Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 251:

  A company needs to ensure that production data is recoverable after accidental deletion. The workload uses Amazon EFS for shared storage. The CloudOps engineer wants a managed backup solution that supports centralized policies and restores.

  Which solution will meet these requirements?

  A. Use AWS Backup to create backup plans for EFS file systems and define retention policies.
  B. Enable S3 Cross-Region Replication for EFS.
  C. Take EBS snapshots of the EC2 instances that mount EFS.
  D. Enable Amazon Inspector to scan EFS and generate restore points.
  A. Use AWS Backup to create backup plans for EFS file systems and define retention policies.

  ---

  Explanation

  AWS Backup is the managed service for centrally configuring backup policies, scheduling, retention, and restore workflows across supported AWS services, including Amazon EFS. By creating backup plans, vaults, and lifecycle/retention policies, the CloudOps engineer can meet recoverability requirements with minimal operational overhead and consistent governance. Restores can be initiated through AWS Backup, and policies can be standardized across environments.

  S3 replication is not applicable to EFS. EBS snapshots capture block volumes attached to instances, not EFS file system state. Inspector does not provide backup/restore functionality.

  AWS Backup - Protecting Amazon EFS with backup plans and retention

• Question 252:

  A company has a microservice that runs on a set of Amazon EC2 instances. The EC2 instances run behind an Application Load Balancer (ALB).

  A CloudOps engineer must use Amazon Route 53 to create a record that maps the ALB URL to example.com.

  Which type of record will meet this requirement?

  A. An A record
  B. An AAAA record
  C. An alias record
  D. A CNAME record
  C. An alias record

  ---

  Explanation

  An alias record is the recommended Route 53 record type to map domain names (e.g., example.com) to AWS-managed resources such as an Application Load Balancer. Alias records are extension types of A or AAAA records that support AWS resources directly, providing automatic DNS integration and no additional query costs.

  AWS documentation states: "Use alias records to map your domain or subdomain to an AWS resource such as an Application Load Balancer, CloudFront distribution, or S3 website endpoint." A and AAAA records are used for static IP addresses, not load balancers. CNAME records cannot be used at the root domain (e.g., example.com). Thus, Option C is correct as it meets CloudOps networking best practices for scalable, managed DNS resolution to ALBs.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 5: Networking and Content Delivery Amazon Route 53 Developer Guide - Alias Records AWS Well-Architected Framework - Reliability and Performance Efficiency Pillars Elastic Load Balancing - Integrating with Route 53

• Question 253:

  A company runs applications on Amazon EC2 instances. Many of the instances are not patched. The company has a tagging policy. All the instances are tagged with details about the owners, application, and environment. AWS Systems Manager Agent (SSM Agent) is installed on all the instances.

  A SysOps administrator must implement a solution to automatically patch all existing and future instances that have "Prod" in the environment tag. The SysOps administrator plans to create a patch policy in Systems Manager Patch Manager.

  Which solution will meet the patching requirements with the LEAST operational overhead?

  A. Define targets of the patch policy by specifying node tags that match the company's tagging strategy.
  B. Configure an AWS Lambda function to scan for new instances and to add the instances to the targets of the patch policy.
  C. Create resource groups. Add the existing instances to the resource groups. Configure an AWS Lambda function to scan for new instances and to add the instances to the resource groups at regular intervals. Attach the resource groups to the patch policy.
  D. Create resource groups. Add the existing instances to the resource groups. Create an Amazon EventBridge rule that uses an appropriately defined filter to add new instances to the resource groups. Attach the resource groups to the patch policy.
  A. Define targets of the patch policy by specifying node tags that match the company's tagging strategy.

  ---

  Explanation

  The correct answer is A because AWS Systems Manager Patch Manager natively supports tag-based targeting, which automatically includes both existing and future instances that match specified tag criteria. AWS CloudOps documentation states that patch policies can target managed nodes by instance tags, allowing administrators to dynamically scope patching operations without additional automation.

  By defining the patch policy target as instances with an environment tag value of "Prod," Patch Manager automatically applies patch baselines to all matching instances. Any new EC2 instance launched with the same tag is included automatically, requiring no manual intervention or additional services. This approach delivers the least operational overhead while remaining fully scalable and compliant.

  Options B, C, and D are incorrect because they introduce unnecessary complexity by adding AWS Lambda functions, resource groups, or EventBridge rules. AWS CloudOps best practices emphasize using native Systems Manager capabilities whenever possible to reduce operational burden and failure points.

• Question 254:

  A company maintains a list of 75 approved Amazon Machine Images (AMIs) that can be used across an organization in AWS Organizations. The company's development team has been launching Amazon EC2 instances from unapproved AMIs.

  A SysOps administrator must prevent users from launching EC2 instances from unapproved AMIs.

  Which solution will meet this requirement?

  A. Add a tag to the approved AMIs. Create an IAM policy that includes a tag condition that allows users to launch EC2 instances from only the tagged AMIs.
  B. Create a service-linked role. Attach a policy that denies the ability to launch EC2 instances from a list of unapproved AMIs. Assign the role to users.
  C. Use AWS Config with an AWS Lambda function to check for EC2 instances that are launched from unapproved AMIs. Program the Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the SysOps administrator to terminate those EC2 instances.
  D. Use AWS Trusted Advisor to check for EC2 instances that are launched from unapproved AMIs. Configure Trusted Advisor to invoke an AWS Lambda function to terminate those EC2 instances.
  A. Add a tag to the approved AMIs. Create an IAM policy that includes a tag condition that allows users to launch EC2 instances from only the tagged AMIs.

  ---

  Explanation

  The requirement is preventative: stop users from launching from unapproved AMIs. The most scalable approach with 75 approved AMIs is to tag all approved AMIs (for example, ApprovedAMI=true) and enforce usage through an IAM policy condition that only allows ec2:RunInstances when the ec2:ImageId resource (the AMI) includes the required tag. This avoids maintaining long allow/deny lists of AMI IDs and supports continuous updates: as new approved AMIs are created, tagging them automatically brings them under the policy without policy rewrites.

  Option B is incorrect because service-linked roles are used by AWS services, not assigned to users for interactive authorization enforcement in this way. Option C and D are detective/remedial controls that act after instances are already launched, which does not satisfy "must prevent." They also increase operational overhead and risk disruptions.

• Question 255:

  A CloudOps engineer needs to ensure CloudFormation resources are created in a specific order because a custom resource must run only after an IAM role and an S3 bucket exist.

  Which CloudFormation mechanism should be used?

  A. Use Fn::If to delay resource creation.
  B. Use DependsOn to enforce resource creation order.
  C. Use an Auto Scaling lifecycle hook.
  D. Use a CloudWatch alarm to pause the stack.
  B. Use DependsOn to enforce resource creation order.

  ---

  Explanation

  CloudFormation creates resources in parallel when possible. When a custom resource requires other resources to exist first, DependsOn explicitly enforces creation order. This prevents timing-related failures (for example, a custom resource trying to assume a role or access a bucket that is not yet created).

  Fn::If controls conditional creation but does not guarantee sequencing when both resources are created. Auto Scaling lifecycle hooks are unrelated to CloudFormation resource ordering. CloudWatch alarms do not control stack execution order.

  AWS CloudFormation - Resource dependencies with DependsOn

• Question 256:

  A company wants to ensure that Amazon EC2 instances are automatically replaced if the underlying hardware fails.

  Which solution will meet this requirement with minimal operational effort?

  A. Enable EC2 instance recovery for the instances.
  B. Create a Lambda function to monitor instance status checks.
  C. Use AWS Backup to restore instances automatically.
  D. Enable termination protection on the instances.
  A. Enable EC2 instance recovery for the instances.

  ---

  Explanation

  EC2 instance recovery automatically restarts an instance on new hardware if a system status check fails, preserving instance metadata, private IPs, and EBS volumes. This is a managed, native solution that requires minimal configuration. Options B and C add unnecessary complexity, and termination protection does not provide recovery functionality.

  Amazon EC2 - Instance Recovery

• Question 257:

  A CloudOps engineer needs to track configuration changes to IAM policies over time.

  Which service provides this capability?

  A. AWS CloudTrail
  B. AWS Config
  C. Amazon Inspector
  D. AWS Security Hub
  B. AWS Config

  ---

  Explanation

  AWS Config records configuration history for IAM resources, enabling audit and drift analysis.

  AWS Config - IAM Resource Tracking

• Question 258:

  A CloudOps engineer is configuring an Amazon CloudFront distribution to use an SSL/TLS certificate. The CloudOps engineer must ensure automatic certificate renewal.

  Which combination of steps will meet this requirement? (Select TWO.)

  A. Use a certificate issued by AWS Certificate Manager (ACM).
  B. Use a certificate issued by a third-party certificate authority (CA).
  C. Configure CloudFront to automatically renew the certificate when the certificate expires.
  D. Configure email validation for the certificate.
  E. Configure DNS validation for the certificate.
  A. Use a certificate issued by AWS Certificate Manager (ACM).
  E. Configure DNS validation for the certificate.

  ---

  Explanation

  The AWS Cloud Operations and Security documentation specifies that for Amazon CloudFront, automatic certificate renewal is only supported for certificates issued by AWS Certificate Manager (ACM). When a certificate is managed by ACM and validated through DNS validation, ACM automatically renews the certificate before expiration without requiring manual intervention. Option A ensures that the certificate is issued and managed by ACM, enabling full integration with CloudFront. Option E (DNS validation) is essential for automation; AWS performs revalidation automatically as long as the DNS validation record remains in place. By contrast, email validation (Option D) requires manual user confirmation upon renewal, which prevents automatic renewals. Certificates issued by third-party certificate authorities (Option B) are manually managed and must be reimported into ACM after renewal. CloudFront does not have a direct feature (Option C) to renew certificates; it relies on ACM's lifecycle management. Thus, combining ACM-issued certificates (A) with DNS validation (E) ensures continuous, automated renewal with no downtime or human action required.

  AWS Cloud Operations and Security Best Practices - Section: Using AWS Certificate Manager with CloudFront for Automatic Certificate Renewal

• Question 259:

  A company's reporting job that previously ran in 15 minutes is now taking 1 hour . The application runs on Amazon EC2 and extracts data from an Amazon RDS for MySQL DB instance.

  CloudWatch metrics show high Read IOPS even when reports are not running. The CloudOps engineer must improve performance and availability.

  Which solution will meet these requirements?

  A. Configure Amazon ElastiCache and query it for reports.
  B. Deploy an RDS read replica and update the reporting job to query the reader endpoint.
  C. Create a CloudFront distribution with the RDS instance as the origin.
  D. Increase the size of the RDS instance.
  B. Deploy an RDS read replica and update the reporting job to query the reader endpoint.

  ---

  Explanation

  RDS read replicas offload read traffic from the primary database, improving performance and availability. By directing reporting queries to the reader endpoint, the primary instance is freed from heavy read workloads.

  ElastiCache is unsuitable for complex SQL reporting. CloudFront cannot front a database. Increasing instance size does not address inefficient read scaling.

  Thus, read replicas are the correct solution.

• Question 260:

  A SysOps administrator needs to give an existing AWS Lambda function access to an existing Amazon S3 bucket. Traffic between the Lambda function and the S3 bucket must not use public IP addresses. The Lambda function has been configured to run in a VPC.

  Which solution will meet these requirements?

  A. Configure VPC sharing between the Lambda VPC and the S3 bucket.
  B. Attach a transit gateway to the Lambda VPC to allow the Lambda function to connect to the S3 bucket.
  C. Create a NAT gateway. Associate the NAT gateway with the subnet where the Lambda function is configured to run.
  D. Create an S3 interface endpoint. Change the Lambda function to use the new S3 DNS name.
  D. Create an S3 interface endpoint. Change the Lambda function to use the new S3 DNS name.

  ---

  Explanation

  The requirement is that traffic from a VPC-connected Lambda to Amazon S3 must not use public IP addresses. The AWS-native way to keep traffic private is to use VPC endpoints, which provide private connectivity to supported AWS services without traversing the public internet. Among the options, creating an S3 VPC endpoint is the only approach that satisfies "no public IP addresses" while allowing access to the bucket. Option D is the best match because it explicitly configures an S3 endpoint and directs the Lambda function to use the endpoint-specific DNS name for private routing.

  Option C (NAT gateway) is incorrect for this requirement because NAT provides outbound internet access from private subnets and typically uses public IP addressing at the NAT gateway. That violates the intent to avoid public IP paths for S3 traffic. Option A is not applicable because S3 buckets are not placed "inside" a VPC and do not participate in VPC sharing in a way that provides private network paths. Option B (transit gateway) connects VPCs and on-prem networks, but it does not create private service connectivity to S3 by itself; you would still need the correct service endpoint solution for S3 access.

  Using a VPC endpoint also aligns with CloudOps best practices: it reduces exposure, simplifies network egress controls, and supports least-privilege access via endpoint policies (where applicable) alongside IAM policies.