Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 201:

  A CloudOps engineer needs to control access to groups of Amazon EC2 instances using AWS Systems Manager Session Manager. Specific tags on the EC2 instances have already been added.

  Which additional actions should the CloudOps engineer take to control access? (Select TWO.)

  A. Attach an IAM policy to the users or groups that require access to the EC2 instances.
  B. Attach an IAM role to control access to the EC2 instances.
  C. Create a placement group for the EC2 instances and add a specific tag.
  D. Create a service account and attach it to the EC2 instances that need to be controlled.
  E. Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element.
  A. Attach an IAM policy to the users or groups that require access to the EC2 instances.
  E. Create an IAM policy that grants access to any EC2 instances with a tag specified in the Condition element.

  ---

  Explanation

  AWS Systems Manager Session Manager allows secure, auditable instance access without SSH keys or inbound ports. To control access based on instance tags, CloudOps best practices require two configurations: Attach an IAM policy to users or groups granting ssm:StartSession, ssm:DescribeInstanceInformation, and ssm:DescribeSessions.

  Include a Condition element in the IAM policy referencing instance tags, such as Condition:

  {"StringEquals": {"ssm:resourceTag/Environment": "Production"}}. This ensures users can start sessions only with instances that have matching tags, providing fine-grained access control.

  AWS CloudOps documentation under Security and Compliance states: "Use IAM policies with resource tags in the Condition element to restrict which managed instances users can access using Session Manager."

  Options B and D incorrectly suggest attaching roles or service accounts that are not relevant to user-level access control. Option C (placement groups) pertains to networking and performance, not access management. Therefore, A and E together provide tag-based, least-privilege access as required.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 4: Security and Compliance AWS Systems Manager User Guide - Controlling Access to Session Manager Using Tags AWS IAM Policy Reference - Condition Keys for AWS Systems Manager AWS Well-Architected Framework - Security Pillar

• Question 202:

  A company uses Amazon EventBridge to route operational events. A CloudOps engineer creates a rule to match specific AWS service events, but events are not arriving at the target in the same account. The engineer confirms the target has correct permissions and is healthy.

  Which action is MOST likely to identify the root cause quickly?

  A. Use the EventBridge rule "Test event pattern" feature with a sample event and verify matching results.
  B. Enable AWS Config to record EventBridge configuration changes.
  C. Create a NAT gateway to allow EventBridge to reach the target.
  D. Enable Amazon Inspector to scan the EventBridge rule.
  A. Use the EventBridge rule "Test event pattern" feature with a sample event and verify matching results.

  ---

  Explanation

  When EventBridge rules do not trigger, the most common cause is an event pattern mismatch (wrong source, detail-type, missing fields, incorrect value matching, or Region/event-bus mismatch). The fastest operational troubleshooting step is to validate the rule's event pattern against representative events using built-in testing and then confirm the event bus and rule are in the correct Region. This directly validates whether events should match before investigating deeper delivery mechanics. AWS Config provides historical configuration visibility but does not immediately confirm pattern matching logic. NAT gateways are not required for EventBridge service-to-service routing. Inspector is unrelated to EventBridge rule matching.

  Amazon EventBridge - Rule event patterns and troubleshooting

• Question 203:

  A company needs to log and audit any principal that publishes messages to Amazon Simple Notification Service (Amazon SNS) topics and Amazon Simple Queue Service (Amazon SQS) queues. The company wants to ensure that all communication with these services uses VPC endpoints.

  Which combination of solutions will meet these requirements? (Select TWO.)

  A. Use Amazon CloudWatch Logs to collect message content from Amazon SNS and Amazon SQS.Deliver logs to an Amazon S3 bucket for querying.
  B. Set up AWS CloudTrail. Enable tracking of data events for Amazon SNS and Amazon SQS. Deliver logs to an Amazon S3 bucket for querying.
  C. Create Amazon EventBridge rules to gather Amazon SNS and Amazon SQS events. Store the events in an Amazon S3 bucket.
  D. Configure VPC endpoints for Amazon SNS and Amazon SQS. Inspect the vpcEndpointId field in the AWS CloudTrail logs.
  E. Configure VPC endpoints for Amazon SNS and Amazon SQS. Inspect the vpcEndpoint field in the Amazon CloudWatch logs.
  B. Set up AWS CloudTrail. Enable tracking of data events for Amazon SNS and Amazon SQS. Deliver logs to an Amazon S3 bucket for querying.
  D. Configure VPC endpoints for Amazon SNS and Amazon SQS. Inspect the vpcEndpointId field in the AWS CloudTrail logs.

  ---

  Explanation

  To meet the requirement to log and audit any principal that publishes to SNS topics and interacts with SQS queues, the correct service is AWS CloudTrail, because CloudTrail records API activity (who did what, when, and from where). Enabling data events (where supported/required for deeper visibility) provides detailed records for operations such as publishing messages and sending/receiving messages. Delivering CloudTrail logs to Amazon S3 provides durable retention and supports querying workflows.

  To ensure that communication uses VPC endpoints, the company should configure VPC endpoints for SNS and SQS and then validate usage by inspecting CloudTrail event records. CloudTrail includes endpoint- related context fields (for example, a VPC endpoint identifier) that allow auditors to confirm that the request path used a VPC endpoint rather than traversing the public internet. This directly addresses the "must use VPC endpoints" control with auditable evidence.

  The other options do not satisfy both requirements. CloudWatch Logs does not automatically capture SNS /SQS API caller identity for publish/send/receive operations in the same authoritative way CloudTrail does. EventBridge can capture service events but is not the primary audit log of API calls and does not inherently prove VPC endpoint usage per request. Inspecting a VPC endpoint field in CloudWatch Logs is not the standard audit mechanism for these API calls.

• Question 204:

  An application runs on Amazon EC2 instances that are in an Auto Scaling group. A CloudOps engineer needs to implement a solution that provides a central storage location for errors that the application logs to disk. The solution must also provide an alert when the application logs an error.

  What should the CloudOps engineer do to meet these requirements?

  A. Deploy and configure the Amazon CloudWatch agent on the EC2 instances to log to a CloudWatch log group. Create a metric filter on the target CloudWatch log group. Create a CloudWatch alarm that publishes to an Amazon Simple Notification Service (Amazon SNS) topic that has an email subscription.
  B. Create a cron job on the EC2 instances to identify errors and push the errors to an Amazon CloudWatch metric filter. Configure the filter to publish to an Amazon Simple Notification Service (Amazon SNS) topic that has an SMS subscription.
  C. Deploy an AWS Lambda function that pushes the errors directly to Amazon CloudWatch Logs. Configure the Lambda function to run every time the log file is updated on disk.
  D. Create an Auto Scaling lifecycle hook that invokes an EC2-based script to identify errors. Configure the script to push the error messages to an Amazon CloudWatch log group when the EC2 instances scale in. Create a CloudWatch alarm that publishes to an Amazon Simple Notification Service (Amazon SNS) topic that has an email subscription when the number of error messages exceeds a threshold.
  A. Deploy and configure the Amazon CloudWatch agent on the EC2 instances to log to a CloudWatch log group. Create a metric filter on the target CloudWatch log group. Create a CloudWatch alarm that publishes to an Amazon Simple Notification Service (Amazon SNS) topic that has an email subscription.

  ---

  Explanation

  The AWS Cloud Operations and Monitoring documentation specifies that the Amazon CloudWatch Agent is the recommended tool for collecting system and application logs from EC2 instances. The agent pushes these logs into a centralized CloudWatch Logs group, providing durable storage and real-time monitoring. Once the logs are centralized, a CloudWatch Metric Filter can be configured to search for specific error keywords (for example, "ERROR" or "FAILURE"). This filter transforms matching log entries into custom metrics. From there, a CloudWatch Alarm can monitor the metric threshold and publish notifications to an Amazon SNS topic, which can send email or SMS alerts to subscribed recipients. This combination provides a fully automated, managed, and serverless solution for log aggregation and error alerting. It eliminates the need for manual cron jobs (Option B), custom scripts (Option D), or Lambda-based log streaming (Option C).

  AWS Cloud Operations & Monitoring Guide - Collecting Application Logs and Creating Alarms Using CloudWatch Agent, Metric Filters, and SNS Notifications

• Question 205:

  A CloudOps engineer must ensure that all AWS API calls across an organization are logged and stored centrally for compliance audits.

  Which solution should the engineer implement?

  A. Enable CloudTrail in each account individually.
  B. Create an organization trail in AWS CloudTrail.
  C. Enable VPC Flow Logs in all Regions.
  D. Use Amazon CloudWatch Logs Insights.
  B. Create an organization trail in AWS CloudTrail.

  ---

  Explanation

  An organization trail in AWS CloudTrail automatically logs API activity from all member accounts and delivers logs to a central S3 bucket.

  This approach ensures consistent coverage, simplified governance, and audit readiness. Options C and D do not capture API-level activity, and Option A is operationally inefficient.

  AWS CloudTrail - Organization Trails

• Question 206:

  A CloudOps engineer needs secure, keyless access to EC2 instances without opening inbound ports.

  Which solution meets this requirement?

  A. EC2 Instance Connect
  B. Systems Manager Session Manager
  C. Bastion hosts
  D. VPN access
  B. Systems Manager Session Manager

  ---

  Explanation

  Session Manager provides secure shell access over AWS APIs without SSH keys or inbound ports, with full audit logging.

  AWS Systems Manager - Session Manager

• Question 207:

  A CloudOps engineer uses AWS CloudTrail Lake to investigate an incident involving Amazon S3 data access. The engineer must identify which IAM role accessed a specific object and retrieve the request parameters used during the access.

  Which approach should the engineer use?

  A. Query S3 server access logs with Amazon Athena.
  B. Query CloudTrail Lake using SQL-like queries filtered by eventName and resource ARN.
  C. Review AWS Config configuration history for the S3 bucket.
  D. Use Amazon Macie findings for the object.
  B. Query CloudTrail Lake using SQL-like queries filtered by eventName and resource ARN.

  ---

  Explanation

  CloudTrail Lake stores immutable API event data and supports SQL-like queries that expose detailed request context, including IAM identity, eventName, requestParameters, and resource ARNs. S3 server access logs lack full IAM and API context. AWS Config tracks configuration changes, not object- level access. Macie focuses on data classification, not audit trails.

  AWS CloudTrail Lake - Querying API Activity

• Question 208:

  A CloudOps engineer must ensure that all of a company's current and future Amazon S3 buckets have logging enabled. If an S3 bucket does not have logging enabled, an automated process must enable logging for the S3 bucket.

  Which solution will meet these requirements?

  A. Use AWS Trusted Advisor to perform a check for S3 buckets that do not have logging enabled. Configure the check to enable logging for S3 buckets that do not have logging enabled.
  B. Configure an S3 bucket policy that requires all current and future S3 buckets to have logging enabled.
  C. Use the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that uses an AWS Lambda function to enable logging.
  D. Use the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that uses the AWS-ConfigureS3BucketLogging AWS Systems Manager Automation runbook.
  D. Use the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that uses the AWS-ConfigureS3BucketLogging AWS Systems Manager Automation runbook.

  ---

  Explanation

  AWS Config is designed to continuously evaluate AWS resource configurations and detect noncompliance. The s3-bucket-logging-enabled managed rule specifically checks whether server access logging is enabled on S3 buckets. This directly meets the detection requirement for both current and future buckets.

  To satisfy the remediation requirement, AWS Config supports automatic remediation actions . Using the AWS-provided AWS-ConfigureS3BucketLogging Systems Manager Automation runbook enables logging without custom code. This reduces operational overhead, avoids Lambda function maintenance, and aligns with AWS best practices.

  Option A is incorrect because Trusted Advisor does not support automatic remediation. Option B cannot enforce logging at creation time through bucket policies alone. Option C works but introduces unnecessary Lambda maintenance compared to using an AWS-managed automation runbook.

  Thus, combining AWS Config managed rules with Systems Manager Automation provides continuous compliance with minimal operational effort.

• Question 209:

  A company runs a high performance computing (HPC) data-processing application on Amazon EC2 instances in one Availability Zone within a development environment. The application uses a dataset that the company stores on an Amazon S3 general purpose bucket in the same AWS Region as the EC2 instances.

  A SysOps administrator must improve the application's performance for retrieval of objects from Amazon S3.

  Which solution will meet these requirements?

  A. Enable S3 Transfer Acceleration for the S3 bucket. Create an S3 access point for the bucket. Update the application to use the access point.
  B. Create an S3 Lifecycle configuration for the S3 bucket to move all objects to the S3 Express One Zone storage class. Update the application to use an S3 Regional endpoint.
  C. Create a second general purpose S3 bucket in the same Region. Copy the objects from the original bucket to the new bucket. Use the S3 Express One Zone storage class to store the objects in the new bucket. Update the application to use an S3 Regional endpoint.
  D. Create an S3 directory bucket in the same Availability Zone. Import objects from the original bucket to the new bucket. Use the S3 Express One Zone storage class to store the objects in the new bucket. Update the application to use an S3 Zonal endpoint.
  D. Create an S3 directory bucket in the same Availability Zone. Import objects from the original bucket to the new bucket. Use the S3 Express One Zone storage class to store the objects in the new bucket. Update the application to use an S3 Zonal endpoint.

  ---

  Explanation

  The correct answer is D because Amazon S3 Express One Zone with directory buckets and zonal endpoints is specifically designed for single-Availability Zone, high-performance workloads such as HPC, machine learning, and analytics applications running on Amazon EC2. AWS CloudOps documentation states that S3 Express One Zone delivers single-digit millisecond latency and up to 10x higher request performance compared to general purpose S3 buckets when data is accessed from the same Availability Zone.

  An S3 directory bucket is required to use the S3 Express One Zone storage class. These buckets are explicitly associated with a single Availability Zone and use zonal endpoints, which eliminate cross-AZ network hops and significantly reduce latency. Importing the data from the existing general purpose bucket ensures compatibility while achieving maximum throughput and lowest latency.

  Option A is incorrect because S3 Transfer Acceleration is optimized for long-distance, internet-based transfers, not for in-Region HPC workloads. Option B is incorrect because lifecycle policies cannot move objects into S3 Express One Zone, and S3 Express One Zone does not use Regional endpoints. Option C is incorrect because general purpose buckets do not support zonal endpoints and therefore cannot achieve the same performance benefits.

  AWS CloudOps performance optimization guidance clearly identifies S3 directory buckets with S3 Express One Zone and zonal endpoints as the optimal architecture for high-throughput, low-latency workloads in a single Availability Zone.

• Question 210:

  A SysOps administrator monitors and maintains the availability of resources in an AWS environment. The SysOps administrator notices that the CPU utilization of an Amazon EC2 instance that runs web server software peaks above 80% at various times during each day. The CPU spikes correlate with peak daily loads. The high CPU load has resulted in performance issues for customers.

  The SysOps administrator needs to resolve the system performance issue without causing any service disruptions.

  Which solution will meet these requirements?

  A. Configure an Amazon CloudWatch alarm that invokes an AWS Systems Manager Automation runbook to vertically scale the EC2 instance when the CPU utilization exceeds 80%.
  B. Configure an AWS Systems Manager Automation runbook to run a script that automatically restarts the application when CPU utilization exceeds 80%.
  C. Configure an Amazon EventBridge rule that invokes an AWS Systems Manager Automation document. Configure the document to increase the EC2 instance size when CPU utilization exceeds 80%.
  D. Set up an Auto Scaling group with an Amazon CloudWatch alarm that triggers a scaling policy to launch additional EC2 instances when the CPU utilization exceeds 80%.
  D. Set up an Auto Scaling group with an Amazon CloudWatch alarm that triggers a scaling policy to launch additional EC2 instances when the CPU utilization exceeds 80%.

  ---

  Explanation

  The requirement is to fix performance degradation from predictable peak CPU load without service disruptions. The most reliable and operationally standard approach is horizontal scaling with an Auto Scaling group driven by CloudWatch metrics/alarms (or target tracking). Launching additional instances and distributing traffic (typically behind a load balancer) increases capacity while keeping existing instances serving requests--no reboot or stop/start required.

  Option D meets the requirement because Auto Scaling can add capacity when CPU exceeds a threshold and remove capacity when demand falls. This improves performance during peak periods and maintains availability. It is also operationally efficient: scaling actions are automated, consistent, and can be tuned with cooldowns/health checks.

  Options A and C describe vertical scaling (instance resize). Resizing an EC2 instance type generally requires stopping the instance, changing the type, and starting it again--this is disruptive for a single- instance web server and often causes downtime. Option B (restarting the application) directly introduces disruption and does not address underlying capacity constraints; it can also worsen customer impact during peaks.