Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 151:

  A company uses Amazon Aurora PostgreSQL. A developer accidentally deletes critical data. The CloudOps engineer must restore the database to the exact state from 30 minutes earlier.

  Which approach is REQUIRED?

  A. Aurora Backtrack
  B. Restore from automated snapshot in place
  C. Point-in-time restore to a new cluster
  D. Restore from an S3 export
  C. Point-in-time restore to a new cluster

  ---

  Explanation

  Aurora PostgreSQL does not support Backtrack. Point-in-time recovery always restores to a new cluster, preserving the original cluster state.

  In-place restoration is not supported, and S3 exports are not recovery mechanisms.

  Amazon Aurora - Point-in-Time Recovery

• Question 152:

  A SysOps administrator must load test a new Amazon CloudFront distribution to assess data transfer and latency performance.

  Which solution will meet this requirement?

  A. Send client requests from a single geographic region. Configure the load test so that each client makes an identical DNS request. Focus the client requests on the IP address that the DNS returns.
  B. Send client requests from a single geographic region. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.
  C. Send client requests from multiple geographic regions. Configure the load test so that each client makes an identical DNS request. Focus the client requests on the IP address that the DNS returns.
  D. Send client requests from multiple geographic regions. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.
  D. Send client requests from multiple geographic regions. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.

  ---

  Explanation

  CloudFront is a global edge network service, and its performance (latency and data transfer behavior) depends heavily on the geographic location of viewers and the edge locations that serve them. Therefore, a valid load test must generate traffic from multiple geographic regions to reflect real user distribution and to measure end- to-end latency across diverse network paths. Additionally, CloudFront uses DNS to return multiple possible edge IP addresses and can direct clients to different edge locations based on resolver behavior and network conditions. For a realistic test, each client should make an independent DNS request and distribute traffic across the returned IP addresses, rather than pinning all load to a single IP. Spreading requests across the returned set avoids biasing the test to one edge path and better represents how real browsers and applications resolve and connect to CloudFront.

  Options A and B fail to model global viewer behavior because they test from only one region. Option C introduces an unrealistic constraint by forcing identical DNS resolution and concentrating load on a single IP address, which can distort latency and throughput results. Option D best matches CloudOps guidance for performance validation of CDN workloads: multi-region testing with realistic DNS resolution and traffic distribution.

• Question 153:

  A company has a workload that is sending log data to Amazon CloudWatch Logs. One of the fields includes a measure of application latency. A CloudOps engineer needs to monitor the p90 statistic of this field over time.

  What should the CloudOps engineer do to meet this requirement?

  A. Create an Amazon CloudWatch Contributor Insights rule on the log data.
  B. Create a metric filter on the log data.
  C. Create a subscription filter on the log data.
  D. Create an Amazon CloudWatch Application Insights rule for the workload.
  B. Create a metric filter on the log data.

  ---

  Explanation

  To analyze and visualize custom statistics such as the p90 latency (90th percentile), a CloudWatch metric must be generated from the log data. The correct method is to create a metric filter that extracts the latency value from each log event and publishes it as a CloudWatch metric. Once the metric is published, percentile statistics (p90, p95, etc.) can be displayed in CloudWatch dashboards or alarms.

  AWS documentation states:

  "You can use metric filters to extract numerical fields from log events and publish them as metrics in CloudWatch. CloudWatch supports percentile statistics such as p90 and p95 for these metrics." Contributor Insights (Option A) is for analyzing frequent contributors, not numeric distributions. Subscription filters (Option C) are used for log streaming, and Application Insights (Option D) provides monitoring of application health but not custom p90 statistics. Hence, Option B is the CloudOps-aligned, minimal- overhead solution for percentile latency monitoring.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 1: Monitoring and Logging Amazon CloudWatch Logs - Metric Filters AWS Well-Architected Framework - Operational Excellence Pillar

• Question 154:

  A company uses AWS Systems Manager to manage a fleet of Amazon EC2 instances across multiple AWS accounts in an organization. The CloudOps engineer needs to ensure that future EC2 instances are automatically managed by Systems Manager without manual IAM configuration.

  Which solution will meet this requirement?

  A. Attach the AmazonSSMManagedInstanceCore policy to each EC2 instance role manually.
  B. Enable AWS Organizations trusted access for Systems Manager and configure Default Host Management Configuration.
  C. Create a Systems Manager Run Command to attach IAM policies to instance profiles.
  D. Use AWS Config to identify unmanaged EC2 instances.
  B. Enable AWS Organizations trusted access for Systems Manager and configure Default Host Management Configuration.

  ---

  Explanation

  AWS Systems Manager supports organization-wide management by integrating with AWS Organizations. By enabling trusted access and configuring Default Host Management Configuration, Systems Manager automatically provisions the required IAM roles and permissions for all existing and future EC2 instances across member accounts.

  This approach eliminates the need for manual IAM role attachment and ensures consistent, scalable management.

  Options A and C require manual or scripted intervention, and Option D only provides detection, not remediation.

  AWS Systems Manager - Default Host Management Configuration

• Question 155:

  A CloudOps engineer needs to enforce encryption at rest for all newly created Amazon EBS volumes in an AWS account.

  Which solution will meet this requirement?

  A. Use an SCP to deny ec2:CreateVolume actions.
  B. Enable EBS encryption by default in the account.
  C. Use AWS Config to detect unencrypted volumes.
  D. Encrypt volumes manually after creation.
  B. Enable EBS encryption by default in the account.

  ---

  Explanation

  Enabling EBS encryption by default ensures that all newly created EBS volumes and snapshots are encrypted automatically using AWS KMS, without requiring user action. AWS Config can only detect noncompliance, not prevent it. Manual encryption introduces operational risk and inconsistency.

  Amazon EBS - Encryption by Default

• Question 156:

  A company requires that all Amazon S3 objects remain immutable for regulatory reasons. Even the root user must not be able to delete objects during the retention period.

  Which solution satisfies this requirement?

  A. Enable S3 Versioning and MFA Delete.
  B. Enable S3 Object Lock in governance mode.
  C. Enable S3 Object Lock in compliance mode.
  D. Apply a bucket policy denying s3:DeleteObject.
  C. Enable S3 Object Lock in compliance mode.

  ---

  Explanation

  S3 Object Lock in compliance mode enforces WORM protection that cannot be bypassed by any user, including the root user, until the retention period expires. Governance mode allows privileged overrides. Versioning and IAM policies can be bypassed or modified, making them unsuitable for strict regulatory enforcement.

  Amazon S3 - Object Lock Compliance Mode

• Question 157:

  A CloudOps engineer wants to prevent developers from launching EC2 instances using unapproved AMIs across all accounts in an AWS Organization.

  Which solution enforces this MOST effectively?

  A. IAM policies applied to developer roles
  B. AWS Config rule with automatic remediation
  C. Service Control Policy (SCP) denying RunInstances with unapproved AMIs
  D. AWS Trusted Advisor checks
  C. Service Control Policy (SCP) denying RunInstances with unapproved AMIs

  ---

  Explanation

  Only SCPs can enforce preventive controls across all accounts, including root users. By denying ec2:RunInstances unless the AMI ID matches an approved list, the organization ensures enforcement before resource creation.

  AWS Config detects drift after creation and cannot prevent launches.

  AWS Organizations - Service Control Policies

• Question 158:

  A financial services company stores customer images in an Amazon S3 bucket in the us-east-1 Region. To comply with regulations, the company must ensure that all existing objects are replicated to an S3 bucket in a second AWS Region. If an object replication fails, the company must be able to retry replication for the object.

  What solution will meet these requirements?

  A. Configure Amazon S3 Cross-Region Replication (CRR). Use Amazon S3 live replication to replicate existing objects.
  B. Configure Amazon S3 Cross-Region Replication (CRR). Use S3 Batch Replication to replicate existing objects.
  C. Configure Amazon S3 Cross-Region Replication (CRR). Use S3 Replication Time Control (S3 RTC) to replicate existing objects.
  D. Use S3 Lifecycle rules to move objects to the destination bucket in a second Region.
  B. Configure Amazon S3 Cross-Region Replication (CRR). Use S3 Batch Replication to replicate existing objects.

  ---

  Explanation

  AWS Cloud Operations and S3 Data Management documentation Cross-Region Replication (CRR) automatically replicates new objects between S3 buckets across Regions. However, CRR alone does not retroactively replicate existing objects created before replication configuration. To include such objects, AWS introduced S3 Batch Replication.

  S3 Batch Replication scans the source bucket and replicates all existing objects that were not copied previously. Additionally, it can retry failed replication tasks automatically, ensuring regulatory compliance for complete dataset replication.

  S3 Replication Time Control (S3 RTC) guarantees predictable replication times for new objects only-it does not cover previously stored data. S3 Lifecycle rules (Option D) move or transition objects between storage classes or buckets, but not in a replication context. Therefore, the correct solution is to use S3 Cross-Region Replication (CRR) combined with S3 Batch Replication to ensure all current and future data is synchronized across Regions with retry capability.

  AWS Cloud Operations and S3 Guide - Section: Cross-Region Replication and Batch Replication for Existing Objects

• Question 159:

  A company runs several workloads on AWS. The company identifies five AWS Trusted Advisor service quota metrics to monitor in a specific AWS Region. The company wants to receive email notifications each time resource usage exceeds 60% of one of the service quotas.

  Which solution will meet these requirements?

  A. Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of one of the service quotas.
  B. Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Queue Service (Amazon SQS) queue for email notification.
  C. Use the AWS Health Dashboard to monitor each Trusted Advisor service quota metric. Configure an Amazon SQS queue for email notification.
  D. Use the AWS Health Dashboard to monitor each Trusted Advisor service quota metric. Configure an Amazon SNS topic for email notification.
  A. Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon Simple Notification Service (Amazon SNS) topic for email notification each time that usage exceeds 60% of one of the service quotas.

  ---

  Explanation

  AWS Trusted Advisor publishes service quota metrics to Amazon CloudWatch. These metrics can be monitored using CloudWatch alarms, which support threshold-based alerting. By creating a CloudWatch alarm for each service quota metric, the CloudOps engineer can trigger alerts when usage exceeds 60%. Amazon SNS is the AWS-native service for email notifications. CloudWatch alarms integrate directly with SNS, making this the most straightforward solution. SNS supports email subscriptions without additional infrastructure.

  Options B and C incorrectly use SQS for email notifications, which requires additional processing and does not natively send emails. Option D relies on the AWS Health Dashboard, which does not support configurable threshold-based alerts for service quotas.

  Therefore, CloudWatch alarms combined with SNS provide the correct and most efficient solution.

• Question 160:

  A CloudOps engineer needs to trigger automated remediation when an Amazon CloudWatch alarm enters the ALARM state.

  Which AWS service should be used to route the alarm event?

  A. Amazon SNS
  B. Amazon EventBridge
  C. AWS Step Functions
  D. Amazon SQS
  B. Amazon EventBridge

  ---

  Explanation

  Amazon EventBridge can respond to CloudWatch alarm state changes and invoke remediation actions such as Lambda functions or Systems Manager Automation runbooks. This enables event-driven, automated operations without manual intervention.

  Amazon EventBridge - CloudWatch Integration