Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 11:

  A company's architecture team must receive immediate email notifications whenever new Amazon EC2 instances are launched in the company's main AWS production account.

  What should a CloudOps engineer do to meet this requirement?

  A. Create a user data script that sends an email message through a smart host connector. Include the architecture team's email address in the user data script as the recipient. Ensure that all new EC2 instances include the user data script as part of a standardized build process.
  B. Create an Amazon Simple Notification Service (Amazon SNS) topic and a subscription that uses the email protocol. Enter the architecture team's email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched. Specify the SNS topic as the rule's target.
  C. Create an Amazon Simple Queue Service (Amazon SQS) queue and a subscription that uses the email protocol. Enter the architecture team's email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched. Specify the SQS queue as the rule's target.
  D. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure AWS Systems Manager to publish EC2 events to the SNS topic. Create an AWS Lambda function to poll the SNS topic. Configure the Lambda function to send any messages to the architecture team's email address.
  B. Create an Amazon Simple Notification Service (Amazon SNS) topic and a subscription that uses the email protocol. Enter the architecture team's email address as the subscriber. Create an Amazon EventBridge rule that reacts when EC2 instances are launched. Specify the SNS topic as the rule's target.

  ---

  Explanation

  As per the AWS Cloud Operations and Event Monitoring documentation, the most efficient method for event-driven notification is to use Amazon EventBridge to detect specific EC2 API events and trigger a Simple Notification Service (SNS) alert.

  EventBridge continuously monitors AWS service events, including RunInstances, which signals the creation of new EC2 instances. When such an event occurs, EventBridge sends it to an SNS topic, which then immediately emails subscribed recipients - in this case, the architecture team. This combination provides real-time, serverless notifications with minimal management. SQS (Option C) is designed for queue-based processing, not direct user alerts. User data scripts (Option A) and custom polling with Lambda (Option D) introduce unnecessary operational complexity and latency. Hence, Option B is the correct and AWS-recommended CloudOps design for immediate launch notifications.

  AWS Cloud Operations & Monitoring Guide - Section: EventBridge and SNS Integration for EC2 Event Notifications

• Question 12:

  A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems Manager Agent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows only outbound traffic.

  A CloudOps engineer needs to give a group of privileged administrators the ability to connect to the instance through SSH without exposing the instance to the internet.

  Which solution will meet this requirement?

  A. Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to allow inbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
  B. Create a Systems Manager endpoint in the private subnet. Update the security group to allow SSH traffic from the private network where the Systems Manager endpoint is connected. Create an IA. group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
  C. Create an EC2 Instance Connect endpoint in the public subnet. Update the security group to allow SSH traffic from the private network. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
  D. Create a Systems Manager endpoint in the public subnet. Create an IAM role that has the AmazonSSMManagedInstanceCore permission for the EC2 instance. Create an IAM group for privileged administrators. Assign the AmazonEC2ReadOnlyAccess IAM policy to the IAM group.
  A. Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to allow inbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.

  ---

  Explanation

  Comprehensive and Detailed From Exact Extract of AWS CloudOps Doocuments:

  EC2 Instance Connect Endpoint (EIC Endpoint) enables SSH to instances in private subnets without public IPs and without needing to traverse the public internet. CloudOps guidance explains that you deploy the endpoint in the same VPC/subnet as the targets, then allow inbound SSH on the instance security group from the endpoint's security group. Access is governed by IAM-administrators must have Instance Connect permissions;

  while the example uses a broad policy, the key mechanism is EIC in the private subnet plus SG rules scoped to the endpoint. Systems Manager Session Manager can provide shell access without SSH, but the requirement explicitly states "connect through SSH," making EIC the purpose- built solution. Options B and D misuse Systems Manager for SSH and propose unnecessary SG changes or incorrect endpoint placement; Option C places the endpoint in a public subnet, which is not required for private SSH access. Therefore, creating an EC2 Instance Connect endpoint in the private subnet and updating SGs accordingly meets the requirement while keeping the instance non-internet-exposed.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Security and Compliance Amazon EC2 - Instance Connect Endpoint (Private SSH Access) AWS Well-Architected Framework - Security Pillar (Least Privilege Network Access)

• Question 13:

  A CloudOps engineer needs historical visibility into configuration changes for AWS resources.

  Which service provides this capability?

  A. AWS CloudTrail
  B. AWS Config
  C. Amazon CloudWatch
  D. Amazon GuardDuty
  B. AWS Config

  ---

  Explanation

  AWS Config records configuration history and relationships, enabling auditing and troubleshooting of configuration changes over time.

  AWS Config - Resource History

• Question 14:

  A company must implement an audit trail for operational changes to AWS resources, including who made the change and the exact API parameters used.

  A CloudOps engineer needs a solution that can be queried efficiently for investigations without exporting logs to another service first.

  Which solution will meet these requirements?

  A. Use Amazon CloudWatch Logs and build dashboards for all API requests.
  B. Use AWS CloudTrail Lake to store events and run SQL-like queries for investigations.
  C. Use VPC Flow Logs to capture all AWS API activity.
  D. Use Amazon Inspector reports for operational change tracking.
  B. Use AWS CloudTrail Lake to store events and run SQL-like queries for investigations.

  ---

  Explanation

  CloudTrail is the authoritative service for recording AWS API activity, including identity context (IAM principal, access key/role session), timestamps, source IP, resources, and request parameters. CloudTrail Lake provides managed, queryable storage for CloudTrail events with SQL-like querying, allowing investigations directly in the service without requiring an export pipeline. This meets both the audit-trail and "query without exporting first" requirements.

  CloudWatch Logs is not the primary record of API activity across services. VPC Flow Logs capture network flows, not control-plane API calls. Inspector is a vulnerability management service and does not provide comprehensive API audit trails.

  AWS CloudTrail - CloudTrail Lake and event querying

• Question 15:

  A company's application servers in AWS account 111122223333 use a security group sg-1234abcd. They need to access a database hosted in account 444455556666. The VPCs are connected using a VPC peering connection (pcx-b04deed9).

  A CloudOps engineer must configure the database's security group to allow new connections only from the application servers.

  What should the engineer do?

  A. Add an inbound rule to the database's security group. Reference 111122223333/sg-1234abcd as the source.
  B. Add an inbound rule to the database's security group. Reference pcx-b04deed9/sg-1234abcd as the source.
  C. Add an inbound rule to the database's security group. Reference sg-1234abcd as the source.
  D. Add an inbound rule to the database's security group. Reference 444455556666/sg-1234abcd as the source.
  C. Add an inbound rule to the database's security group. Reference sg-1234abcd as the source.

  ---

  Explanation

  AWS Cloud Operations and VPC Networking documentation, when VPCs are peered, security groups can reference peer account security groups directly to restrict traffic between them. This feature allows specifying the security group ID (sg-1234abcd) from the source account (111122223333) in the target database's security group inbound rule. AWS automatically validates that the VPCs are connected through an existing VPC peering connection and that mutual permissions are properly configured.

  You do not prefix the security group ID with the account or peering connection (Options A and B), and using the destination account ID (Option D) is incorrect because it represents the database side, not the source.

  Hence, the correct configuration is Option C, which references the application servers' security group directly for precise, least-privilege access control.

  AWS Cloud Operations & Networking Guide - Using Security Group References Across VPC Peering Connections

• Question 16:

  A CloudOps engineer needs to ensure that only approved AMIs are used to launch EC2 instances.

  Which solution will enforce this?

  A. AWS Config rules
  B. IAM policies only
  C. AWS Trusted Advisor
  D. EC2 Auto Scaling
  A. AWS Config rules

  ---

  Explanation

  AWS Config rules can evaluate AMI IDs against approved lists and trigger remediation for noncompliant launches.

  AWS Config - AMI Compliance

• Question 17:

  A CloudOps engineer needs to automatically restart a failed application process when specific error patterns appear in application logs stored in CloudWatch Logs.

  Which architecture aligns with AWS recommended operational best practices?

  A. CloudWatch Logs subscription filter --- Lambda --- restart process
  B. CloudWatch metric filter --- alarm --- EventBridge --- Systems Manager Automation
  C. CloudTrail Insights --- Lambda remediation
  D. GuardDuty findings --- SNS notification
  B. CloudWatch metric filter --- alarm --- EventBridge --- Systems Manager Automation

  ---

  Explanation

  AWS promotes event-driven remediation using CloudWatch metric filters to detect log patterns, alarms to represent state, EventBridge for routing, and Systems Manager Automation for controlled remediation. Subscription filters stream logs but do not represent state. CloudTrail and GuardDuty are unrelated to application log errors.

  AWS Systems Manager - Automated Remediation Patterns

• Question 18:

  A company deploys AWS infrastructure in a VPC that has an internet gateway. The VPC has public subnets and private subnets. An Amazon RDS for MySQL DB instance is deployed in a private subnet. An AWS Lambda function uses the same private subnet and connects to the DB instance to query data.

  A developer modifies the Lambda function to require the function to publish messages to an Amazon Simple Queue Service (Amazon SQS) queue. After these changes, the Lambda function times out when it tries to publish messages to the SQS queue.

  Which solutions will resolve this issue? (Select TWO.)

  A. Reconfigure the Lambda function so that the function is not connected to the VPC.
  B. Deploy an RDS proxy. Configure the Lambda function to connect to the DB instance through the proxy.
  C. Deploy a NAT gateway. Update the private subnet's route table to route all traffic to the NAT gateway.
  D. Create an interface VPC endpoint for Amazon SQS in the VPC.
  E. Create a gateway endpoint for Amazon SQS in the VPC.
  C. Deploy a NAT gateway. Update the private subnet's route table to route all traffic to the NAT gateway.
  D. Create an interface VPC endpoint for Amazon SQS in the VPC.

  ---

  Explanation

  When an AWS Lambda function is configured to run inside a VPC, it loses default internet access. All outbound traffic must be explicitly routed. In this scenario, the Lambda function resides in a private subnet and successfully connects to Amazon RDS, but it times out when attempting to publish messages to Amazon SQS. This indicates a lack of network connectivity to the SQS service endpoint.

  There are two valid AWS-supported ways to restore connectivity. The first is to deploy a NAT gateway in a public subnet and update the private subnet route table to send outbound internet-bound traffic (0.0.0.0/0) to the NAT gateway. This allows the Lambda function to reach public AWS service endpoints, including SQS.

  The second option is to create an interface VPC endpoint (AWS PrivateLink) for Amazon SQS. This enables private, secure connectivity to SQS directly within the AWS network without traversing the internet. This approach is often preferred for security-sensitive workloads and removes dependency on NAT gateways.

  Option A would break database connectivity because the Lambda function must remain in the VPC to access the private RDS instance. Option B does not address outbound connectivity to SQS. Option E is incorrect because Amazon SQS does not support gateway endpoints; only interface endpoints are supported.

  Therefore, deploying a NAT gateway or creating an SQS interface endpoint resolves the timeout issue.

• Question 19:

  A company deploys an application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The company wants to protect the application from SQL injection attacks.

  Which solution will meet this requirement?

  A. Deploy AWS Shield Advanced in front of the ALB. Enable SQL injection filtering.
  B. Deploy AWS Shield Standard in front of the ALB. Enable SQL injection filtering.
  C. Deploy a vulnerability scanner on each EC2 instance. Continuously scan the application code.
  D. Deploy AWS WAF in front of the ALB. Subscribe to an AWS Managed Rule for SQL injection filtering.
  D. Deploy AWS WAF in front of the ALB. Subscribe to an AWS Managed Rule for SQL injection filtering.

  ---

  Explanation

  The AWS Cloud Operations and Security documentation confirms that AWS WAF (Web Application Firewall) is designed to protect web applications from application-layer threats, including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities. When integrated with an Application Load Balancer, AWS WAF inspects incoming traffic using rule groups. The AWS Managed Rules for SQL Injection Protection provide preconfigured, continuously updated filters that detect and block malicious SQL patterns.

  AWS Shield (Standard or Advanced) defends against DDoS attacks, not application-layer SQL attacks, and vulnerability scanners (Option C) only detect, not prevent, exploitation. Thus, Option D provides the correct, managed, and automated protection aligned with AWS best practices.

  AWS Cloud Operations & Security Guide - Protecting Applications from SQL Injection with AWS WAF Managed Rules

• Question 20:

  A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications.

  A CloudOps engineer must prevent users from launching Amazon EC2 instances that do not have a CostCenter-Project tag into any account in the application OU. The restriction must apply only to accounts in the application OU.

  Which solution will meet these requirements?

  A. Create an IAM group that has a policy that allows the ec2:RunInstances action when the CostCenter- Project tag is present. Place all IAM users who need access to the application accounts in the IAM group.
  B. Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter- Project tag is missing. Attach the SCP to the application OU .
  C. Create an IAM role that has a policy that allows the ec2:RunInstances action when the CostCenter- Project tag is present. Attach the IAM role to the IAM users that are in the application OU accounts.
  D. Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter- Project tag is missing. Attach the SCP to the root OU .
  B. Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter- Project tag is missing. Attach the SCP to the application OU .

  ---

  Explanation

  AWS Organizations service control policies (SCPs) are designed to enforce permission guardrails across accounts. SCPs define the maximum available permissions for IAM principals in member accounts, regardless of the permissions granted by IAM policies. Because the requirement is to prevent EC2 instance launches without a required tag and to apply the restriction only to accounts within a specific organizational unit, SCPs are the correct control mechanism.

  By creating an SCP that denies the ec2:RunInstances action when the CostCenter-Project tag is missing, the CloudOps engineer ensures that no EC2 instance can be launched without the required tag. Attaching the SCP directly to the application OU limits the scope of enforcement to only the accounts that belong to that OU, which satisfies the requirement precisely.

  IAM-based solutions such as user groups or roles cannot enforce controls across multiple accounts consistently and can be bypassed by users with sufficient permissions. Attaching the SCP to the root OU would incorrectly apply the restriction to all accounts in the organization, which violates the requirement.

  Therefore, attaching a tag-enforcing SCP to the application OU is the correct and least operationally complex solution.