Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 121:

  A company runs mission-critical workloads on Amazon EC2 instances in multiple Availability Zones. The instances are managed by AWS Systems Manager.

  During a security audit, the company discovers that some instances intermittently stop responding to Systems Manager commands, even though the SSM Agent is running and the IAM role is correctly attached. The instances are in private subnets with no internet access.

  Which action will MOST LIKELY resolve the issue?

  A. Attach the AmazonSSMManagedInstanceCore policy again to the instance role.
  B. Create interface VPC endpoints for ssm, ec2messages, and ssmmessages.
  C. Enable VPC Flow Logs to troubleshoot dropped traffic.
  D. Configure a NAT gateway in each Availability Zone.
  B. Create interface VPC endpoints for ssm, ec2messages, and ssmmessages.

  ---

  Explanation

  When EC2 instances are in private subnets without internet access, Systems Manager requires private connectivity through interface VPC endpoints. Specifically, Session Manager and Run Command depend on three endpoints: ssm, ec2messages, and ssmmessages.

  Without these endpoints, the agent can run locally but cannot establish persistent control and messaging channels with the Systems Manager service, leading to intermittent command failures. Reattaching IAM policies does not address network connectivity. NAT gateways are not required when private endpoints are used, and Flow Logs only provide visibility, not remediation.

  AWS Systems Manager - VPC Endpoints for Private Connectivity

• Question 122:

  A company needs centralized visibility into security findings from GuardDuty, Inspector, and IAM Access Analyzer.

  Which service provides this aggregation natively?

  A. AWS Config
  B. AWS Security Hub
  C. Amazon Detective
  D. AWS CloudTrail
  B. AWS Security Hub

  ---

  Explanation

  AWS Security Hub aggregates and normalizes findings from multiple AWS security services into a centralized view with compliance scoring.

  AWS Security Hub - Centralized Findings

• Question 123:

  A CloudOps engineer needs historical visibility into configuration changes for AWS resources.

  Which service provides this capability?

  A. AWS CloudTrail
  B. AWS Config
  C. Amazon CloudWatch
  D. Amazon GuardDuty
  B. AWS Config

  ---

  Explanation

  AWS Config records configuration history and relationships, enabling auditing and troubleshooting of configuration changes over time.

  AWS Config - Resource History

• Question 124:

  A company runs an application on Amazon EC2 instances in an Auto Scaling group. Scale-out actions take a long time because of long-running boot scripts. The CloudOps engineer must reduce scale-out time without overprovisioning.

  Which solution will meet these requirements?

  A. Change the launch configuration to use a larger instance size.
  B. Increase the minimum number of instances in the Auto Scaling group.
  C. Add a predictive scaling policy to the Auto Scaling group.
  D. Add a warm pool to the Auto Scaling group.
  D. Add a warm pool to the Auto Scaling group.

  ---

  Explanation

  An Auto Scaling warm pool keeps pre-initialized instances in a stopped or running state, allowing them to be quickly attached to the Auto Scaling group when scaling events occur. This significantly reduces scale- out latency caused by long bootstrapping scripts.

  Unlike increasing the minimum instance count, warm pools do not permanently overprovision resources. Predictive scaling improves timing but does not eliminate boot time delays.

  Therefore, warm pools provide the fastest scale-out with minimal cost overhead.

• Question 125:

  A company wants to automatically restart a failed application process on EC2 instances.

  Which AWS service enables this with minimal configuration?

  A. AWS Lambda
  B. Systems Manager Automation
  C. CloudWatch alarms with EC2 recovery actions
  D. Amazon ECS
  C. CloudWatch alarms with EC2 recovery actions

  ---

  Explanation

  CloudWatch alarms can directly trigger EC2 recovery or reboot actions when metrics breach thresholds, enabling fast remediation.

  Amazon CloudWatch - EC2 Recovery Actions

• Question 126:

  A CloudOps engineer operates workloads in multiple AWS accounts. The engineer needs a single dashboard in one account to visualize Amazon CloudWatch metrics from production accounts in two other AWS Regions.

  The solution must minimize duplicated dashboard maintenance across accounts.

  Which solution will meet these requirements?

  A. Export metrics from each account to Amazon S3. Use Amazon Athena to visualize data.
  B. Use CloudWatch cross-account observability. Create a single dashboard in the monitoring account that references linked source accounts and Regions.
  C. Enable AWS Config aggregators for all accounts and build dashboards from AWS Config.
  D. Stream CloudWatch metrics to Amazon OpenSearch Service and build a dashboard there.
  B. Use CloudWatch cross-account observability. Create a single dashboard in the monitoring account that references linked source accounts and Regions.

  ---

  Explanation

  CloudWatch cross-account observability is designed to centralize monitoring across multiple AWS accounts while keeping the dashboard defined once in a monitoring account. After linking source accounts, the monitoring account can query and visualize metrics (and related telemetry) across those accounts and across multiple Regions, avoiding the operational overhead of duplicating dashboards or deploying templates separately per account/Region.

  Options A and D introduce unnecessary data pipelines and additional operational components that are not required to meet the "single dashboard" and "minimal maintenance" requirements. Option C (AWS Config) is intended for configuration compliance and history, not near-real-time metric visualization.

  Amazon CloudWatch - Cross-account observability and dashboards

• Question 127:

  A company uses AWS CloudFormation to deploy application stacks. A CloudOps engineer needs to roll out a standard baseline stack to all existing and future accounts in an AWS Organization, with minimal manual effort.

  Which solution will meet these requirements?

  A. Use CloudFormation StackSets with service-managed permissions integrated with AWS Organizations.
  B. Copy and paste the template into each account and deploy it manually.
  C. Use AWS Config to deploy CloudFormation templates automatically.
  D. Use Amazon SNS to trigger stack creation in each account.
  A. Use CloudFormation StackSets with service-managed permissions integrated with AWS Organizations.

  ---

  Explanation

  CloudFormation StackSets with service-managed permissions is specifically designed for centralized, multi-account, multi-Region deployments integrated with AWS Organizations. The management account (or delegated administrator) can deploy a baseline stack across OUs and automatically apply it to new accounts added to targeted OUs, meeting both "existing and future accounts" and "minimal manual effort." Manual deployment does not scale and increases drift risk. AWS Config is for compliance evaluation rather than orchestrating organization-wide stack rollout. SNS can notify but does not provide the governed deployment model and lifecycle management that StackSets provides.

  AWS CloudFormation - StackSets with AWS Organizations integration

• Question 128:

  An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A CloudOps engineer must ensure that the application can read, write, and delete messages from the SQS queues.

  Which solution will meet these requirements in the MOST secure manner?

  A. Create an IAM user with permissions and embed credentials in the application configuration.
  B. Create an IAM user with permissions and export credentials as environment variables.
  C. Create and associate an IAM role for EC2 . Attach a policy that allows sqs:* permissions.
  D. Create and associate an IAM role for EC2 . Attach a policy that allows SendMessage, ReceiveMessage, and DeleteMessage permissions.
  D. Create and associate an IAM role for EC2 . Attach a policy that allows SendMessage, ReceiveMessage, and DeleteMessage permissions.

  ---

  Explanation

  The most secure way for an EC2 instance to access AWS services is by using an IAM role attached to the instance . IAM roles eliminate the need for long-term credentials, which reduces the risk of credential leakage and simplifies credential rotation.

  Following the principle of least privilege , the IAM policy attached to the role should grant only the permissions required: sqs:SendMessage, sqs:ReceiveMessage, and sqs:DeleteMessage. Granting broader permissions such as sqs:* violates least privilege and increases security risk.

  Options A and B rely on IAM users and static credentials, which are not recommended for applications running on EC2. Option C grants excessive permissions.

  Therefore, attaching an EC2 IAM role with only the required SQS permissions is the most secure solution.

• Question 129:

  A company has an on-premises DNS solution and wants to resolve DNS records in an Amazon Route 53 private hosted zone for example.com.

  The company has set up an AWS Direct Connect connection for network connectivity between the on- premises network and the VPC. A CloudOps engineer must ensure that an on-premises server can query records in the example.com domain.

  What should the CloudOps engineer do to meet these requirements?

  A. Create a Route 53 Resolver inbound endpoint. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.
  B. Create a Route 53 Resolver inbound endpoint. Attach a security group to the endpoint to allow outbound traffic on TCP/UDP port 53 to the on-premises DNS servers.
  C. Create a Route 53 Resolver outbound endpoint. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.
  D. Create a Route 53 Resolver outbound endpoint. Attach a security group to the endpoint to allow outbound traffic on TCP/UDP port 53 to the on-premises DNS servers.
  A. Create a Route 53 Resolver inbound endpoint. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.

  ---

  Explanation

  AWS Cloud Operations and Networking documentation Route 53 Resolver inbound endpoints allow DNS queries to originate from on-premises DNS servers and resolve private hosted zone records in AWS. The inbound endpoint provides DNS resolver IP addresses within the VPC, which the on-premises DNS servers can forward queries to over AWS Direct Connect or VPN connections. The inbound endpoint must be associated with a security group that permits inbound traffic on TCP and UDP port 53 from the on-premises DNS server IP addresses. This ensures that DNS requests from the on- premises environment reach the VPC Resolver for resolution of private domains like example.com. By contrast, outbound endpoints are used for the opposite direction-resolving external (on-premises or internet) DNS names from within AWS VPCs. Therefore, only an inbound endpoint correctly satisfies the direction of resolution in this scenario.

  AWS Cloud Operations & Route 53 Resolver Guide - Section: Inbound and Outbound Endpoints for Hybrid DNS Resolution

• Question 130:

  A company uses an Auto Scaling group with target tracking based on CPU utilization. During traffic spikes, application latency increases before scaling occurs. The workload processes messages from an Amazon SQS queue.

  Which change will MOST EFFECTIVELY improve scaling responsiveness?

  A. Reduce the Auto Scaling cooldown period.
  B. Switch from target tracking to simple scaling.
  C. Use CloudWatch metric math to scale on SQS backlog per instance.
  D. Increase the maximum capacity of the Auto Scaling group.
  C. Use CloudWatch metric math to scale on SQS backlog per instance.

  ---

  Explanation

  For queue-based workloads, CPU utilization is an indirect signal and often lags behind actual demand. AWS recommends scaling based on queue backlog per instance using CloudWatch metric math, which directly reflects processing pressure.

  Cooldown tuning or capacity limits do not correct the fundamental signal mismatch, and simple scaling is less adaptive than target tracking.

  Amazon EC2 Auto Scaling - Scaling on Amazon SQS Backlog