Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 191:

  A company uses hundreds of Amazon EC2 On-Demand Instances and Spot Instances to run production and non-production workloads. The company installs and configures the AWS Systems Manager Agent (SSM Agent) on the EC2 instances.

  During a recent instance patch operation, some instances were not patched because the instances were either busy or down. The company needs to generate a report that lists the current patch version of all instances .

  Which solution will meet these requirements in the MOST operationally efficient way?

  A. Use Systems Manager Inventory to collect patch versions. Generate a report of all instances.
  B. Use Systems Manager Run Command to remotely collect patch version information. Generate a report of all instances.
  C. Use AWS Config to track EC2 instance configuration changes by using output from the SSM Agents. Create a custom rule to check for patch versions. Generate a report of all unpatched instances.
  D. Use AWS Config to monitor the patch status of the EC2 instances by using output from the SSM Agents. Create a configuration compliance rule to check whether patches are installed. Generate a report of all instances.
  A. Use Systems Manager Inventory to collect patch versions. Generate a report of all instances.

  ---

  Explanation

  AWS Systems Manager Inventory is designed to collect metadata from managed instances, including installed software, applications, and patch information. It works asynchronously and does not require instances to be actively running a command at the time of collection, which is critical when instances may be busy or temporarily unavailable during patch windows.

  Inventory data is stored centrally and can be queried to generate reports showing the current patch level or installed patch versions across all managed instances. This makes it well-suited for large fleets that include both On-Demand and Spot Instances and that may scale dynamically.

  Option B relies on Run Command, which requires instances to be online and available at execution time. This does not meet the requirement because some instances were already missed during patch operations due to being busy or down. Option C and Option D use AWS Config, which is primarily intended for configuration compliance and drift detection, not detailed patch version reporting. Creating custom or managed rules for patch status introduces unnecessary complexity and overhead compared to Inventory's built-in capability.

  Therefore, Systems Manager Inventory provides the most operationally efficient and reliable solution for collecting and reporting patch version data across all EC2 instances.

• Question 192:

  A CloudOps engineer needs to set up alerting and remediation for a web application. The application consists of Amazon EC2 instances that have AWS Systems Manager Agent (SSM Agent) installed. Each EC2 instance runs a custom web server. The EC2 instances run behind a load balancer and write logs locally.

  The CloudOps engineer must implement a solution that restarts the web server software automatically if specific web errors are detected in the logs.

  Which combination of steps will meet these requirements? (Select THREE.)

  A. Install the Amazon CloudWatch agent on the EC2 instances.
  B. Create an AWS CloudTrail metric filter for the web logs. Configure an alarm for the specific errors.
  C. Create an Amazon CloudWatch metric filter for the web logs. Configure an alarm for the specific errors.
  D. Publish alarm findings to Amazon Simple Email Service (Amazon SES). Invoke an AWS Lambda function to restart the web server software.
  E. Create an Amazon EventBridge rule that responds to the alarm. Configure the rule to invoke an AWS Systems Manager Automation runbook to restart the web server software.
  F. Create an Amazon Simple Notification Service (Amazon SNS) notification that responds to the alarm. Configure the notification to invoke an AWS Systems Manager Automation runbook to restart the web server software.
  A. Install the Amazon CloudWatch agent on the EC2 instances.
  C. Create an Amazon CloudWatch metric filter for the web logs. Configure an alarm for the specific errors.
  E. Create an Amazon EventBridge rule that responds to the alarm. Configure the rule to invoke an AWS Systems Manager Automation runbook to restart the web server software.

  ---

  Explanation

  Per the AWS Cloud Operations, Monitoring, and Automation documentation, the correct workflow for automated operational remediation is: Amazon CloudWatch Agent is installed on each EC2 instance (Option A) to collect local log data and push it to Amazon CloudWatch Logs.

  A CloudWatch Metric Filter (Option C) is then defined to identify specific error strings or patterns within those logs (e.g., "HTTP 5xx" or "Service Unavailable"). When such an event occurs, CloudWatch Alarms are triggered.

  Upon alarm activation, Amazon EventBridge rules (Option E) are configured to respond automatically by invoking an AWS Systems Manager Automation runbook, which executes an action to restart the web server process on the affected instance via SSM Agent.

  This approach aligns directly with AWS's recommended CloudOps remediation pattern, known as event- driven automation, which ensures minimal downtime and eliminates manual intervention. Options involving CloudTrail (B) or SES notifications (D) are incorrect because they are unrelated to log- based application monitoring and automated remediation workflows.

  AWS Cloud Operations & Systems Manager Guide - Section: Automated Remediation using CloudWatch, EventBridge, and Systems Manager Automation

• Question 193:

  A company applies user-defined tags to AWS resources. Twenty days after applying the tags, the company notices that the tags cannot be used to filter views in the AWS Cost Explorer console.

  What is the reason for this issue?

  A. It takes at least 30 days before tags can be used in Cost Explorer.
  B. The company has not activated the user-defined tags for cost allocation .
  C. The company has not created an AWS Cost and Usage Report.
  D. The company has not created a usage budget in AWS Budgets.
  B. The company has not activated the user-defined tags for cost allocation .

  ---

  Explanation

  User-defined tags must be explicitly activated as cost allocation tags in the AWS Billing and Cost Management console before they can be used in Cost Explorer. Simply applying tags to resources is not sufficient.

  Once activated, cost allocation tags can take up to 24 hours to appear in Cost Explorer, but they will not appear at all if activation is not performed. The 30-day delay applies only to historical reporting after activation, not to visibility itself.

  Cost and Usage Reports and Budgets are not prerequisites for Cost Explorer filtering.

  Therefore, the issue occurs because the tags were not activated for cost allocation.

• Question 194:

  A CloudOps engineer needs to investigate sporadic Lambda failures over the past week.

  Which tool provides the FASTEST insight with the least setup?

  A. Athena queries on exported logs
  B. CloudWatch Logs Insights
  C. OpenSearch dashboards
  D. CloudTrail event history
  B. CloudWatch Logs Insights

  ---

  Explanation

  CloudWatch Logs Insights enables ad-hoc, serverless querying of Lambda logs with minimal configuration, making it ideal for rapid troubleshooting.

  Amazon CloudWatch Logs Insights

• Question 195:

  A company must ensure that all Amazon EC2 Windows instances that are launched in an AWS account have a third-party agent installed. The company uses AWS Systems Manager, and the Windows instances are tagged appropriately. The company must deploy periodic updates to the third-party agent when the updates become available.

  Which combination of steps will meet these requirements with the LEAST operational effort? (Select TWO.)

  A. Create a Systems Manager Distributor package for the third-party agent.
  B. Create a Systems Manager OpsItem that includes the tag value for Windows. Attach Systems Manager inventory to the OpsItem.
  C. Create an AWS Lambda function. Program the Lambda function to log in to each instance and to install or update the third-party agent as needed.
  D. Create a Systems Manager State Manager association to run the AWS-RunRemoteScript document. Populate the details of the third-party agent package.
  E. Create a Systems Manager State Manager association to run the AWS-ConfigureAWSPackage document. Populate the details of the third-party agent package. Specify instance targets based on the appropriate tag value for Windows.
  A. Create a Systems Manager Distributor package for the third-party agent.
  E. Create a Systems Manager State Manager association to run the AWS-ConfigureAWSPackage document. Populate the details of the third-party agent package. Specify instance targets based on the appropriate tag value for Windows.

  ---

  Explanation

  The least-effort, most scalable approach to ensure consistent software installation and ongoing updates across tagged Windows instances is to use AWS Systems Manager's native software distribution and desired-state capabilities. Systems Manager Distributor lets you package third-party software as an "SSM package," version it, and publish updates in a controlled way. This directly supports the requirement to install a third- party agent and deploy periodic updates when new versions are available.

  State Manager Associations let you enforce configuration continuously or on a schedule across a fleet, targeting instances by tags (which the scenario explicitly says are in place). By creating an association that runs AWS- ConfigureAWSPackage , you instruct Systems Manager to install (and optionally update) a specific SSM package on all instances that match the Windows tag criteria. This provides ongoing compliance: newly launched instances that receive the tag will automatically get the agent installed, and existing instances will receive updates according to the association's frequency and the package version strategy.

  Option C (custom Lambda that logs in) is high operational overhead and poor practice (credentials, connectivity, error handling, scaling, and security concerns). Option D (RunRemoteScript) can work but is more brittle than ConfigureAWSPackage because it shifts lifecycle management (versioning, state, idempotency) into scripts. Option B (OpsItem + Inventory) is not an enforcement mechanism for installation /updating; it's for operations tracking and visibility.

  Therefore, Distributor (A) + State Manager association using AWS-ConfigureAWSPackage targeted by tags (E) is the cleanest and lowest-ops solution.

• Question 196:

  A company plans to host an application on Amazon EC2 instances distributed across multiple Availability Zones. The application must scale to millions of requests per second and handle sudden and volatile traffic patterns. The solution must use a single static IP address per Availability Zone .

  Which solution will meet these requirements?

  A. Amazon Simple Queue Service (Amazon SQS)
  B. Application Load Balancer
  C. AWS Global Accelerator
  D. Network Load Balancer
  D. Network Load Balancer

  ---

  Explanation

  Network Load Balancer supports static IP per Availability Zone and handles millions of requests per second. Global Accelerator provides static anycast IPs globally, not per AZ requirement directly.

• Question 197:

  A CloudOps engineer needs to enforce encryption at rest for all newly created Amazon EBS volumes in an AWS account.

  Which solution will meet this requirement?

  A. Use an SCP to deny ec2:CreateVolume actions.
  B. Enable EBS encryption by default in the account.
  C. Use AWS Config to detect unencrypted volumes.
  D. Encrypt volumes manually after creation.
  B. Enable EBS encryption by default in the account.

  ---

  Explanation

  Enabling EBS encryption by default ensures that all newly created EBS volumes and snapshots are encrypted automatically using AWS KMS, without requiring user action. AWS Config can only detect noncompliance, not prevent it. Manual encryption introduces operational risk and inconsistency.

  Amazon EBS - Encryption by Default

• Question 198:

  A CloudOps engineer needs to detect a recurring application error pattern in Amazon CloudWatch Logs and reduce alert noise.

  The engineer must send only one notification if the error occurs across multiple log groups within a short time window.

  Which solution will meet this requirement?

  A. Create a CloudWatch Logs subscription filter for each log group and send all matches to email.
  B. Create one CloudWatch alarm per log group and configure all alarms to send notifications directly to Amazon SNS.
  C. Create metric filters for each log group, create CloudWatch alarms for the derived metrics, and use a CloudWatch composite alarm to notify only when multiple alarms are in ALARM.
  D. Enable VPC Flow Logs and alert when traffic increases.
  C. Create metric filters for each log group, create CloudWatch alarms for the derived metrics, and use a CloudWatch composite alarm to notify only when multiple alarms are in ALARM.

  ---

  Explanation

  Metric filters convert specific log patterns into CloudWatch metrics, which can then drive CloudWatch alarms. To reduce noise when the same failure pattern appears across multiple components/log groups, a CloudWatch composite alarm can combine underlying alarms and trigger a single action when defined conditions are met (for example, "ALARM if any two of these alarms are ALARM," or "ALARM if all are ALARM"). This consolidates notifications and prevents alert storms while preserving signal quality. Option B increases noise because each alarm independently notifies. Option A is log streaming, not stateful alarming, and it does not inherently reduce duplication. Option D is unrelated to application error patterns in logs.

  Amazon CloudWatch - Metric filters, alarms, and composite alarms

• Question 199:

  A company requires immutable backups stored in Amazon S3 for 6 months.

  Which solution meets compliance requirements?

  A. S3 Versioning
  B. S3 Lifecycle rules
  C. S3 Object Lock compliance mode
  D. KMS encryption
  C. S3 Object Lock compliance mode

  ---

  Explanation

  Only S3 Object Lock in compliance mode enforces time-based immutability that cannot be bypassed.

  Amazon S3 - WORM Protection

• Question 200:

  A CloudOps engineer needs to investigate sporadic Lambda failures over the past week.

  Which tool provides the FASTEST insight with the least setup?

  A. Athena queries on exported logs
  B. CloudWatch Logs Insights
  C. OpenSearch dashboards
  D. CloudTrail event history
  B. CloudWatch Logs Insights

  ---

  Explanation

  CloudWatch Logs Insights enables ad-hoc, serverless querying of Lambda logs with minimal configuration, making it ideal for rapid troubleshooting.

  Amazon CloudWatch Logs Insights