Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 171:

  A company's website runs on an Amazon EC2 Linux instance. The website needs to serve PDF files from an Amazon S3 bucket.

  All public access to the S3 bucket is blocked at the account level. The company needs to allow website users to download the PDF files.

  Which solution will meet these requirements with the LEAST administrative effort?

  A. Create an IAM role that has a policy that allows s3:list* and s3:get* permissions. Assign the role to the EC2 instance. Assign a company employee to download requested PDF files to the EC2 instance and deliver the files to website users. Create an AWS Lambda function to periodically delete local files.
  B. Create an Amazon CloudFront distribution that uses an origin access control (OAC) that points to the S3 bucket. Apply a bucket policy to the bucket to allow connections from the CloudFront distribution. Assign a company employee to provide a download URL that contains the distribution URL and the object path to users when users request PDF files.
  C. Change the S3 bucket permissions to allow public access on the source S3 bucket. Assign a company employee to provide a PDF file URL to users when users request the PDF files.
  D. Deploy an EC2 instance that has an IAM instance profile to a public subnet. Use a signed URL from the EC2 instance to provide temporary access to the S3 bucket for website users.
  B. Create an Amazon CloudFront distribution that uses an origin access control (OAC) that points to the S3 bucket. Apply a bucket policy to the bucket to allow connections from the CloudFront distribution. Assign a company employee to provide a download URL that contains the distribution URL and the object path to users when users request PDF files.

  ---

  Explanation

  Per the AWS Cloud Operations, Networking, and Security documentation, the best practice for serving private S3 content securely to end users is to use Amazon CloudFront with Origin Access Control (OAC). OAC enables CloudFront to access S3 buckets privately, even when Block Public Access settings are enabled at the account level. This allows content to be delivered globally and securely without making the S3 bucket public. The bucket policy explicitly allows access only from the CloudFront distribution, ensuring that users can retrieve PDF files only via CloudFront URLs.

  This configuration offers:

  Automatic scalability through CloudFront caching, Improved security via private access control, Minimal administration effort with fully managed services.

  Other options require manual handling or make the bucket public, violating AWS security best practices. Therefore, Option B-using CloudFront with Origin Access Control and a restrictive bucket policy-provides the most secure, efficient, and low-maintenance CloudOps solution.

  AWS Cloud Operations and Content Delivery Guide - Section: Serving Private Content Securely from Amazon S3 via CloudFront Using Origin Access Control

• Question 172:

  A company has an application that collects notifications from thousands of alarm systems. Notifications include alarm notifications and information notifications. All notifications are stored in an Amazon Simple Queue Service (Amazon SQS) queue. Amazon EC2 instances in an Auto Scaling group process the messages.

  A CloudOps engineer needs to prioritize alarm notifications over information notifications.

  Which solution will meet these requirements?

  A. Scale the Auto Scaling group faster when message volume increases.
  B. Use Amazon SNS fanout to send messages to all EC2 instances.
  C. Add an Amazon DynamoDB stream to accelerate processing.
  D. Create separate SQS queues for alarm notifications and information notifications and process alarm messages first.
  D. Create separate SQS queues for alarm notifications and information notifications and process alarm messages first.

  ---

  Explanation

  Amazon SQS does not support message prioritization within a single queue. To prioritize certain messages, AWS recommends using multiple queues and processing them in priority order.

  By separating alarm notifications into one queue and information notifications into another, the application can poll and process the alarm queue first. This ensures that critical alarm messages are handled immediately, even during high load.

  Scaling faster or using SNS fanout does not guarantee priority. DynamoDB streams are unrelated to SQS message ordering.

  Therefore, separate queues provide a simple, scalable, and effective prioritization mechanism.

• Question 173:

  A company wants to prevent accidental deletion of CloudFormation stacks.

  Which feature should be enabled?

  A. Stack policies
  B. Termination protection
  C. Rollback configuration
  D. Change sets
  B. Termination protection

  ---

  Explanation

  Termination protection prevents stacks from being deleted until the protection is explicitly disabled, safeguarding critical infrastructure.

  AWS CloudFormation - Termination Protection

• Question 174:

  A CloudOps engineer has successfully deployed a VPC with an AWS CloudFormation template. The CloudOps engineer wants to deploy the same template across multiple accounts that are managed through AWS Organizations.

  Which solution will meet this requirement with the LEAST operational overhead?

  A. Assume the OrganizationAccountAccessRole IAM role from the management account. Deploy the template in each of the accounts.
  B. Create an AWS Lambda function to assume a role in each account. Deploy the template by using the AWS CloudFormation CreateStack API call.
  C. Create an AWS Lambda function to query for a list of accounts. Deploy the template by using the AWS CloudFormation CreateStack API call.
  D. Use AWS CloudFormation StackSets from the management account to deploy the template in each of the accounts.
  D. Use AWS CloudFormation StackSets from the management account to deploy the template in each of the accounts.

  ---

  Explanation

  CloudFormation StackSets are designed specifically to deploy and manage the same CloudFormation stack across multiple AWS accounts and Regions from a centralized administration point. When accounts are managed under AWS Organizations, StackSets can integrate directly with Organizations to target Organizational Units (OUs) or specific accounts, which minimizes operational overhead. This removes the need to manually assume roles and deploy stacks one-by- one, and avoids building custom automation (Lambda + cross-account role assumption + account enumeration + error handling + retries + idempotency).

  With StackSets, you define the template once and then create stack instances across many accounts in a controlled and consistent manner. StackSets provide built-in features for: (1) centralized rollout and updates, (2) drift detection, (3) automatic deployment to new accounts (when using Organizations integration), and (4) standardized execution roles. This is operationally simpler and safer than scripting because StackSets handle orchestration and track deployment state per account/Region.

  Option A increases manual work and is error-prone at scale. Options B and C require custom Lambda orchestration, cross-account permissions, and ongoing maintenance for failure modes and change management. StackSets provide the native "least ops" approach to multi-account CloudFormation deployments under Organizations.

• Question 175:

  A company's AWS accounts are in an organization in AWS Organizations. The organization has all features enabled. The accounts use Amazon EC2 instances to host applications. The company manages the EC2 instances manually by using the AWS Management Console. The company applies updates to the EC2 instances by using an SSH connection to each EC2 instance.

  The company needs a solution that uses AWS Systems Manager to manage all the organization's current and future EC2 instances. The latest version of Systems Manager Agent (SSM Agent) is running on the EC2 instances.

  Which solution will meet these requirements?

  A. Configure a home AWS Region in Systems Manager Quick Setup in the organization's management account. Deploy the Systems Manager Default Host Management Configuration Quick Setup from the management account.
  B. Configure a home AWS Region in Systems Manager Quick Setup in the organization's management account. Create a Systems Manager Run Command that attaches the AmazonSSMServiceRolePolicy IAM policy to every IAM role that the EC2 instances use. Invoke the command in every account in the organization.
  C. Create an AWS CloudFormation stack set that contains a Systems Manager parameter to define the Default Host Management Configuration role. Use the organization's management account to deploy the stack set to every account in the organization.
  D. Create an AWS CloudFormation stack set that contains an EC2 instance profile with the AmazonSSMManagedEC2InstanceDefaultPolicy IAM policy attached. Use the organization's management account to deploy the stack set to every account in the organization.
  A. Configure a home AWS Region in Systems Manager Quick Setup in the organization's management account. Deploy the Systems Manager Default Host Management Configuration Quick Setup from the management account.

  ---

  Explanation

  AWS CloudOps automation best practices recommend using AWS Systems Manager Quick Setup for organization-wide management and configuration of EC2 instances. The Default Host Management Configuration Quick Setup automatically enables Systems Manager capabilities such as Patch Manager, and AutomationInventory Session Manager across all managed instances within the organization. When deployed from the management account, Quick Setup automatically integrates with AWS Organizations to propagate configuration and permissions to existing and future accounts. This meets the requirement for organization-wide management with no manual configuration or SSH access. AWS documentation notes: "You can use Quick Setup in the management account of an organization in AWS Organizations to configure Systems Manager capabilities for all accounts and Regions. Quick Setup automatically keeps configurations up to date."

  Options B, C, and D require custom deployments or manual IAM updates, lacking centralized automation. Therefore, Option A fully satisfies CloudOps standards for automated provisioning and ongoing management of EC2 instances across an organization.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 3: Deployment, Provisioning and Automation AWS Systems Manager - Quick Setup and Default Host Management Configuration AWS Organizations Integration with Systems Manager AWS Well-Architected Framework - Operational Excellence Pillar

• Question 176:

  A company needs to automatically scale EC2 capacity based on application demand.

  Which AWS service should be configured?

  A. AWS Auto Scaling
  B. Amazon CloudFront
  C. AWS Batch
  D. Amazon ECS
  A. AWS Auto Scaling

  ---

  Explanation

  AWS Auto Scaling dynamically adjusts EC2 capacity based on defined metrics and scaling policies, ensuring availability and cost efficiency.

  AWS Auto Scaling - EC2 Scaling

• Question 177:

  A company hosts an encrypted Amazon S3 bucket in the ap-southeast-2 Region. Users from the eu-west- 2 Region access the S3 bucket through the internet. The users from eu-west-2 need faster transfers to and from the S3 bucket for large files.

  Which solution will meet these requirements?

  A. Create an S3 access point in eu-west-2 to use as the destination for S3 replication from ap-southeast- 2. Ensure all users switch to the new S3 access point.
  B. Create an Amazon Route 53 hosted zone with a geolocation routing policy. Choose the Alias to S3 website endpoint option. Specify the S3 bucket that is in ap-southeast-2 as the source bucket.
  C. Create a new S3 bucket in eu-west-2. Copy all contents from ap-southeast-2 to the new bucket in eu- west-2. Create an S3 access point, and associate it with both buckets. Ensure users use the new S3 access point.
  D. Configure and activate S3 Transfer Acceleration on the S3 bucket. Use the new S3 acceleration endpoint's domain name for access.
  D. Configure and activate S3 Transfer Acceleration on the S3 bucket. Use the new S3 acceleration endpoint's domain name for access.

  ---

  Explanation

  For users in eu-west-2 transferring large files to/from an S3 bucket in ap-southeast-2 over the public internet, S3 Transfer Acceleration is designed to improve performance by leveraging the AWS global edge network. With Transfer Acceleration enabled, users access the bucket via the acceleration endpoint. Requests enter AWS at the nearest edge location and then traverse the AWS backbone network to the bucket's Region, which typically reduces latency variability and can improve throughput for long- distance transfers.

  Option A is incorrect because access points do not "replicate destinations" in the way described, and an access point in another Region does not move data closer by itself. Option B is incorrect because Route 53 DNS routing does not accelerate data transfers; it only resolves names and (in this case) also incorrectly references S3 website endpoints (not appropriate for general large file transfer APIs). Option C is not valid as written because a single S3 access point cannot be "associated with both buckets," and maintaining two buckets introduces synchronization/consistency overhead; it's not the least-friction acceleration approach for direct internet users.

• Question 178:

  A CloudOps engineer needs to automate patching across EC2 instances.

  Which AWS feature should be used?

  A. AWS Systems Manager Patch Manager
  B. AWS Config
  C. Amazon Inspector
  D. AWS Backup
  A. AWS Systems Manager Patch Manager

  ---

  Explanation

  Patch Manager automates OS patching using maintenance windows and patch baselines, reducing manual effort.

  Systems Manager - Patch Manager

• Question 179:

  A company plans to run a public web application on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. The company's security team wants to protect the website by using AWS Certificate Manager (ACM) certificates. The load balancer must automatically redirect any HTTP requests to HTTPS .

  Which solution will meet these requirements?

  A. Create an Application Load Balancer that has one HTTPS listener on port 80. Attach an SSL/TLS certificate to port 80.
  B. Create an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS listener on port 443. Attach an SSL/TLS certificate to port 443. Create a rule to redirect requests from port 80 to port 443.
  C. Create an Application Load Balancer that has two TCP listeners on ports 80 and 443. Attach an SSL / TLS certificate to port 443.
  D. Create a Network Load Balancer with TCP listeners on ports 80 and 443. Attach an SSL/TLS certificate to port 443.
  B. Create an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS listener on port 443. Attach an SSL/TLS certificate to port 443. Create a rule to redirect requests from port 80 to port 443.

  ---

  Explanation

  An Application Load Balancer (ALB) operates at Layer 7 (HTTP/HTTPS) and supports advanced routing features, including HTTP-to-HTTPS redirection. To meet the requirement of protecting traffic with ACM certificates and automatically redirecting HTTP requests, the ALB must be configured with two listeners.

  The correct design is to create an HTTP listener on port 80 and an HTTPS listener on port 443. The SSL/ TLS certificate from AWS Certificate Manager is attached to the HTTPS listener. A listener rule on port 80 redirects incoming HTTP requests to HTTPS on port 443, ensuring all client connections are encrypted.

  Option A is invalid because HTTPS cannot operate on port 80. Option C uses TCP listeners, which do not support HTTP-level redirects. Option D uses a Network Load Balancer, which operates at Layer 4 and does not support HTTP redirects.

  Therefore, Option B is the only solution that satisfies all requirements using AWS-native features with minimal complexity.

• Question 180:

  A company wants to ensure that EC2 instances do not drift from approved configuration standards.

  Which AWS service is designed for this purpose?

  A. AWS Config
  B. Amazon Inspector
  C. AWS Trusted Advisor
  D. Amazon GuardDuty
  A. AWS Config

  ---

  Explanation

  AWS Config continuously evaluates AWS resource configurations against defined rules, detects drift, and maintains a configuration history.

  Inspector focuses on vulnerabilities, GuardDuty on threats, and Trusted Advisor on best-practice checks.

  AWS Config - Configuration Compliance