Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 141:

  A CloudOps engineer needs to ensure CloudFormation resources are created in a specific order because a custom resource must run only after an IAM role and an S3 bucket exist.

  Which CloudFormation mechanism should be used?

  A. Use Fn::If to delay resource creation.
  B. Use DependsOn to enforce resource creation order.
  C. Use an Auto Scaling lifecycle hook.
  D. Use a CloudWatch alarm to pause the stack.
  B. Use DependsOn to enforce resource creation order.

  ---

  Explanation

  CloudFormation creates resources in parallel when possible. When a custom resource requires other resources to exist first, DependsOn explicitly enforces creation order. This prevents timing-related failures (for example, a custom resource trying to assume a role or access a bucket that is not yet created).

  Fn::If controls conditional creation but does not guarantee sequencing when both resources are created. Auto Scaling lifecycle hooks are unrelated to CloudFormation resource ordering. CloudWatch alarms do not control stack execution order.

  AWS CloudFormation - Resource dependencies with DependsOn

• Question 142:

  A CloudOps engineer must ensure that S3 objects cannot be deleted for a defined retention period.

  Which solution should be used?

  A. S3 Versioning
  B. S3 Object Lock in compliance mode
  C. IAM deny policies
  D. S3 Lifecycle rules
  B. S3 Object Lock in compliance mode

  ---

  Explanation

  S3 Object Lock in compliance mode enforces WORM protection, preventing deletion even by the root user until the retention period expires.

  Amazon S3 - Object Lock

• Question 143:

  A company is running an ecommerce application on AWS. The application maintains many open but idle connections to an Amazon Aurora DB cluster. During times of peak usage, the database produces the following error message: "Too many connections." The database clients are also experiencing errors.

  Which solution will resolve these errors?

  A. Increase the read capacity units (RCUs) and the write capacity units (WCUs) on the database.
  B. Configure RDS Proxy. Update the application with the RDS Proxy endpoint.
  C. Turn on enhanced networking for the DB instances.
  D. Modify the DB cluster to use a burstable instance type.
  B. Configure RDS Proxy. Update the application with the RDS Proxy endpoint.

  ---

  Explanation

  The correct solution is B. Configure RDS Proxy, because RDS Proxy is specifically designed to manage and pool database connections for Amazon Aurora and Amazon RDS. AWS CloudOps documentation states that RDS Proxy reduces database load and prevents connection exhaustion by reusing existing connections and managing spikes in application demand.

  In this scenario, the ecommerce application maintains many idle connections, which consume database connection slots even when not actively used. During peak traffic, new connections cannot be established, resulting in the "Too many connections" error. RDS Proxy sits between the application and the Aurora DB cluster, maintaining a smaller, efficient pool of database connections and multiplexing application requests over those connections.

  Option A is incorrect because RCUs and WCUs apply to DynamoDB, not Aurora. Option C is incorrect because enhanced networking improves network throughput and latency but does not manage database connections. Option D is incorrect because changing instance types does not address idle connection buildup and can still result in connection exhaustion.

  AWS CloudOps best practices recommend RDS Proxy for applications with connection-heavy workloads, unpredictable traffic patterns, or serverless components.

• Question 144:

  A company has a web application that is experiencing performance problems many times each night. A root cause analysis reveals sudden increases in CPU utilization that last 5 minutes on an Amazon EC2 Linux instance. A CloudOps engineer must find the process ID (PID) of the service or process that is consuming more CPU.

  What should the CloudOps engineer do to collect the process utilization information with the LEAST amount of effort?

  A. Configure the Amazon CloudWatch agent procstat plugin to capture CPU process metrics.
  B. Configure an AWS Lambda function to run every minute to capture the PID and send a notification.
  C. Log in to the EC2 instance each night and run the top command.
  D. Use the default Amazon CloudWatch CPUUtilization metric.
  A. Configure the Amazon CloudWatch agent procstat plugin to capture CPU process metrics.

  ---

  Explanation

  The CloudWatch agent procstat plugin is specifically designed to collect per-process metrics such as CPU usage by process ID. It allows continuous, automated monitoring without manual intervention and integrates directly with CloudWatch.

  Default CloudWatch metrics provide only instance-level CPU utilization and do not expose process-level details. Manual logins and Lambda-based polling introduce unnecessary operational overhead and are not scalable.

  Therefore, configuring the procstat plugin is the most efficient solution.

• Question 145:

  A company needs to automate operational tasks on EC2 instances by running a standardized procedure (for example, restart a service, update a config file, and verify status). The CloudOps engineer wants a repeatable, auditable workflow.

  Which solution will meet these requirements?

  A. Use Systems Manager Automation runbooks.
  B. Use SSH and run commands manually on each instance.
  C. Use CloudTrail to replay API calls.
  D. Use Amazon S3 Batch Operations to run shell commands on instances.
  A. Use Systems Manager Automation runbooks.

  ---

  Explanation

  Systems Manager Automation runbooks provide a structured, repeatable workflow for operational tasks, with execution history, logging, and the ability to integrate approvals and parameters. This supports consistent operations at scale and aligns with auditability requirements because executions are tracked and can be reviewed.

  Manual SSH is not scalable and lacks standardized execution control. CloudTrail records API calls but does not execute OS-level operational procedures. S3 Batch Operations acts on S3 objects, not on instance-level service operations.

  AWS Systems Manager - Automation runbooks for operational workflows

• Question 146:

  A company has two AWS accounts connected by a transit gateway . Each account has one VPC in the same AWS Region. The company wants to simplify inbound and outbound rules in security groups by referencing security group IDs instead of IP CIDR blocks.

  Which solution will meet this requirement?

  A. Create VPC peering connections and remove the transit gateway.
  B. Enable security group referencing support on the transit gateway.
  C. Enable security group referencing support on each transit gateway attachment .
  D. Deploy private NAT gateways in each VPC.
  C. Enable security group referencing support on each transit gateway attachment .

  ---

  Explanation

  AWS Transit Gateway supports security group referencing across VPCs, but this feature must be explicitly enabled on each transit gateway attachment . Once enabled, security groups in one VPC can reference security groups in another VPC attached to the same transit gateway, simplifying rule management and improving security posture.

  Enabling the feature on the transit gateway itself is not sufficient; it must be enabled per attachment to allow traffic evaluation based on security group IDs. This approach avoids brittle CIDR-based rules and allows dynamic scaling without rule updates.

  Option A removes the transit gateway, which contradicts the existing architecture. Option B is incomplete.

  Option D does not address security group referencing.

  Thus, enabling security group referencing on each transit gateway attachment is the correct solution.

• Question 147:

  A CloudOps engineer needs to ensure that only approved AMIs are used to launch EC2 instances.

  Which solution will enforce this?

  A. AWS Config rules
  B. IAM policies only
  C. AWS Trusted Advisor
  D. EC2 Auto Scaling
  A. AWS Config rules

  ---

  Explanation

  AWS Config rules can evaluate AMI IDs against approved lists and trigger remediation for noncompliant launches.

  AWS Config - AMI Compliance

• Question 148:

  A company's Amazon EC2 instance with high CPU utilization is a t3.large instance running a test web app. The company determines the app would run better on a compute-optimized large instance.

  What should the CloudOps engineer do?

  A. Migrate the EC2 instance to a compute optimized instance by using AWS VM Import/Export.
  B. Enable hibernation on the EC2 instance. Change the instance type to a compute optimized instance. Disable hibernation on the EC2 instance.
  C. Stop the EC2 instance. Change the instance type to a compute optimized instance. Start the EC2 instance.
  D. Change the instance type to a compute optimized instance while the EC2 instance is running.
  C. Stop the EC2 instance. Change the instance type to a compute optimized instance. Start the EC2 instance.

  ---

  Explanation

  As described in the AWS Cloud Operations and EC2 Management documentation, changing an instance type (e.g., from T3 to C5) requires that the instance be stopped first. Once stopped, the engineer can modify the instance type through the AWS Management Console, CLI, or API, then start the instance again to apply changes.

  This process preserves the root volume, networking configuration, and data, making it an operationally safe and efficient way to upgrade to a different instance family. Changing the instance type while running (Option D) is unsupported. VM Import/Export (Option A) is for external VM migration. Hibernation (Option B) does not apply to type changes. Thus, Option C is correct - stopping the instance, changing its type, and restarting it meets AWS best practices.

  AWS Cloud Operations & Compute Guide - Modifying EC2 Instance Types for Performance Optimization

• Question 149:

  A company wants to ensure that EC2 instances do not drift from approved configuration standards.

  Which AWS service is designed for this purpose?

  A. AWS Config
  B. Amazon Inspector
  C. AWS Trusted Advisor
  D. Amazon GuardDuty
  A. AWS Config

  ---

  Explanation

  AWS Config continuously evaluates AWS resource configurations against defined rules, detects drift, and maintains a configuration history.

  Inspector focuses on vulnerabilities, GuardDuty on threats, and Trusted Advisor on best-practice checks.

  AWS Config - Configuration Compliance

• Question 150:

  A CloudOps engineer needs to automatically replace unhealthy EC2 instances while preserving application availability.

  Which configuration is REQUIRED?

  A. CloudWatch alarms only
  B. EC2 Auto Scaling with ELB health checks
  C. EC2 instance recovery
  D. Manual reboot scripts
  B. EC2 Auto Scaling with ELB health checks

  ---

  Explanation

  Auto Scaling integrated with load balancer health checks ensures unhealthy instances are terminated and replaced automatically without manual intervention.

  Amazon EC2 Auto Scaling - Health Checks