Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 31:

  A CloudOps engineer needs to build an event infrastructure for custom application-specific events. The events must be sent to an AWS Lambda function for processing. The CloudOps engineer must record the events so they can be replayed later by event type or event time .

  Which solution will meet these requirements?

  A. Create an Amazon EventBridge custom event bus , create an archive , and create a rule to send events to Lambda.
  B. Create an archive on the default event bus and use pattern matching.
  C. Create an EventBridge pipe and store events in an archive.
  D. Create a CloudWatch Logs log group and route events there.
  A. Create an Amazon EventBridge custom event bus , create an archive , and create a rule to send events to Lambda.

  ---

  Explanation

  Amazon EventBridge supports custom event buses for application-specific events. EventBridge archives allow events to be retained and replayed later based on time ranges or event patterns, directly meeting the replay requirement.

  Creating a custom event bus provides isolation and governance for application events. The archive preserves events automatically, and EventBridge rules route events to AWS Lambda for processing without custom code.

  Options B and C do not properly align with custom event use cases or supported archive behavior. Option D lacks native replay functionality.

  Therefore, a custom event bus with an archive and rule is the correct solution.

• Question 32:

  A company wants to reduce latency for users accessing global content.

  Which AWS service should be used?

  A. Amazon Route 53
  B. Amazon CloudFront
  C. AWS Direct Connect
  D. Application Load Balancer
  B. Amazon CloudFront

  ---

  Explanation

  CloudFront caches content at edge locations globally, significantly reducing latency for end users.

  Amazon CloudFront - Global Content Delivery

• Question 33:

  A CloudOps engineer wants to prevent developers from launching EC2 instances using unapproved AMIs across all accounts in an AWS Organization.

  Which solution enforces this MOST effectively?

  A. IAM policies applied to developer roles
  B. AWS Config rule with automatic remediation
  C. Service Control Policy (SCP) denying RunInstances with unapproved AMIs
  D. AWS Trusted Advisor checks
  C. Service Control Policy (SCP) denying RunInstances with unapproved AMIs

  ---

  Explanation

  Only SCPs can enforce preventive controls across all accounts, including root users. By denying ec2:RunInstances unless the AMI ID matches an approved list, the organization ensures enforcement before resource creation.

  AWS Config detects drift after creation and cannot prevent launches.

  AWS Organizations - Service Control Policies

• Question 34:

  A company's developers manually install software modules on Amazon EC2 instances to deploy new versions of a service. A security audit finds that instances contain inconsistent and unapproved modules.

  A CloudOps engineer must create a new instance image that contains only approved software.

  Which solution will meet these requirements?

  A. Use Amazon Detective to continuously find and uninstall unauthorized modules from the instances.
  B. Use Amazon GuardDuty to create and deploy an Amazon Machine Image (AMI) that includes only the approved modules.
  C. Use AWS Systems Manager Run Command to install the approved modules on all running instances during an in-place update.
  D. Use EC2 Image Builder to create and test an Amazon Machine Image (AMI) that includes only the approved modules. Update the deployment workflow to use the new AMI.
  D. Use EC2 Image Builder to create and test an Amazon Machine Image (AMI) that includes only the approved modules. Update the deployment workflow to use the new AMI.

  ---

  Explanation

  AWS Cloud Operations and Deployment documentation EC2 Image Builder is the AWS-managed service for automating the creation, maintenance, validation, and deployment of secure and compliant Amazon Machine Images (AMIs).

  It allows CloudOps teams to define image pipelines that include only approved software modules and configuration scripts. EC2 Image Builder automatically tests and verifies these AMIs for compliance before deployment.

  This process ensures configuration consistency, eliminates manual installation errors, and simplifies ongoing patch management. The service integrates with, AWS Systems Manager Amazon Inspector, and CloudFormation for end-to-end automation.

  In contrast:

  Amazon Detective and GuardDuty (Options A & B) are security monitoring tools, not image management solutions.

  Run Command (Option C) applies ad-hoc updates but does not create standard, reusable AMIs. Therefore, Option D is correct-EC2 Image Builder provides the most operationally efficient and compliant way to create an approved baseline AMI for future deployments.

  AWS Cloud Operations & Deployment Guide - Building Secure, Consistent AMIs Using EC2 Image Builder

• Question 35:

  A CloudOps engineer needs to retain Amazon CloudWatch Logs for exactly 90 days.

  Which configuration should be applied?

  A. Export logs to Amazon S3 daily.
  B. Set the log group retention policy to 90 days.
  C. Archive logs using AWS Backup.
  D. Stream logs to Amazon OpenSearch Service.
  B. Set the log group retention policy to 90 days.

  ---

  Explanation

  CloudWatch Logs retention policies automatically delete log events older than the specified period. This provides a simple, managed mechanism for compliance-driven retention control.

  Amazon CloudWatch Logs - Retention Policies

• Question 36:

  A company must ensure that secrets used by applications are rotated automatically and that applications can retrieve secrets securely at runtime.

  Which solution will meet these requirements?

  A. Store credentials in an AMI and rebuild the AMI monthly.
  B. Store credentials in AWS Secrets Manager and configure rotation.
  C. Store credentials in Amazon S3 with bucket encryption enabled.
  D. Store credentials in CloudWatch Logs and restrict access.
  B. Store credentials in AWS Secrets Manager and configure rotation.

  ---

  Explanation

  Secrets Manager is purpose-built to store, retrieve, and rotate secrets securely. Rotation reduces long- lived credential risk, and applications can retrieve secrets at runtime using IAM-controlled access. This meets both secure retrieval and automated rotation requirements while reducing operational risk compared with manual credential distribution.

  Embedding secrets in AMIs increases exposure and complicates rotation. S3 and CloudWatch Logs are not designed as secret stores and introduce unacceptable security risk even with access controls.

  AWS Secrets Manager - Secure storage and automatic rotation of secrets

• Question 37:

  A CloudOps engineer needs to automatically replace unhealthy EC2 instances while preserving application availability.

  Which configuration is REQUIRED?

  A. CloudWatch alarms only
  B. EC2 Auto Scaling with ELB health checks
  C. EC2 instance recovery
  D. Manual reboot scripts
  B. EC2 Auto Scaling with ELB health checks

  ---

  Explanation

  Auto Scaling integrated with load balancer health checks ensures unhealthy instances are terminated and replaced automatically without manual intervention.

  Amazon EC2 Auto Scaling - Health Checks

• Question 38:

  A company uses AWS Organizations to manage multiple AWS accounts. A CloudOps engineer must identify all IPv4 ports open to 0.0.0.0/0 across the organization's accounts.

  Which solution will meet this requirement with the LEAST operational effort?

  A. Use the AWS CLI to print all security group rules for review.
  B. Review AWS Trusted Advisor findings in an organizational view for the Security Groups - Specific Ports Unrestricted check.
  C. Create an AWS Lambda function to gather security group rules from all accounts. Aggregate the findings in an Amazon S3 bucket.
  D. Enable Amazon Inspector in each account. Run an automated workload discovery job.
  B. Review AWS Trusted Advisor findings in an organizational view for the Security Groups - Specific Ports Unrestricted check.

  ---

  Explanation

  AWS Cloud Operations and Governance documentation AWS Trusted Advisor provides automated checks for security group rules across all accounts, including identifying ports open to 0.0.0.0/0. When viewed in organizational mode, Trusted Advisor integrates with AWS Organizations, allowing administrators to access organization-wide security findings from a central management account. This approach requires no custom code, additional infrastructure, or manual inspection, providing immediate visibility and the lowest operational overhead.

  AWS CLI scripts (Option A) or Lambda automation (Option C) introduce additional maintenance, and Amazon Inspector (Option D) is focused on instance-level vulnerabilities, not network access rules. Therefore, Option B is the AWS-recommended CloudOps best practice for centralized and low-effort open- port auditing.

  AWS Cloud Operations & Governance Guide - Using Trusted Advisor Organizational View for Security Group Port Checks

• Question 39:

  A company requires that backups of critical workloads be copied to another AWS account for protection against accidental deletion and insider risk. The CloudOps engineer wants a managed approach.

  Which solution will meet these requirements?

  A. Use AWS Backup to copy recovery points to a backup vault in a different AWS account.
  B. Enable S3 Object Lock for all EC2 instances.
  C. Use CloudWatch alarms to detect deletions and then re-create backups.
  D. Use AWS Config to prevent backup deletion automatically.
  A. Use AWS Backup to copy recovery points to a backup vault in a different AWS account.

  ---

  Explanation

  AWS Backup supports cross-account backup strategies by allowing organizations to copy recovery points to backup vaults in other accounts, improving isolation and reducing the risk that a single compromised account can delete both primary resources and backups. This is a managed capability with centralized policy control, auditability, and standard restore procedures. S3 Object Lock applies to S3 objects, not EC2 instance backups as a general mechanism. CloudWatch alarms are reactive and do not guarantee restore points. AWS Config can evaluate compliance but is not a primary mechanism to perform cross-account backup copies.

  AWS Backup - Cross-account backup copy and vault strategies

• Question 40:

  A CloudOps engineer must enforce that workloads can be deployed only in approved AWS Regions across an AWS Organization. The solution must prevent noncompliant deployments, not just detect them.

  Which solution will meet these requirements?

  A. Use AWS Config to detect resources created in unapproved Regions.
  B. Use an SCP to deny actions in unapproved Regions across all accounts.
  C. Use CloudWatch dashboards to report on Regions used.
  D. Use Amazon Inspector to block resources in unapproved Regions.
  B. Use an SCP to deny actions in unapproved Regions across all accounts.

  ---

  Explanation

  Service Control Policies provide preventive guardrails across an organization. By denying key service actions in unapproved Regions (commonly using condition keys that evaluate requested Region), the organization can block noncompliant deployments before they occur, including actions performed by highly privileged identities in member accounts.

  AWS Config and dashboards are detective controls and do not prevent creation. Inspector does not enforce Region governance.

  AWS Organizations - SCPs for Region and service restrictions