Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 231:

  A CloudOps engineer is troubleshooting an AWS CloudFormation stack creation that failed. Before the CloudOps engineer can identify the problem, the stack and its resources are deleted. For future deployments, the CloudOps engineer must preserve any resources that CloudFormation successfully created.

  What should the CloudOps engineer do to meet this requirement?

  A. Set the value of the DisableRollback parameter to False during stack creation.
  B. Set the value of the OnFailure parameter to DO_NOTHING during stack creation.
  C. Specify a rollback configuration that has a rollback trigger of DO_NOTHING during stack creation.
  D. Set the value of the OnFailure parameter to ROLLBACK during stack creation.
  B. Set the value of the OnFailure parameter to DO_NOTHING during stack creation.

  ---

  Explanation

  By default, when AWS CloudFormation encounters a failure during stack creation, it automatically rolls back and deletes any resources that were successfully created. This behavior makes troubleshooting difficult because the failed and partially created resources are no longer available for inspection.

  CloudFormation provides the OnFailure parameter to control this behavior. Setting the parameter to DO_NOTHING instructs CloudFormation to stop stack creation when a failure occurs and retain all successfully created resources . This allows the CloudOps engineer to inspect the environment, review logs, and identify the root cause without redeploying resources.

  The DisableRollback parameter controls rollback behavior but does not provide the same explicit behavior control during failure scenarios. Rollback triggers are used for monitoring-based rollback, not for preserving resources on failure.

  Setting OnFailure to ROLLBACK explicitly enforces deletion, which is the opposite of the requirement.

  Therefore, setting the OnFailure parameter to DO_NOTHING is the correct solution.

• Question 232:

  A company is migrating its production file server to AWS. All data stored on the file server must remain accessible if an Availability Zone becomes unavailable or during system maintenance. Users must access the file server through the SMB protocol and manage permissions by using Windows ACLs.

  Which solution will meet these requirements?

  A. Create a single AWS Storage Gateway file gateway.
  B. Create an Amazon FSx for Windows File Server Multi-AZ file system.
  C. Deploy two AWS Storage Gateway file gateways in two Availability Zones behind an Application Load Balancer.
  D. Deploy two Amazon FSx for Windows File Server Single-AZ file systems and configure DFS Replication.
  B. Create an Amazon FSx for Windows File Server Multi-AZ file system.

  ---

  Explanation

  Amazon FSx for Windows File Server is a fully managed native Windows file system that supports SMB, Windows authentication, and Windows ACLs. The Multi-AZ deployment option automatically replicates data synchronously across Availability Zones and provides automatic failover with minimal downtime.

  This architecture ensures continuous availability during AZ failures or maintenance events without manual intervention. Users experience consistent access and permissions through SMB, fully meeting the stated requirements.

  Storage Gateway introduces on-premises dependencies. DFS Replication increases complexity and recovery time. Therefore, FSx for Windows Multi-AZ is the correct solution.

• Question 233:

  A CloudOps engineer wants to share a copy of a production database with a migration account. The production database is hosted on an Amazon RDS DB instance and is encrypted at rest with an AWS Key Management Service (AWS KMS) key that has an alias of production-rds-key.

  What must the CloudOps engineer do to meet these requirements with the LEAST administrative overhead?

  A. Take a snapshot of the RDS DB instance. Update the KMS key policy to allow access for the migration account root user. Share the snapshot with the migration account.
  B. Create an RDS read replica in the migration account. Replicate the KMS key.
  C. Take a snapshot and create a new KMS key in the migration account with the same alias.
  D. Export the database to Amazon S3 and import it into a new RDS instance.
  A. Take a snapshot of the RDS DB instance. Update the KMS key policy to allow access for the migration account root user. Share the snapshot with the migration account.

  ---

  Explanation

  For encrypted RDS snapshots, cross-account sharing requires both sharing the snapshot and granting access to the KMS key used to encrypt it. By updating the KMS key policy to allow the migration account access, the encrypted snapshot can be restored in the migration account.

  Option A uses native RDS snapshot sharing and minimal configuration changes, making it the least administrative overhead approach.

  Options B, C, and D introduce unnecessary complexity, higher operational cost, or unsupported workflows.

• Question 234:

  A company runs a retail website on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The company must secure traffic to the website over an HTTPS connection.

  Which combination of actions should a SysOps administrator take to meet these requirements? (Select TWO.)

  A. Attach the certificate to each EC2 instance.
  B. Attach the certificate to the ALB.
  C. Create a private certificate in AWS Certificate Manager (ACM).
  D. Create a public certificate in AWS Certificate Manager (ACM).
  E. Export the certificate, and attach it to the website.
  B. Attach the certificate to the ALB.
  D. Create a public certificate in AWS Certificate Manager (ACM).

  ---

  Explanation

  To secure inbound web traffic over HTTPS when using an Application Load Balancer, AWS CloudOps best practices recommend terminating TLS at the load balancer. This is achieved by attaching an SSL/TLS certificate directly to the ALB listener. Therefore, option B is required. By terminating HTTPS at the ALB, traffic between clients and the load balancer is encrypted, and the ALB can then forward traffic to backend EC2 instances using HTTP or HTTPS based on design requirements.

  The certificate used for a public-facing retail website must be trusted by internet browsers. AWS Certificate Manager (ACM) public certificates are specifically designed for this purpose and are trusted by common browsers and operating systems. Therefore, option D is required. ACM manages certificate provisioning, renewal, and deployment automatically, which significantly reduces operational overhead.

  Option A is incorrect because attaching certificates to each EC2 instance is unnecessary and does not scale well. Option C is incorrect because private certificates are intended for internal use cases and are not trusted by public browsers. Option E is incorrect because ACM-managed public certificates cannot be exported; they must be attached directly to supported AWS services such as ALBs.

  This approach aligns with AWS CloudOps guidance for secure, scalable, and highly available HTTPS architectures.

• Question 235:

  A company wants to reduce CloudWatch Logs storage costs while keeping logs searchable for 14 days.

  Which action is MOST cost-effective?

  A. Export logs to S3 and delete immediately
  B. Set log group retention to 14 days
  C. Stream logs to OpenSearch
  D. Archive logs with AWS Backup
  B. Set log group retention to 14 days

  ---

  Explanation

  Retention policies automatically delete old logs, reducing storage cost while preserving searchability during the required window.

  Amazon CloudWatch Logs - Retention

• Question 236:

  A CloudOps engineer is creating a simple, public-facing website running on Amazon EC2. The CloudOps engineer created the EC2 instance in an existing public subnet and assigned an Elastic IP address.

  The CloudOps engineer created a new security group that allows incoming HTTP traffic from 0.0.0.0/0. The CloudOps engineer also created a new network ACL and applied it to the subnet to allow incoming HTTP traffic from 0.0.0.0/0. However, the website cannot be reached from the internet.

  What is the cause of this issue?

  A. The CloudOps engineer did not create an outbound rule that allows ephemeral port return traffic in the new network ACL.
  B. The CloudOps engineer did not create an outbound rule in the security group that allows HTTP traffic from port 80.
  C. The Elastic IP address assigned to the EC2 instance has changed.
  D. There is an additional network ACL associated with the subnet that denies inbound HTTP traffic.
  A. The CloudOps engineer did not create an outbound rule that allows ephemeral port return traffic in the new network ACL.

  ---

  Explanation

  Network ACLs are stateless, meaning both inbound and outbound rules must explicitly allow traffic. While inbound HTTP traffic (port 80) was allowed, the return traffic from the EC2 instance uses ephemeral ports (typically 1024-65535). If outbound rules do not allow this ephemeral port range, the response traffic is dropped, preventing the website from loading.

  Security groups are stateful and automatically allow return traffic, but network ACLs do not. This commonly causes connectivity issues when custom ACLs are applied without matching outbound rules.

  Option B is incorrect because security groups allow all outbound traffic by default. Option C is irrelevant. Option D is incorrect because only one network ACL can be associated with a subnet at a time. Thus, the missing outbound ephemeral port rule in the network ACL is the root cause.

• Question 237:

  A company runs custom statistical analysis software on a cluster of Amazon EC2 instances. The software is highly sensitive to network latency between nodes, although network throughput is not a limitation.

  Which solution will minimize network latency?

  A. Place all the EC2 instances into a cluster placement group.
  B. Configure and assign two Elastic IP addresses for each EC2 instance.
  C. Configure jumbo frames on all the EC2 instances in the cluster.
  D. Place all the EC2 instances into a spread placement group in the same AWS Region.
  A. Place all the EC2 instances into a cluster placement group.

  ---

  Explanation

  The AWS Cloud Operations and Compute documentation explains that control how placement groups EC2 instances are physically arranged within AWS data centers to optimize network performance.

  Among the available placement strategies: Cluster placement groups place instances physically close together within a single Availability Zone, connected through high-bandwidth, low-latency networking (ideal for tightly coupled, HPC, or distributed workloads).

  Spread placement groups distribute instances across distinct racks or Availability Zones for fault tolerance, increasing latency.

  Partition placement groups separate instances into partitions for isolation, not latency reduction. Therefore, to minimize latency for workloads such as computational clusters, the CloudOps engineer should use a cluster placement group. This placement ensures single-digit microsecond latency and enhanced packet rate performance between instances.

  Elastic IPs (Option B) do not influence internal networking. Jumbo frames (Option C) can marginally improve throughput but do not reduce propagation latency. Spread placement (Option D) increases distance, worsening latency.

  Hence, Option A - using a cluster placement group - delivers the lowest possible network latency and is AWS's best-practice design for HPC-style clusters.

  AWS Cloud Operations & Compute Optimization Guide - Optimizing EC2 Networking with Cluster Placement Groups for Low Latency Workloads

• Question 238:

  A CloudOps engineer is maintaining a web application that uses an Amazon CloudFront web distribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All services have logging enabled. The CloudOps engineer needs to investigate HTTP Layer 7 status codes from the web application.

  Which log sources contain the status codes? (Select TWO.)

  A. VPC Flow Logs
  B. AWS CloudTrail logs
  C. ALB access logs
  D. CloudFront access logs
  E. RDS logs
  C. ALB access logs
  D. CloudFront access logs

  ---

  Explanation

  Layer 7 (application-layer) HTTP status codes such as 200, 404, and 500 are generated by web-facing services that process HTTP requests. In this architecture, both CloudFront and the Application Load Balancer (ALB) operate at Layer 7 and record HTTP response information in their access logs.

  ALB access logs include detailed request and response data such as client IP address, request path, target response status code, and latency. These logs are essential for analyzing how backend EC2 instances respond to client requests.

  CloudFront access logs record viewer requests and responses at the edge locations. These logs also include HTTP status codes returned to the client, making them critical for understanding end-user experience and edge-level behavior.

  VPC Flow Logs capture network-level (Layer 3 and 4) traffic metadata such as source IP, destination IP, ports, and protocol. They do not contain HTTP status codes. AWS CloudTrail logs API calls to AWS services and does not capture application response codes. RDS logs contain database-related information, not HTTP responses.

  Therefore, the correct sources for HTTP Layer 7 status codes are ALB access logs and CloudFront access logs.

• Question 239:

  A company's ecommerce application is running on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. Customers report that the website is occasionally down. When the website is down, it returns an HTTP 500 (server error) status code to customer browsers.

  The Auto Scaling group's health check is configured for EC2 status checks, and the instances appear healthy.

  Which solution will resolve the problem?

  A. Replace the ALB with a Network Load Balancer.
  B. Add Elastic Load Balancing (ELB) health checks to the Auto Scaling group.
  C. Update the target group configuration on the ALB. Enable session affinity (sticky sessions).
  D. Install the Amazon CloudWatch agent on all instances. Configure the agent to reboot the instances.
  B. Add Elastic Load Balancing (ELB) health checks to the Auto Scaling group.

  ---

  Explanation

  In this scenario, the EC2 instances pass their EC2 status checks, indicating that the operating system is responsive. However, the application hosted on the instance is failing intermittently, returning HTTP 500 errors. This demonstrates a discrepancy between the instance-level health and the application-level health.

  AWS CloudOps best practices under Monitoring, Logging, Analysis, Remediation and Performance Optimization (SOA-C03 Domain 1), Auto Scaling groups should incorporate Elastic Load Balancing (ELB) health checks instead of relying solely on EC2 status checks. The ELB health check probes the application endpoint (for example, HTTP or HTTPS target group health checks), ensuring that the application itself is functioning correctly.

  When an instance fails an ELB health check, Amazon EC2 Auto Scaling will automatically mark the instance as unhealthy and replace it with a new one, ensuring continuous availability and performance optimization.

  Extract from AWS CloudOps (SOA-C03) Study Guide - Domain 1: "Implement monitoring and health checks using ALB and EC2 Auto Scaling integration. Application Load Balancer health checks allow Auto Scaling to terminate and replace instances that fail application-level health checks, ensuring consistent application performance." Extract from AWS Auto Scaling Documentation: "When you enable the ELB health check type for your Auto Scaling group, Amazon EC2 Auto Scaling considers both EC2 status checks and Elastic Load Balancing health checks to determine instance health. If an instance fails the ELB health check, it is automatically replaced." Therefore, the correct answer is B, as it ensures proper application-level monitoring and remediation using ALB-integrated ELB health checks-a core CloudOps operational practice for proactive incident response and availability assurance.

  References (AWS CloudOps Verified Source Extracts):

  AWS Certified CloudOps Engineer -

  Associate (SOA-C03) Exam Guide: Domain 1 - Monitoring, Logging, and Remediation.

  AWS Auto Scaling User Guide: Health checks for Auto Scaling instances (Elastic Load Balancing integration).

  AWS Well-Architected Framework - Operational Excellence and Reliability Pillars. AWS Elastic Load Balancing Developer Guide - Target group health checks and monitoring.

• Question 240:

  A CloudOps engineer must enforce that workloads can be deployed only in approved AWS Regions across an AWS Organization. The solution must prevent noncompliant deployments, not just detect them.

  Which solution will meet these requirements?

  A. Use AWS Config to detect resources created in unapproved Regions.
  B. Use an SCP to deny actions in unapproved Regions across all accounts.
  C. Use CloudWatch dashboards to report on Regions used.
  D. Use Amazon Inspector to block resources in unapproved Regions.
  B. Use an SCP to deny actions in unapproved Regions across all accounts.

  ---

  Explanation

  Service Control Policies provide preventive guardrails across an organization. By denying key service actions in unapproved Regions (commonly using condition keys that evaluate requested Region), the organization can block noncompliant deployments before they occur, including actions performed by highly privileged identities in member accounts.

  AWS Config and dashboards are detective controls and do not prevent creation. Inspector does not enforce Region governance.

  AWS Organizations - SCPs for Region and service restrictions