Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 41:

  A CloudOps engineer must ensure that all AWS API calls across an organization are logged and stored centrally for compliance audits.

  Which solution should the engineer implement?

  A. Enable CloudTrail in each account individually.
  B. Create an organization trail in AWS CloudTrail.
  C. Enable VPC Flow Logs in all Regions.
  D. Use Amazon CloudWatch Logs Insights.
  B. Create an organization trail in AWS CloudTrail.

  ---

  Explanation

  An organization trail in AWS CloudTrail automatically logs API activity from all member accounts and delivers logs to a central S3 bucket.

  This approach ensures consistent coverage, simplified governance, and audit readiness. Options C and D do not capture API-level activity, and Option A is operationally inefficient.

  AWS CloudTrail - Organization Trails

• Question 42:

  A company must implement an audit trail for operational changes to AWS resources, including who made the change and the exact API parameters used. A CloudOps engineer needs a solution that can be queried efficiently for investigations without exporting logs to another service first.

  Which solution will meet these requirements?

  A. Use Amazon CloudWatch Logs and build dashboards for all API requests.
  B. Use AWS CloudTrail Lake to store events and run SQL-like queries for investigations.
  C. Use VPC Flow Logs to capture all AWS API activity.
  D. Use Amazon Inspector reports for operational change tracking.
  B. Use AWS CloudTrail Lake to store events and run SQL-like queries for investigations.

  ---

  Explanation

  CloudTrail is the authoritative service for recording AWS API activity, including identity context (IAM principal, access key/role session), timestamps, source IP, resources, and request parameters. CloudTrail Lake provides managed, queryable storage for CloudTrail events with SQL-like querying, allowing investigations directly in the service without requiring an export pipeline. This meets both the audit-trail and "query without exporting first" requirements.

  CloudWatch Logs is not the primary record of API activity across services. VPC Flow Logs capture network flows, not control-plane API calls. Inspector is a vulnerability management service and does not provide comprehensive API audit trails.

  AWS CloudTrail - CloudTrail Lake and event querying

• Question 43:

  A company operates compute resources in a VPC and in the company's on-premises data center. The company already has an AWS Direct Connect connection between the VPC and the on-premises data center.

  A CloudOps engineer needs to ensure that Amazon EC2 instances in the VPC can resolve DNS names for hosts in the on-premises data center.

  Which solution will meet this requirement with the LEAST amount of ongoing maintenance?

  A. Create an Amazon Route 53 private hosted zone. Populate the zone with the hostnames and IP addresses of the hosts in the on-premises data center.
  B. Create an Amazon Route 53 Resolver outbound endpoint . Add the IP addresses of an on-premises DNS server for the domain names that need to be forwarded.
  C. Set up a forwarding rule for reverse DNS queries in Amazon Route 53 Resolver. Set the enableDnsHostnames attribute to true for the VPC.
  D. Add the hostnames and IP addresses for the on-premises hosts to the /etc/hosts file of each EC2 instance.
  B. Create an Amazon Route 53 Resolver outbound endpoint . Add the IP addresses of an on-premises DNS server for the domain names that need to be forwarded.

  ---

  Explanation

  Amazon Route 53 Resolver outbound endpoints enable Amazon VPC resources to forward DNS queries to DNS servers that are outside of AWS, such as on-premises DNS servers. Because the company already has AWS Direct Connect in place, DNS queries can be routed privately from the VPC to the on- premises DNS infrastructure without using the public internet.

  By creating an outbound endpoint and configuring forwarding rules for the on-premises domains, EC2 instances in the VPC can resolve DNS names dynamically using the existing authoritative DNS servers. This approach requires minimal ongoing maintenance because DNS records continue to be managed centrally in the on-premises DNS system.

  Manually populating a private hosted zone or /etc/hosts files would require constant updates and does not scale. Reverse DNS forwarding alone does not solve forward name resolution.

  Therefore, using Route 53 Resolver outbound endpoints is the correct solution.

• Question 44:

  A CloudOps engineer creates a new VPC that includes a public subnet and a private subnet. The CloudOps engineer successfully launches 11 Amazon EC2 instances in the private subnet. The CloudOps engineer attempts to launch one more EC2 instance in the same subnet but receives an error stating that not enough free IP addresses are available.

  What must the CloudOps engineer do to deploy more EC2 instances?

  A. Edit the private subnet to change the CIDR block to /27.
  B. Edit the private subnet to extend across a second Availability Zone.
  C. Assign additional Elastic IP addresses to the private subnet.
  D. Create a new private subnet to hold the required EC2 instances.
  D. Create a new private subnet to hold the required EC2 instances.

  ---

  Explanation

  Each subnet in a VPC has a fixed CIDR range that determines how many private IP addresses are available. AWS reserves five IP addresses per subnet, reducing the usable address count. Once the available IP addresses are exhausted, no more instances can be launched in that subnet.

  AWS does not allow changing the CIDR block of an existing subnet. Therefore, Option A is invalid. Option B does not increase the number of IP addresses; Availability Zones are properties of subnets, not expansions of their CIDR ranges. Option C is incorrect because Elastic IP addresses are public IPs and do not increase the number of private IP addresses available in a subnet.

  The only viable solution is to create a new subnet with a larger or additional CIDR range and deploy additional EC2 instances there. This approach aligns with AWS VPC design principles and is the standard method for handling IP exhaustion.

• Question 45:

  A company hosts a production MySQL database on an Amazon Aurora single-node DB cluster. The database is queried heavily for reporting purposes. The DB cluster is experiencing periods of performance degradation because of high CPU utilization and maximum connections errors. A CloudOps engineer needs to improve the stability of the database.

  Which solution will meet these requirements?

  A. Create an Aurora Replica node. Create an Auto Scaling policy to scale replicas based on CPU utilization. Ensure that all reporting requests use the read-only connection string.
  B. Create a second Aurora MySQL single-node DB cluster in a second Availability Zone. Ensure that all reporting requests use the connection string for this additional node.
  C. Create an AWS Lambda function that caches reporting requests. Ensure that all reporting requests call the Lambda function.
  D. Create a multi-node Amazon ElastiCache cluster. Ensure that all reporting requests use the ElastiCache cluster. Use the database if the data is not in the cache.
  A. Create an Aurora Replica node. Create an Auto Scaling policy to scale replicas based on CPU utilization. Ensure that all reporting requests use the read-only connection string.

  ---

  Explanation

  Comprehensive and Detailed From Exact Extract of AWS CloudOps Doocuments: Amazon Aurora supports up to 15 Aurora Replicas that share the same storage volume and provide read scaling and improved availability. Official guidance states that replicas "offload read traffic from the writer" and that you should direct read-only workloads to the reader endpoint, reducing CPU pressure and connection counts on the primary. Aurora also supports Replica Auto Scaling through Application Auto Scaling policies using metrics such as CPU utilization or connections to add or remove replicas automatically. This design addresses both high CPU and maximum connections by moving reporting traffic to read replicas while keeping a single write primary for OLTP. Option B creates a separate cluster with independent storage, increasing operational overhead and data synchronization complexity. Options C and D introduce application-layer caching changes that may not guarantee data freshness or relieve the write node directly. Therefore, adding read replicas and routing reporting to the reader endpoint, with auto scaling based on load, is the least intrusive, CloudOps-aligned way to stabilize performance.

  References (AWS CloudOps Documents / Study Guide):

  Amazon Aurora - Replicas and Reader Endpoint (Aurora User Guide) Aurora Replica Auto Scaling (Aurora & Application Auto Scaling Guides) AWS Well-Architected Framework - Reliability & Performance Efficiency

• Question 46:

  A company uses Amazon ElastiCache (Redis OSS) to cache application data. A CloudOps engineer must implement a solution to increase the resilience of the cache. The solution also must minimize the recovery time objective (RTO).

  Which solution will meet these requirements?

  A. Replace ElastiCache (Redis OSS) with ElastiCache (Memcached).
  B. Create an Amazon EventBridge rule to initiate a backup every hour. Restore the backup when necessary.
  C. Create a read replica in a second Availability Zone. Enable Multi-AZ for the ElastiCache (Redis OSS) replication group.
  D. Enable automatic backups. Restore the backups when necessary.
  C. Create a read replica in a second Availability Zone. Enable Multi-AZ for the ElastiCache (Redis OSS) replication group.

  ---

  Explanation

  Comprehensive and Detailed From Exact Extract of AWS CloudOps Doocuments:

  For high availability and fast failover, ElastiCache for Redis supports replication groups with Multi-AZ and automatic failover. CloudOps guidance states that a primary node can be paired with one or more replicas across multiple Availability Zones; if the primary fails, Redis automatically promotes a replica to primary in seconds, thereby minimizing RTO. This architecture maintains in-memory data continuity without waiting for backup restore operations. Backups (Options B and D) provide durability but require restore and re- warm procedures that increase RTO and may impact application latency. Switching engines (Option A) to Memcached does not provide Redis replication/failover semantics and would not inherently improve resilience for this use case. Therefore, creating a read replica in a different AZ and enabling Multi-AZ with automatic failover is the prescribed CloudOps pattern to increase resilience and achieve the lowest practical RTO for Redis caches.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Reliability and Business Continuity Amazon ElastiCache for Redis - Replication Groups, Multi-AZ, and Automatic Failover AWS Well-Architected Framework - Reliability Pillar

• Question 47:

  A company hosts a static website in an Amazon S3 bucket, accessed globally via Amazon CloudFront. The Cache-Control max-age header is set to 1 hour, and Maximum TTL is set to 5 minutes. The CloudOps engineer observes that CloudFront is not caching objects for the expected duration.

  What is the reason for this issue?

  A. The Expires header has been set to 3 hours.
  B. Cached assets are not expiring in the edge location.
  C. Cache invalidation is missing in the CloudFront configuration.
  D. Cache-duration settings conflict with each other.
  D. Cache-duration settings conflict with each other.

  ---

  Explanation

  As per the AWS Cloud Operations and Content Delivery documentation, CloudFront determines cache behavior by evaluating both origin headers (e.g., Cache-Control and Expires) and distribution-level TTL settings.

  When Cache-Control max-age conflicts with the Maximum TTL configured in CloudFront, the shorter TTL value takes precedence. This results in CloudFront caching content for only 5 minutes instead of 1 hour, despite the origin headers suggesting a longer duration. AWS documentation explicitly states: "When both origin cache headers and CloudFront TTL settings are defined, CloudFront uses the most restrictive caching period." This mismatch causes the perceived performance drop, as CloudFront frequently revalidates content. Therefore, Option D is correct -cache-duration settings conflict with each other, leading to unexpected caching behavior.

  AWS Cloud Operations & Content Delivery Guide - Interaction Between Cache-Control Headers and CloudFront TTL Settings

• Question 48:

  A company uses a large number of Linux-based Amazon EC2 instances to run business operations. The company uses AWS Systems Manager to manage the EC2 instances. The company wants to ensure that the Systems Manager Agent (SSM Agent) is always up to date with the latest version.

  Which solution will meet this requirement in the MOST operationally efficient way?

  A. Enable the Auto update SSM Agent setting in Systems Manager Fleet Manager.
  B. Subscribe to SSM Agent GitHub notifications and use Lambda to update agents.
  C. Enable the Auto update SSM Agent setting in Systems Manager Patch Manager.
  D. Use GitHub notifications and a Systems Manager Automation document.
  A. Enable the Auto update SSM Agent setting in Systems Manager Fleet Manager.

  ---

  Explanation

  AWS Systems Manager provides a built-in capability to automatically update the SSM Agent on managed instances. Enabling Auto update SSM Agent ensures that instances receive the latest agent version without manual intervention or custom automation.

  This setting is centrally managed and applies across the fleet, making it the most scalable and operationally efficient solution. It eliminates the need for external notifications, custom Lambda functions, or scheduled automation workflows.

  Options B and D introduce unnecessary complexity and operational burden. Option C is incorrect because Patch Manager is designed for operating system patching, not for managing SSM Agent updates.

  Therefore, enabling automatic SSM Agent updates is the best solution.

• Question 49:

  A CloudOps engineer needs secure, keyless access to EC2 instances without opening inbound ports.

  Which solution meets this requirement?

  A. EC2 Instance Connect
  B. Systems Manager Session Manager
  C. Bastion hosts
  D. VPN access
  B. Systems Manager Session Manager

  ---

  Explanation

  Session Manager provides secure shell access over AWS APIs without SSH keys or inbound ports, with full audit logging.

  AWS Systems Manager - Session Manager

• Question 50:

  A company has an internal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone. A CloudOps engineer must make the application highly available.

  Which action should the CloudOps engineer take to meet this requirement?

  A. Increase the maximum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
  B. Increase the minimum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
  C. Update the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.
  D. Update the Auto Scaling group to launch new instances in an Availability Zone in a second AWS Region.
  C. Update the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.

  ---

  Explanation

  High availability for an EC2-based web application behind an ALB is primarily achieved by eliminating single points of failure at the infrastructure layer. A single Availability Zone (AZ) deployment is vulnerable to AZ-level impairment (power/ network issues, facility events, or service disruptions). The most direct and standard AWS approach is to distribute the Auto Scaling group across multiple AZs within the same Region.

  Updating the Auto Scaling group to use subnets in at least two AZs allows instances to be launched across AZs automatically. The ALB is built to route traffic across targets in multiple AZs, and Auto Scaling can replace unhealthy instances in any enabled AZ. This provides resilience without the complexity of multi- Region architectures.

  Options A and B address capacity for peak load but do not address the core availability requirement. Even with more instances, a full AZ outage would still take the entire application down if all instances are in the same AZ. Option D (multi-Region) can improve resilience further, but it introduces significantly more operational overhead: cross-Region traffic routing, data replication, DNS failover strategy, application state handling, and potentially active-active or active-passive designs. For "make the application highly available" from a single- AZ baseline, multi-AZ in the same Region is the standard, least-overhead improvement.