

  Therefore, attempting to set PrivateDnsName results in stack creation failure.

• Question 105:

  A SysOps administrator needs to encrypt an existing Amazon Elastic File System (Amazon EFS) file system by using an existing AWS KMS customer managed key.

  Which solution will meet these requirements?

  A. Use Amazon EFS replication to create a new file system. Copy the data and metadata from the existing file system to the new file system. Specify the KMS customer managed key in the replication configuration. When the replication process finishes, fail over to the new encrypted file system.
  B. Directly modify the file system to use encryption. Specify the KMS customer managed key.
  C. Use Amazon EFS replication to create a new file system. Copy the data and metadata from the existing file system to the new file system. Generate a new TLS certificate. Specify the TLS certificate in the replication configuration. When the replication process finishes, fail over to the new encrypted file system.
  D. Create a new EFS file system that is encrypted with the KMS customer managed key. Create an Amazon EC2 instance to copy the files. Mount the encrypted file system and unencrypted file system on the instance. Copy all data from the unencrypted file system to the encrypted file system. Unmount the unencrypted file system and remove the temporary instance.
  D. Create a new EFS file system that is encrypted with the KMS customer managed key. Create an Amazon EC2 instance to copy the files. Mount the encrypted file system and unencrypted file system on the instance. Copy all data from the unencrypted file system to the encrypted file system. Unmount the unencrypted file system and remove the temporary instance.

• Question 106:

  A CloudOps engineer has an AWS CloudFormation template of the company's existing infrastructure in us- west-2. The CloudOps engineer attempts to use the template to launch a new stack in eu-west-1, but the stack partially deploys, receives an error message, and then rolls back.

  Why would this template fail to deploy? (Select TWO.)

  A. The template referenced an IAM user that is not available in eu-west-1.
  B. The template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1.
  C. The template did not have the proper level of permissions to deploy the resources.
  D. The template requested services that do not exist in eu-west-1.
  E. CloudFormation templates can be used only to update existing services.
  B. The template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1.
  D. The template requested services that do not exist in eu-west-1.

  ---

  Explanation

  Amazon Machine Images (AMIs) are Region-specific . An AMI ID that exists in us-west-2 does not automatically exist in eu-west-1. If a CloudFormation template references a hardcoded AMI ID from one Region, stack creation in another Region will fail when that AMI cannot be found. Additionally, not all AWS services or service features are available in every AWS Region. If the template includes a resource type or feature that is unsupported in eu-west-1, CloudFormation will fail during stack creation. IAM users are global resources, not Region-specific, so Option A is incorrect. Permission issues would typically fail immediately and are not Region-dependent. Option E is incorrect because CloudFormation can both create and update resources.

  Therefore, Region-specific AMIs and unavailable services are the valid reasons for failure.

• Question 107:

  A company has an AWS CloudFormation template that includes an AWS::EC2::Instance resource and a custom resource (Lambda function). The Lambda function fails because it runs before the EC2 instance is launched.

  Which solution will resolve this issue?

  A. Add a DependsOn attribute to the custom resource. Specify the EC2 instance in the DependsOn attribute.
  B. Update the custom resource's service token to point to a valid Lambda function.
  C. Update the Lambda function to use the cfn-response module to send a response to the custom resource.
  D. Use the Fn::If intrinsic function to check for the EC2 instance before the custom resource runs.
  A. Add a DependsOn attribute to the custom resource. Specify the EC2 instance in the DependsOn attribute.

  ---

  Explanation

  The AWS Cloud Operations and Infrastructure-as-Code documentation specifies that when using AWS CloudFormation, resources are created in parallel by default unless explicitly ordered using DependsOn. If a custom resource (Lambda) depends on another resource (like an EC2 instance) to exist before execution, a DependsOn attribute must be added to enforce creation order. This ensures the EC2 instance is launched and available before the custom resource executes its automation logic. Updating the service token (Option B) doesn't affect order of execution. The cfn-response module (Option C) handles callback communication but not sequencing. Fn::If (Option D) is for conditional creation, not dependency control.

  Therefore, Option A is correct - adding a DependsOn attribute guarantees that CloudFormation provisions the EC2 instance before executing the Lambda custom resource.

  AWS Cloud Operations & Infrastructure-as-Code Guide - Using DependsOn for Resource Creation Order in CloudFormation Templates

• Question 108:

  A CloudOps engineer wants to ensure that future EC2 instances automatically receive patching without manual scheduling.

  Which Systems Manager feature should be used?

  A. Patch Manager with maintenance windows
  B. Default Host Management Configuration
  C. Run Command documents
  D. Automation runbooks
  B. Default Host Management Configuration

  ---

  Explanation

  Default Host Management Configuration automatically enables core Systems Manager capabilities, including patching, for current and future instances at the organization or account level.

  AWS Systems Manager - Quick Setup

• Question 109:

  A company has a new security policy that requires all Amazon Elastic Block Store (Amazon EBS) volumes to be encrypted at rest. The company needs to use a custom key policy to manage access to the encryption keys. The company must rotate the keys once each year.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Create AWS KMS symmetric customer managed keys. Enable automatic key rotation.
  B. Use AWS owned AWS KMS keys across the company's AWS environment.
  C. Create AWS KMS asymmetric customer managed keys. Enable automatic key rotation.
  D. Create AWS KMS symmetric customer managed keys by using imported key material. Rotate the keys on a yearly basis.
  A. Create AWS KMS symmetric customer managed keys. Enable automatic key rotation.

  ---

  Explanation

  The correct answer is A because AWS KMS symmetric customer managed keys with automatic key rotation provide encryption, access control, and compliance with minimal operational effort. AWS CloudOps documentation states that Amazon EBS encryption supports AWS KMS symmetric keys only, and customer managed keys allow administrators to define custom key policies to control access.

  Automatic key rotation is supported for symmetric customer managed keys and rotates the backing key material once every year, fully satisfying the company's rotation requirement without manual intervention. This approach minimizes operational overhead while maintaining strong security controls and auditability. Option B is incorrect because AWS owned keys do not allow custom key policies and therefore cannot meet the access control requirement. Option C is incorrect because asymmetric KMS keys are not supported for EBS encryption. Option D is incorrect because imported key material requires manual rotation and re-import, increasing operational complexity and risk.

  AWS CloudOps security best practices strongly recommend customer managed symmetric keys with automatic rotation when organizations need fine-grained access control, regulatory compliance, and low maintenance overhead.

• Question 110:

  A CloudOps engineer needs to track the costs of data transfer between AWS Regions. The CloudOps engineer must implement a solution to send alerts to an email distribution list when transfer costs reach 75% of a specific threshold.

  What should the CloudOps engineer do to meet these requirements?

  A. Create an AWS Cost and Usage Report. Analyze the results in Amazon Athena. Configure an alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when costs reach 75% of the threshold. Subscribe the email distribution list to the topic.
  B. Create an Amazon CloudWatch billing alarm to detect when costs reach 75% of the threshold. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email distribution list to the topic.
  C. Use AWS Budgets to create a cost budget for data transfer costs. Set an alert at 75% of the budgeted amount. Configure the budget to send a notification to the email distribution list when costs reach 75% of the threshold.
  D. Set up a VPC flow log. Set up a subscription filter to an AWS Lambda function to analyze data transfer. Configure the Lambda function to send a notification to the email distribution list when costs reach 75% of the threshold.
  C. Use AWS Budgets to create a cost budget for data transfer costs. Set an alert at 75% of the budgeted amount. Configure the budget to send a notification to the email distribution list when costs reach 75% of the threshold.

  ---

  Explanation

  AWS Cloud Operations and Cost Management documentation, AWS Budgets is the recommended service to track and alert on cost thresholds across all AWS accounts and resources. It allows users to define cost, usage, or reservation budgets, and configure notifications to trigger when usage or cost reaches defined percentages of the budgeted value (e.g., 75%, 90%, 100%). The AWS Budgets system integrates natively with Amazon Simple Notification Service (SNS) to deliver alerts to an email distribution list or SNS topic subscribers. AWS Budgets supports granular cost filters, including specific service categories such as data transfer, regions, or linked accounts, ensuring precise visibility into inter-Region transfer costs.

  By contrast, CloudWatch billing alarms (Option B) monitor total account charges only and do not allow detailed service-level filtering, such as data transfer between Regions. Cost and Usage Reports (Option A) are for detailed cost analysis, not real-time alerting, and VPC Flow Logs (Option D) capture traffic data, not billing or cost-based metrics.

  Thus, using AWS Budgets with a 75% alert threshold best satisfies the operational and notification requirements.

  AWS CloudOps and Cost Management Guide - Section: AWS Budgets for Cost Monitoring and Alerts