Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 241:

  A company uses multiple Amazon RDS databases to support an application. The application receives all its traffic during weekdays and is idle during weekends. The company wants a solution to automatically manage the RDS DB instances during idle periods to optimize costs.

  Which solution will meet these requirements?

  A. Use a cron job to automatically scale down the RDS DB instance type during weekends.
  B. Configure Instance Scheduler on AWS to stop the RDS DB instances at the beginning of each weekend and to start the instances at the end of each weekend.
  C. Purchase Reserved Instances for the RDS DB instances.
  D. Use the auto scaling feature of Amazon RDS to automatically adjust the DB instance type based on CPU utilization.
  B. Configure Instance Scheduler on AWS to stop the RDS DB instances at the beginning of each weekend and to start the instances at the end of each weekend.

  ---

  Explanation

  The Instance Scheduler on AWS is an AWS-provided solution designed specifically to start and stop AWS resources such as Amazon RDS instances on a defined schedule. This directly aligns with the requirement to automatically manage RDS instances during predictable idle periods, such as weekends, to reduce costs.

  RDS instances incur compute charges while running, even if idle. Stopping them during weekends eliminates those charges while retaining storage and backups. Instance Scheduler supports tag-based scheduling, centralized management, and automated start/stop workflows without custom scripting.

  Option A introduces custom automation and ongoing maintenance overhead. Option C (Reserved Instances) is unsuitable because the databases are idle for long, predictable periods and Reserved Instances charge regardless of usage.

  Option D is incorrect because RDS does not support auto scaling of DB instance classes based on utilization.

  Instance Scheduler is the most cost-effective and operationally efficient solution for this use case.

• Question 242:

  A company must ensure that any new IAM policy granting public access to resources is detected quickly and investigated. The CloudOps engineer needs near real-time visibility into policy changes and the identity that made the change.

  Which solution will meet these requirements?

  A. Enable AWS CloudTrail and monitor IAM policy-related API calls; send notifications when specific events occur.
  B. Use VPC Flow Logs to detect policy changes.
  C. Enable Amazon Inspector to scan IAM policies continuously.
  D. Use EC2 instance recovery to restore prior IAM state.
  A. Enable AWS CloudTrail and monitor IAM policy-related API calls; send notifications when specific events occur.

  ---

  Explanation

  CloudTrail records IAM control-plane API activity, including who made a change (user/role/session), when it occurred, and the request parameters. By monitoring relevant IAM API calls (for example, Put*Policy, CreatePolicyVersion, AttachRolePolicy) and sending notifications when changes meet defined criteria, the CloudOps engineer can quickly detect risky permission changes and preserve an authoritative audit trail for investigations.

  VPC Flow Logs cannot see IAM API calls. Inspector does not evaluate IAM policies as its primary function. Instance recovery is unrelated to IAM configuration management.

  AWS CloudTrail - Monitoring IAM policy changes and alerting

• Question 243:

  An AWS CloudFormation template creates an Amazon RDS instance. This template is used to build up development environments as needed and then delete the stack when the environment is no longer required. The RDS-persisted data must be retained for further use, even after the CloudFormation stack is deleted.

  How can this be achieved in a reliable and efficient way?

  A. Write a script to continue backing up the RDS instance every five minutes.
  B. Create an AWS Lambda function to take a snapshot of the RDS instance, and manually invoke the function before deleting the stack.
  C. Use the Snapshot Deletion Policy in the CloudFormation template definition of the RDS instance.
  D. Create a new CloudFormation template to perform backups of the RDS instance, and run this template before deleting the stack.
  C. Use the Snapshot Deletion Policy in the CloudFormation template definition of the RDS instance.

  ---

  Explanation

  Comprehensive and Detailed From Exact Extract of AWS CloudOps Doocuments: AWS CloudFormation supports the DeletionPolicy attribute to control what happens to a resource when a stack is deleted. For Amazon RDS DB instances, setting

  DeletionPolicy: Snapshot instructs CloudFormation to retain a final DB snapshot automatically at stack deletion. CloudOps best practice recommends using this native mechanism for data retention and auditability, avoiding manual scripts or out-of-band processes. Options A, B, and D introduce operational overhead and potential human error. With DeletionPolicy set to Snapshot, the environment can be repeatedly created and torn down while preserving data states for later restoration with minimal manual steps. This aligns with IaC principles-, reliable declarative repeatable, and -and supports efficient lifecycle management of ephemeral development stacks.

  References (AWS CloudOps Documents / Study Guide): AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Deployment, Provisioning and Automation AWS CloudFormation User Guide - DeletionPolicy Attribute (Snapshot for RDS) AWS Well-Architected Framework - Operational Excellence Pillar

• Question 244:

  A company uses memory-optimized Amazon EC2 instances behind a Network Load Balancer (NLB) to run an application. The company launched the EC2 instances from an AWS-provided Red Hat Enterprise Linux (RHEL) AMI.

  A CloudOps engineer must monitor RAM utilization in 5-minute intervals. The CloudOps engineer must ensure that the EC2 instances scale in and out appropriately based on incoming load.

  Which solution will meet these requirements?

  A. Configure detailed monitoring for the EC2 instances. Configure the Amazon CloudWatch agent on the EC2 instances. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_active metric.
  B. Configure detailed monitoring for the EC2 instances. Use the mem_used_percent metric that the detailed monitoring feature provides. Create an IAM role that allows the CloudWatch agent to upload data. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.
  C. Configure basic monitoring for the EC2 instances. Configure the Amazon CloudWatch agent on the EC2 instances. Create an IAM role that allows the CloudWatch agent to upload data. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.
  D. Configure basic monitoring for the EC2 instances. Use the standard mem_used_percent metric for monitoring. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.
  C. Configure basic monitoring for the EC2 instances. Configure the Amazon CloudWatch agent on the EC2 instances. Create an IAM role that allows the CloudWatch agent to upload data. Create an EC2 Auto Scaling group and Auto Scaling policy that is based on the mem_used_percent metric.

  ---

  Explanation

  EC2 does not publish RAM utilization as a native CloudWatch metric by default. Memory metrics such as mem_used_percent are typically collected by the CloudWatch Agent, which runs on the instance and publishes custom metrics to CloudWatch. Because the requirement is RAM utilization at 5-minute intervals, the CloudWatch Agent can be configured to emit metrics at that cadence (or faster).

  "Detailed monitoring" for EC2 mainly affects EC2-provided metrics (like CPU) by changing the period from 5 minutes (basic) to 1 minute (detailed). It does not magically provide memory utilization. Therefore, the key requirement is installing/ configuring the CloudWatch Agent and ensuring it has permissions to publish metrics (via an IAM role attached to the instance / instance profile).

  Option C correctly combines: (1) basic monitoring (fine for the ask), (2) CloudWatch Agent to publish mem_used_percent , (3) IAM role permissions to allow publishing, and (4) Auto Scaling policy that scales based on the memory metric.

  Option B incorrectly implies detailed monitoring provides mem_used_percent (it does not). Option D assumes a "standard" memory metric exists without the agent, which is not correct. Option A references mem_active , which is not the typical metric name exposed by CloudWatch Agent's standard memory measurements for scaling policies, and also omits the IAM role requirement needed for publishing custom metrics.

  Thus, C is the AWS-correct path for memory-based scaling using CloudWatch custom metrics.

• Question 245:

  A CloudOps engineer wants to provide access to AWS services by attaching an IAM policy to multiple IAM users. The CloudOps engineer also wants to be able to change the policy and create new versions.

  Which combination of actions will meet these requirements? (Select TWO.)

  A. Add the users to an IAM service-linked role. Attach the policy to the role.
  B. Add the users to an IAM user group. Attach the policy to the group.
  C. Create an AWS managed policy.
  D. Create a customer managed policy.
  E. Create an inline policy.
  B. Add the users to an IAM user group. Attach the policy to the group.
  D. Create a customer managed policy.

  ---

  Explanation

  IAM user groups allow permissions to be managed centrally and applied to multiple users simultaneously, making them ideal for scalable access management. Attaching policies to groups ensures that changes propagate automatically to all members.

  A customer managed policy supports versioning, reuse, and centralized updates, which meets the requirement to modify policies and manage versions over time. AWS managed policies cannot be edited, and inline policies do not support reuse or versioning across multiple principals. Option A is invalid because service-linked roles are AWS-managed and not designed for user access. Option E lacks versioning and reusability. Option C does not allow customization.

  Therefore, using IAM groups with a customer managed policy is the correct and secure solution.

• Question 246:

  A company uses an Amazon Simple Queue Service (Amazon SQS) queue and Amazon EC2 instances in an Auto Scaling group with target tracking for a web application.

  The company collects the ASGAverageNetworkIn metric but notices that instances do not scale fast enough during peak traffic. There are a large number of SQS messages accumulating in the queue.

  A CloudOps engineer must reduce the number of SQS messages during peak periods.

  Which solution will meet this requirement?

  A. Define and use a new custom Amazon CloudWatch metric based on the SQS ApproximateNumberOfMessagesDelayed metric in the target tracking policy.
  B. Define and use Amazon CloudWatch metric math to calculate the SQS queue backlog for each instance in the target tracking policy.
  C. Define and use step scaling by specifying a ChangeInCapacity value for the EC2 instances.
  D. Define and use simple scaling by specifying a ChangeInCapacity value for the EC2 instances.
  B. Define and use Amazon CloudWatch metric math to calculate the SQS queue backlog for each instance in the target tracking policy.

  ---

  Explanation

  AWS Cloud Operations and Auto Scaling documentation, scaling applications that consume Amazon SQS messages should be driven by queue backlog per instance, not by general system metrics such as network traffic or CPU.

  The correct approach is to calculate a custom metric using CloudWatch metric math that divides the SQS metric ApproximateNumberOfMessagesVisible by the number of active EC2 instances in the Auto Scaling group. This "backlog per instance" value represents the average number of messages waiting to be processed by each instance.

  Then, the CloudOps engineer can create a target tracking policy that automatically scales out or in based on maintaining a desired backlog threshold. This approach ensures dynamic, workload-driven scaling behavior that reacts in near real time to message volume. Step and simple scaling (Options C and D) require manual thresholds and do not automatically balance the load per instance.

  Thus, Option B-using CloudWatch metric math to define queue backlog per instance for target tracking-is the most effective and AWS-recommended CloudOps practice.

  AWS Cloud Operations & Scaling Guide - Scaling Based on Amazon SQS Queue Backlog Per Instance

• Question 247:

  A company runs an Amazon RDS for PostgreSQL DB instance. The company requires automatic failover to maintain write availability during infrastructure failures, with minimal application changes.

  Which solution will meet these requirements?

  A. Create a read replica and promote it manually when needed.
  B. Enable Multi-AZ deployment for the DB instance.
  C. Export the database to Amazon S3 every hour.
  D. Use an Auto Scaling group to run two RDS instances in parallel.
  B. Enable Multi-AZ deployment for the DB instance.

  ---

  Explanation

  RDS Multi-AZ deployments provide synchronous replication to a standby instance in a different Availability Zone and automatic failover. The application typically continues to use the same DB endpoint, which minimizes application changes. This directly satisfies the requirement for write availability and automated failover.

  Read replicas are asynchronous and do not provide automatic failover for writes (promotion is a manual or separate process and can introduce data lag). Exports to S3 are not high-availability mechanisms. Auto Scaling groups do not manage RDS instances as if they were EC2 capacity.

  Amazon RDS - Multi-AZ deployments and automated failover

• Question 248:

  A web application runs on Amazon EC2 instances in the us-east-1 Region and the us-west-2 Region. The instances run behind an Application Load Balancer (ALB) in each Region. An Amazon Route 53 hosted zone controls DNS records.

  The instances in us-east-1 are production resources. The instances in us-west-2 are for disaster recovery. EC2 Auto Scaling groups are configured based on the ALBRequestCountPerTarget metric in both Regions.

  A SysOps administrator must implement a solution that provides failover from us-east-1 to us-west-2. The instances in us-west-2 must be used only for failover.

  Which solution will meet these requirements?

  A. Implement a Route 53 health check and a failover routing policy for the hosted zone. Configure the failover routing policy to automatically redirect traffic to the resources in us-west-2.
  B. Implement a Route 53 health check and a latency routing policy for the hosted zone. Configure the latency routing policy to automatically redirect traffic to the resources in us-west-2.
  C. In us-east-1, create an Amazon CloudWatch alarm that enters ALARM state when an EC2 instance is terminated. In us-west-2, create an AWS Lambda function that modifies the Route 53 hosted zone records to send traffic to us-west-2. Configure the CloudWatch alarm to invoke the Lambda function.
  D. In us-west-2, create an Amazon CloudWatch alarm that enters ALARM state when resources in us- east- 1 cannot be resolved. In us-west-2, create an AWS Lambda function that modifies the Route 53 hosted zone records to send traffic to us-west-2. Configure the CloudWatch alarm to invoke the Lambda function.
  A. Implement a Route 53 health check and a failover routing policy for the hosted zone. Configure the failover routing policy to automatically redirect traffic to the resources in us-west-2.

  ---

  Explanation

  The requirement is classic active-passive (production in us-east-1, DR in us-west-2 "only for failover"). The most operationally efficient and purpose-built solution is Route 53 failover routing combined with health checks. With failover routing, Route 53 designates one record as PRIMARY (us-east-1) and another as SECONDARY (us-west-2). Route 53 continuously evaluates the health check associated with the primary endpoint (commonly the ALB DNS name or a specific health- check path). If the primary fails, Route 53 automatically returns the secondary record, directing client DNS resolution to the DR region. This ensures us- west-2 is used only when us-east-1 is unhealthy, directly matching the requirement.

  Latency routing (Option B) is designed to route users to the region with the lowest latency, which can actively send traffic to us-west-2 even when us-east-1 is healthy--violating the "DR only" constraint. Options C and D introduce custom automation (CloudWatch + Lambda + DNS record updates) that increases operational overhead, adds failure modes, and is unnecessary because Route 53 already provides managed health-check- based failover. Additionally, "EC2 instance terminated" is not a reliable proxy for full application availability, and DNS modification automation is more complex than using native Route 53 failover policies.

• Question 249:

  A CloudOps engineer wants to ensure EC2 instances can be accessed securely without SSH keys or inbound ports, while maintaining full auditability.

  Which solution is MOST appropriate?

  A. Bastion hosts
  B. EC2 Instance Connect
  C. Systems Manager Session Manager
  D. Client VPN
  C. Systems Manager Session Manager

  ---

  Explanation

  Session Manager provides keyless, port-less access with full CloudTrail and CloudWatch logging, aligning with AWS security best practices.

  AWS Systems Manager - Session Manager

• Question 250:

  A company plans to migrate several of its high-performance computing (HPC) virtual machines to Amazon EC2. The deployment must minimize network latency and maximize network throughput between the instances.

  Which placement group strategy should the CloudOps engineer choose?

  A. Deploy the instances in a cluster placement group in one Availability Zone.
  B. Deploy the instances in a partition placement group in two Availability Zones.
  C. Deploy the instances in a partition placement group in one Availability Zone.
  D. Deploy the instances in a spread placement group in two Availability Zones.
  A. Deploy the instances in a cluster placement group in one Availability Zone.

  ---

  Explanation

  Cluster placement groups are specifically designed for workloads that require extremely low latency and high network throughput, such as HPC applications. Instances are placed physically close together within the same Availability Zone, enabling high-bandwidth, low-latency networking.

  Partition placement groups are optimized for fault isolation, not network performance. Spread placement groups prioritize availability by distributing instances across distinct hardware, which increases latency.

  Because the requirement is performance rather than fault isolation or high availability, a cluster placement group is the optimal choice.