Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 51:

  A CloudOps engineer needs to track configuration changes to IAM policies over time.

  Which service provides this capability?

  A. AWS CloudTrail
  B. AWS Config
  C. Amazon Inspector
  D. AWS Security Hub
  B. AWS Config

  ---

  Explanation

  AWS Config records configuration history for IAM resources, enabling audit and drift analysis.

  AWS Config - IAM Resource Tracking

• Question 52:

  To comply with regulations, a SysOps administrator needs to back up an Amazon EC2 Amazon Machine Image (AMI) to an Amazon S3 bucket. If the SysOps administrator restores the AMI from the bucket in the future, the AMI must use the same AMI image ID as the original AMI.

  Which solution will meet this requirement?

  A. Create a copy of the AMI. Specify the destination S3 bucket. Set the launch permissions to implicit.
  B. Archive the snapshot that is associated with the AMI. Specify the S3 bucket as the archive destination.
  C. Create a store image task. Specify the image ID and the destination S3 bucket.
  D. Use the AWS CLI copy-image command. Specify the image ID and the destination S3 bucket.
  C. Create a store image task. Specify the image ID and the destination S3 bucket.

  ---

  Explanation

  The correct answer is C. Create a store image task. Specify the image ID and the destination S3 bucket, because this is the only AWS-supported solution that allows an AMI to be backed up to Amazon S3 and later restored while preserving the original AMI ID. This capability is essential for regulatory and compliance requirements where immutable identifiers must be retained.

  According to AWS CloudOps documentation for Amazon EC2 AMI lifecycle management, the AMI store and restore feature is specifically designed for long-term retention, audit, and compliance scenarios. When an AMI is stored using a store image task, AWS packages the AMI's configuration, metadata, and associated snapshots and saves them as encrypted objects in an Amazon S3 bucket. When the AMI is restored, AWS explicitly states that the restored AMI retains the same AMI ID as the original image, ensuring continuity for compliance tracking and operational dependencies.

  Option A is incorrect because copying an AMI always results in a new AMI ID, even when copied within the same AWS Region. Option B is incorrect because archiving snapshots to Amazon S3 does not preserve AMI metadata or identity; restoring from snapshots requires creating a new AMI with a different ID. Option D is incorrect because the copy-image command is intended for cross-Region or cross-account AMI duplication and also generates a new AMI ID.

  AWS CloudOps best practices clearly identify store image tasks as the correct mechanism when AMI identity preservation is required for governance, auditability, and compliance controls.

• Question 53:

  A company hosts a static website in Amazon S3 behind an Amazon CloudFront distribution. When new versions are deployed, users sometimes do not see updated content immediately.

  Which solution will meet this requirement?

  A. Configure the CloudFront distribution to add a custom Cache-Control header to requests for content from the S3 bucket.
  B. Modify the distribution settings to specify the protocol as HTTPS only.
  C. Attach the CachingOptimized managed cache policy to the distribution.
  D. Create a CloudFront invalidation.
  D. Create a CloudFront invalidation.

  ---

  Explanation

  The AWS Cloud Operations and Content Delivery documentation explains that Amazon CloudFront caches objects in edge locations for a defined time based on TTL settings or origin headers. When new content is deployed to the S3 origin, previously cached versions remain in edge caches until they expire. To immediately serve the new version, CloudOps engineers must initiate a CloudFront invalidation, which removes cached objects from all edge locations. This forces CloudFront to fetch the latest version from the origin (S3).

  Invalidations can target individual objects (e.g., /index.html) or wildcard paths (e.g., /*) and are the AWS- recommended approach for dynamic content refresh after static site updates. Changing headers (Option A), enforcing HTTPS (Option B), or applying caching policies (Option C) do not directly refresh outdated cache content.

  Thus, Option D - issuing a CloudFront invalidation - ensures users receive the latest website content immediately after deployment.

  AWS Cloud Operations & Content Delivery Guide - Using Invalidation to Refresh Cached Content in CloudFront

• Question 54:

  A company wants to protect its web application from common application-layer attacks such as SQL injection.

  Which AWS service provides this capability?

  A. AWS Shield Standard
  B. AWS WAF
  C. Amazon Inspector
  D. AWS Firewall Manager
  B. AWS WAF

  ---

  Explanation

  AWS WAF is designed to protect web applications from OWASP Top 10 threats, including SQL injection and cross-site scripting.

  Shield protects against DDoS attacks, not application-layer exploits.

  AWS WAF - Application Layer Protection

• Question 55:

  An environment consists of 100 Amazon EC2 Windows instances . The Amazon CloudWatch agent is deployed and running on all EC2 instances with a baseline configuration file to capture log files. There is a new requirement to capture DHCP log files that exist on 50 of the instances.

  What is the MOST operationally efficient way to meet this new requirement?

  A. Create an additional CloudWatch agent configuration file to capture the DHCP logs. Use AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append- config option.
  B. Log in to each EC2 instance with administrator rights and create a PowerShell script to push logs to CloudWatch.
  C. Run the CloudWatch agent configuration wizard on each EC2 instance and add DHCP logs manually.
  D. Run the CloudWatch agent configuration wizard on each EC2 instance and select the advanced detail level.
  A. Create an additional CloudWatch agent configuration file to capture the DHCP logs. Use AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append- config option.

  ---

  Explanation

  The CloudWatch agent supports modular configuration using the append-config option, which allows additional log sources to be added without overwriting the existing baseline configuration. This makes it ideal for incremental log collection changes across large fleets. By creating a separate configuration file specifically for DHCP logs and using Systems Manager Run Command, the CloudOps engineer can remotely update only the relevant instances in a scalable and automated manner. This approach avoids manual login and preserves the existing baseline configuration.

  Options B and C require manual intervention on each instance, which is not scalable or operationally efficient. Option D captures additional logs indiscriminately and does not specifically target DHCP logs, potentially increasing noise and cost.

  Therefore, Option A is the most efficient and AWS-recommended approach.

• Question 56:

  A CloudOps engineer wants to configure observability of specific metrics for a public website that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The CloudOps engineer wants to observe latency, traffic, errors, and saturation metrics. The CloudOps engineer wants to define service level objectives (SLOs) and monitor service level indicators (SLIs). The CloudOps engineer also wants to correlate metrics, logs, and traces to support faster issue resolution.

  Which solution will meet these requirements with the LEAST operational effort?

  A. Use Amazon CloudWatch Application Signals to automatically collect and monitor the specified metrics for the EKS workloads.
  B. Configure AWS Distro for OpenTelemetry and use Amazon Managed Service for Prometheus and Amazon Managed Grafana.
  C. Configure Amazon CloudWatch RUM and CloudWatch Synthetics canaries.
  D. Configure Amazon CloudWatch Application Insights.
  A. Use Amazon CloudWatch Application Signals to automatically collect and monitor the specified metrics for the EKS workloads.

  ---

  Explanation

  Amazon CloudWatch Application Signals is designed to provide built-in observability for containerized workloads, including Amazon EKS. It automatically collects golden signals such as latency, traffic, errors, and saturation without requiring complex instrumentation.

  Application Signals supports SLO definition and SLI monitoring and correlates metrics, logs, and traces within CloudWatch. This significantly reduces operational overhead compared to manually configuring OpenTelemetry pipelines, Prometheus, and Grafana.

  CloudWatch RUM and Synthetics focus on frontend monitoring, not backend service observability. Application Insights does not provide full SLO/SLI support for EKS workloads.

  Therefore, CloudWatch Application Signals is the correct and least-effort solution.

• Question 57:

  A company wants to reduce CloudWatch Logs storage costs while keeping logs searchable for 14 days.

  Which action is MOST cost-effective?

  A. Export logs to S3 and delete immediately
  B. Set log group retention to 14 days
  C. Stream logs to OpenSearch
  D. Archive logs with AWS Backup
  B. Set log group retention to 14 days

  ---

  Explanation

  Retention policies automatically delete old logs, reducing storage cost while preserving searchability during the required window.

  Amazon CloudWatch Logs - Retention

• Question 58:

  A company runs an Amazon RDS for PostgreSQL DB instance. The company requires automatic failover to maintain write availability during infrastructure failures, with minimal application changes.

  Which solution will meet these requirements?

  A. Create a read replica and promote it manually when needed.
  B. Enable Multi-AZ deployment for the DB instance.
  C. Export the database to Amazon S3 every hour.
  D. Use an Auto Scaling group to run two RDS instances in parallel.
  B. Enable Multi-AZ deployment for the DB instance.

  ---

  Explanation

  RDS Multi-AZ deployments provide synchronous replication to a standby instance in a different Availability Zone and automatic failover. The application typically continues to use the same DB endpoint, which minimizes application changes. This directly satisfies the requirement for write availability and automated failover.

  Read replicas are asynchronous and do not provide automatic failover for writes (promotion is a manual or separate process and can introduce data lag). Exports to S3 are not high-availability mechanisms. Auto Scaling groups do not manage RDS instances as if they were EC2 capacity.

  Amazon RDS - Multi-AZ deployments and automated failover

• Question 59:

  A CloudOps engineer must optimize storage performance for an Amazon EC2 Linux instance. The instance uses an Amazon EBS gp3 volume, and the workload experiences sustained high IOPS demand at predictable times each day. The engineer wants to avoid changing instance type.

  Which solution will MOST directly address the bottleneck?

  A. Enable EC2 hibernation to reduce disk usage.
  B. Increase the gp3 volume's provisioned IOPS and throughput settings.
  C. Convert the gp3 volume to magnetic storage for cost savings.
  D. Create an AMI of the instance and relaunch it in a different Availability Zone.
  B. Increase the gp3 volume's provisioned IOPS and throughput settings.

  ---

  Explanation

  For gp3 volumes, performance (IOPS and throughput) can be provisioned independently of volume size. If a workload is I/O bound and the performance requirement is predictable, increasing the gp3 provisioned IOPS and throughput is the most direct way to remove the storage bottleneck without modifying the instance type. This aligns with performance optimization best practices: tune the constrained component first, and use configurable EBS performance where supported. Hibernation affects instance state management, not sustained I/O performance. Magnetic storage is slower and would worsen the problem. Moving AZs is not a targeted storage-performance action and introduces operational risk and downtime.

  Amazon EBS - gp3 performance configuration (IOPS/throughput)

• Question 60:

  A medical research company uses an Amazon Bedrock powered AI assistant with agents and knowledge bases to provide physicians quick access to medical study protocols. The company needs to generate audit reports that contain user identities, usage data for Bedrock agents, access data for knowledge bases, and interaction parameters.

  Which solution will meet these requirements?

  A. Use AWS CloudTrail to log API events from generative AI workloads. Store the events in CloudTrail Lake. Use SQL-like queries to generate reports.
  B. Use Amazon CloudWatch to capture generative AI application logs. Stream the logs to Amazon OpenSearch Service. Use an OpenSearch dashboard visualization to generate reports.
  C. Use Amazon CloudWatch to log API events from generative AI workloads. Send the events to an Amazon S3 bucket. Use Amazon Athena queries to generate reports.
  D. Use AWS CloudTrail to capture generative AI application logs. Stream the logs to Amazon Managed Service for Apache Flink. Use SQL queries to generate reports.
  A. Use AWS CloudTrail to log API events from generative AI workloads. Store the events in CloudTrail Lake. Use SQL-like queries to generate reports.

  ---

  Explanation

  AWS Cloud Operations, Bedrock, and Governance documentation AWS CloudTrail is the authoritative service for capturing API activity and audit trails across AWS accounts. For Amazon Bedrock, CloudTrail records all user-initiated API calls, including interactions with agents knowledge bases, and, generative AI model parameters.

  Using CloudTrail Lake, organizations can store, query, and analyze CloudTrail events directly without needing to export data. CloudTrail Lake supports SQL-like queries for generating audit and compliance reports, enabling the company to retrieve information such as user identity, API usage, timestamp, model or agent ID, and invocation parameters.

  In contrast, CloudWatch focuses on operational metrics and log streaming, not API-level identity data. OpenSearch or Flink would add unnecessary complexity and cost for this use case. Thus, the AWS-recommended CloudOps best practice is to leverage CloudTrail with CloudTrail Lake to maintain auditable, queryable API activity for Bedrock workloads, fulfilling governance and compliance requirements.

  AWS Cloud Operations & Governance Guide - Section: Auditing and Governance for Generative AI Workloads Using AWS CloudTrail and CloudTrail Lake