Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 61:

  A company hosts a web application on an Amazon EC2 instance. The web server logs are published to Amazon CloudWatch Logs. The log events have the same structure and include the HTTP response codes associated with user requests. The company needs to monitor the number of times the web server returns an HTTP 404 response.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Create a CloudWatch Logs metric filter that counts the number of times the web server returns an HTTP 404 response.
  B. Create a CloudWatch Logs subscription filter that counts the number of HTTP 404 responses.
  C. Create an AWS Lambda function that runs a CloudWatch Logs Insights query every hour.
  D. Create a script that runs a CloudWatch Logs Insights query every hour.
  A. Create a CloudWatch Logs metric filter that counts the number of times the web server returns an HTTP 404 response.

  ---

  Explanation

  CloudWatch Logs metric filters allow log data to be converted into CloudWatch metrics in near real time. This enables continuous monitoring without custom code or scheduled queries. Metric filters are ideal when log events have a consistent structure and specific patterns, such as HTTP response codes.

  By defining a metric filter that matches HTTP 404 responses, CloudWatch can increment a metric each time a 404 occurs. This metric can then be used for dashboards, alarms, and trend analysis. This approach is fully managed, scalable, and requires minimal operational effort.

  Options B, C, and D rely on subscription filters or periodic queries, which introduce unnecessary complexity, latency, and maintenance overhead. Therefore, metric filters are the most efficient solution.

• Question 62:

  A CloudOps engineer is troubleshooting an implementation of Amazon CloudWatch Synthetics. The CloudWatch Synthetics results must be sent to an Amazon S3 bucket. The CloudOps engineer has copied the configuration of an existing canary that runs on a VPC that has an internet gateway attached. However, the CloudOps engineer cannot get the canary to successfully start on a private VPC that has no internet access.

  What should the CloudOps engineer do to successfully run the canary on the private VPC?

  A. Ensure that the DNS resolution option and the DNS hostnames option are turned on in the VPC. Add the synthetics:GetCanaryRuns permission to the VPC. On the S3 bucket, add the IgnorePublicAcls permission to the CloudWatch Synthetics role.
  B. Ensure that the DNS resolution option and the DNS hostnames option are turned off in the VPC. Create a gateway VPC endpoint for Amazon S3. Add the permissions to allow CloudWatch Synthetics to use the S3 endpoint.
  C. Ensure that the DNS resolution option and the DNS hostnames option are turned off in the VPC. Add a security group to the canary to allow outbound traffic on the DNS port. Add the permissions to allow CloudWatch Synthetics to write to the S3 bucket.
  D. Ensure that the DNS resolution option and the DNS hostnames option are turned on in the VPC. Create an interface VPC endpoint for CloudWatch. Create a gateway VPC endpoint for Amazon S3. Add the permissions to allow CloudWatch Synthetics to use both endpoints.
  D. Ensure that the DNS resolution option and the DNS hostnames option are turned on in the VPC. Create an interface VPC endpoint for CloudWatch. Create a gateway VPC endpoint for Amazon S3. Add the permissions to allow CloudWatch Synthetics to use both endpoints.

  ---

  Explanation

  CloudWatch Synthetics canaries require connectivity to both CloudWatch and Amazon S3 to function correctly. In a private VPC without internet access, AWS service access must be provided through VPC endpoints.

  The canary needs to send metrics, logs, and execution data to CloudWatch, which requires an interface VPC endpoint for CloudWatch. It also needs to store artifacts such as screenshots and HAR files in Amazon S3, which requires a gateway VPC endpoint for S3. Without these endpoints, the canary cannot communicate with required AWS services and will fail to start.

  DNS resolution and DNS hostnames must be enabled so the canary can resolve AWS service endpoints to the private IP addresses exposed by the VPC endpoints. This is a mandatory prerequisite for PrivateLink-based service access.

  Option B and C incorrectly disable DNS functionality, which breaks service endpoint resolution. Option A includes invalid or irrelevant permissions and does not address private connectivity requirements.

  Therefore, enabling DNS support and creating both the CloudWatch interface endpoint and the S3 gateway endpoint is the correct and complete solution.

• Question 63:

  A CloudOps engineer has created a VPC that contains a public subnet and a private subnet. Amazon EC2 instances that were launched in the private subnet cannot access the internet. The default network ACL is active on all subnets in the VPC, and all security groups allow outbound traffic.

  Which solution will provide the EC2 instances in the private subnet with access to the internet?

  A. Create a NAT gateway in the public subnet. Create a route from the private subnet to the NAT gateway.
  B. Create a NAT gateway in the public subnet. Create a route from the public subnet to the NAT gateway.
  C. Create a NAT gateway in the private subnet. Create a route from the public subnet to the NAT gateway.
  D. Create a NAT gateway in the private subnet. Create a route from the private subnet to the NAT gateway.
  A. Create a NAT gateway in the public subnet. Create a route from the private subnet to the NAT gateway.

  ---

  Explanation

  According to the AWS Cloud Operations and Networking documentation, instances in a private subnet do not have a direct route to the internet gateway and thus require a NAT gateway for outbound internet access.

  The correct configuration is to create a NAT gateway in the public subnet, associate an Elastic IP address, and then update the private subnet's route table to send all 0.0.0.0/0 traffic to the NAT gateway. This enables instances in the private subnet to initiate outbound connections while keeping inbound traffic blocked for security.

  Placing the NAT gateway inside the private subnet (Options C or D) prevents connectivity because it would not have a route to the internet gateway. Configuring routes from the public subnet to the NAT gateway (Option B) does not serve private subnet traffic. Hence, Option A follows AWS best practices for enabling secure, managed, outbound-only internet access from private resources.

  AWS Cloud Operations & Networking Guide - Section: Providing Internet Access to Private Subnets Using NAT Gateway

• Question 64:

  A company uses AWS CloudFormation to deploy application stacks. A CloudOps engineer needs to roll out a standard baseline stack to all existing and future accounts in an AWS Organization, with minimal manual effort.

  Which solution will meet these requirements?

  A. Use CloudFormation StackSets with service-managed permissions integrated with AWS Organizations.
  B. Copy and paste the template into each account and deploy it manually.
  C. Use AWS Config to deploy CloudFormation templates automatically.
  D. Use Amazon SNS to trigger stack creation in each account.
  A. Use CloudFormation StackSets with service-managed permissions integrated with AWS Organizations.

  ---

  Explanation

  CloudFormation StackSets with service-managed permissions is specifically designed for centralized, multi-account, multi-Region deployments integrated with AWS Organizations. The management account (or delegated administrator) can deploy a baseline stack across OUs and automatically apply it to new accounts added to targeted OUs, meeting both "existing and future accounts" and "minimal manual effort." Manual deployment does not scale and increases drift risk. AWS Config is for compliance evaluation rather than orchestrating organization-wide stack rollout. SNS can notify but does not provide the governed deployment model and lifecycle management that StackSets provides.

  AWS CloudFormation - StackSets with AWS Organizations integration

• Question 65:

  A CloudOps engineer creates an AWS CloudFormation template to define an application stack that can be deployed in multiple AWS Regions. The CloudOps engineer also creates an Amazon CloudWatch dashboard by using the AWS Management Console. Each deployment of the application requires its own CloudWatch dashboard.

  How can the CloudOps engineer automate the creation of the CloudWatch dashboard each time the application is deployed?

  A. Create a script by using the AWS CLI to run the aws cloudformation put-dashboard command with the name of the dashboard. Run the command each time a new CloudFormation stack is created.
  B. Export the existing CloudWatch dashboard as JSON. Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Include the exported JSON in the resource's DashboardBody property.
  C. Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Use the intrinsic Ref function to reference the ID of the existing CloudWatch dashboard.
  D. Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Specify the name of the existing dashboard in the DashboardName property.
  B. Export the existing CloudWatch dashboard as JSON. Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Include the exported JSON in the resource's DashboardBody property.

  ---

  Explanation

  CloudOps automation and monitoring best practices, CloudWatch dashboards should be provisioned as infrastructure-as-code (IaC) resources using AWS CloudFormation to ensure consistency, repeatability, and version control. AWS CloudFormation supports the AWS::CloudWatch::Dashboard resource, where the DashboardBody property accepts a JSON object describing widgets, metrics, and layout. By exporting the existing dashboard configuration as JSON and embedding it into the CloudFormation template, every deployment of the application automatically creates its corresponding dashboard. This method aligns with the CloudOps requirement for automated deployment and operational visibility within the same stack lifecycle.

  AWS documentation explicitly states:

  "Use the AWS::CloudWatch::Dashboard resource to create a dashboard from your template. You can include the same JSON you use to define a dashboard in the console." Option A requires manual execution. Options C and D incorrectly reference or reuse existing dashboards, failing to produce unique, deployment-specific dashboards.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 1: Monitoring and Logging AWS CloudFormation User Guide -

  Resource Type: AWS::CloudWatch::Dashboard AWS Well-Architected Framework - Operational Excellence Pillar Amazon CloudWatch - Automating Dashboards with Infrastructure as Code

• Question 66:

  A CloudOps engineer wants to standardize and harden AMIs used across environments with automated testing.

  Which AWS service is purpose-built for this task?

  A. AWS Systems Manager
  B. EC2 Image Builder
  C. Amazon Inspector
  D. AWS CloudFormation
  B. EC2 Image Builder

  ---

  Explanation

  EC2 Image Builder automates AMI creation, testing, validation, and lifecycle management, ensuring consistency and security.

  EC2 Image Builder - AMI Pipelines

• Question 67:

  A global gaming company is preparing to launch a new game on AWS. The game runs in multiple AWS Regions on a fleet of Amazon EC2 instances. The instances are in an Auto Scaling group behind an Application Load Balancer (ALB) in each Region.

  The company plans to use Amazon Route 53 for DNS services. The DNS configuration must direct users to the Region that is closest to them and must provide automated failover.

  Which combination of steps should a CloudOps engineer take to configure Route 53 to meet these requirements? (Select TWO.)

  A. Create Amazon CloudWatch alarms that monitor the health of the ALB in each Region. Configure Route 53 DNS failover by using a health check that monitors the alarms.
  B. Create Amazon CloudWatch alarms that monitor the health of the EC2 instances in each Region. Configure Route 53 DNS failover by using a health check that monitors the alarms.
  C. Configure Route 53 DNS failover by using a health check that monitors the private IP address of an EC2 instance in each Region.
  D. Configure Route 53 geoproximity routing. Specify the Regions that are used for the infrastructure.
  E. Configure Route 53 simple routing. Specify the continent, country, and state or province that are used for the infrastructure.
  A. Create Amazon CloudWatch alarms that monitor the health of the ALB in each Region. Configure Route 53 DNS failover by using a health check that monitors the alarms.
  D. Configure Route 53 geoproximity routing. Specify the Regions that are used for the infrastructure.

  ---

  Explanation

  The combination of geoproximity routing and DNS failover health checks provides global low-latency routing with high availability.

  Geoproximity routing in Route 53 routes users to the AWS Region closest to their geographic location, optimizing latency. For automatic failover, Route 53 health checks can monitor CloudWatch alarms tied to the health of the ALB in each Region. When a Region becomes unhealthy, Route 53 reroutes traffic to the next available Region automatically.

  AWS documentation states:

  "Use geoproximity routing to direct users to resources based on geographic location, and configure health checks to provide DNS failover for high availability."

  Option B incorrectly monitors EC2 instances directly, which is not efficient at scale. Option C uses private IPs, which cannot be globally health-checked. Option E (simple routing) does not support geographic or failover routing. Hence, A and D together meet both the proximity and failover requirements.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 5: Networking and Content Delivery Amazon Route 53 Developer Guide - Geoproximity Routing and DNS Failover AWS Well-Architected Framework - Reliability Pillar Amazon CloudWatch Alarms - Integration with Route 53 Health Checks

• Question 68:

  A company runs thousands of Amazon EC2 instances that are based on the Amazon Linux 2 Amazon Machine Image (AMI). A SysOps administrator must implement a solution to record commands and output from any user that needs an interactive session on one of the EC2 instances. The solution must log the data to a durable storage location. The solution also must provide automated notifications and alarms that are based on the log data.

  Which solution will meet these requirements with the MOST operational efficiency?

  A. Configure command session logging on each EC2 instance. Configure the unified Amazon CloudWatch agent to send session logs to Amazon CloudWatch Logs. Set up query filters and alerts by using Amazon Athena.
  B. Require all users to use a central bastion host when they need command line access to an EC2 instance. Configure the unified Amazon CloudWatch agent on the bastion host to send session logs to Amazon CloudWatch Logs. Set up a metric filter and a metric alarm for relevant security findings in CloudWatch Logs.
  C. Require all users to use AWS Systems Manager Session Manager when they need command line access to an EC2 instance. Configure Session Manager to stream session logs to Amazon CloudWatch Logs. Set up a metric filter and a metric alarm for relevant security findings in CloudWatch Logs.
  D. Configure command session logging on each EC2 instance. Require all users to use AWS Systems Manager Run Command documents when they need command line access to an EC2 instance. Configure the unified Amazon CloudWatch agent to send session logs to Amazon CloudWatch Logs. Set up CloudWatch alarms that are based on Amazon Athena query results.
  C. Require all users to use AWS Systems Manager Session Manager when they need command line access to an EC2 instance. Configure Session Manager to stream session logs to Amazon CloudWatch Logs. Set up a metric filter and a metric alarm for relevant security findings in CloudWatch Logs.

  ---

  Explanation

  The most operationally efficient solution is C because AWS Systems Manager Session Manager is purpose- built for secure, auditable interactive access to EC2 instances at scale--without managing bastion hosts or distributing SSH keys. Session Manager can be configured to log session activity, including commands and output, to durable destinations such as Amazon CloudWatch Logs (and optionally Amazon S3). This directly satisfies the requirement to record interactive sessions and store logs durably.

  For automated notifications and alarms, CloudWatch Logs supports metric filters that transform matching log patterns into CloudWatch metrics. Those metrics can then drive CloudWatch alarms and notifications (for example, via Amazon SNS). This is a standard CloudOps pattern: centralize logs, derive metrics from security-relevant patterns, and alert automatically. Option A and D require installing and operating agents and building a more complex analytics path (Athena queries for alerting), which is less efficient and introduces more moving parts across thousands of instances. Option B adds a bastion host dependency that becomes an operational burden (scaling, patching, hardening, HA) and a potential choke point. Session Manager reduces these burdens by using SSM Agent already installed, IAM-based access control, and centralized logging/monitoring integrations.

• Question 69:

  A company has a stateful web application that is hosted on Amazon EC2 instances in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) that has a single target group. The ALB is configured as the origin in an Amazon CloudFront distribution. Users are reporting random logouts from the web application.

  Which combination of actions should a CloudOps engineer take to resolve this problem? (Select TWO.)

  A. Change to the least outstanding requests algorithm on the ALB target group.
  B. Configure cookie forwarding in the CloudFront distribution cache behavior.
  C. Configure header forwarding in the CloudFront distribution cache behavior.
  D. Enable group-level stickiness on the ALB listener rule.
  E. Enable sticky sessions on the ALB target group.
  B. Configure cookie forwarding in the CloudFront distribution cache behavior.
  E. Enable sticky sessions on the ALB target group.

  ---

  Explanation

  Stateful applications require session persistence to ensure that subsequent requests from the same user are routed to the same backend instance. When CloudFront is used in front of an ALB, session-related cookies must be forwarded correctly; otherwise, CloudFront can route requests to different targets, causing session loss and random logouts.

  Configuring cookie forwarding in the CloudFront cache behavior ensures that session cookies (such as authentication tokens) are forwarded to the ALB and not stripped or cached incorrectly. Without this configuration, CloudFront may serve cached responses that do not align with the user's active session state, leading to authentication issues.

  On the ALB side, sticky sessions (session affinity) must be enabled on the target group to ensure that requests with the same session cookie are consistently routed to the same EC2 instance. ALB stickiness uses application cookies to bind a user session to a specific target, which is critical for stateful applications that store session data in memory.

  Option A affects load distribution efficiency but does not address session persistence. Option C (header forwarding) is unnecessary unless the application explicitly stores session state in headers, which is uncommon. Option D applies only when using multiple target groups and listener rules, which is not the case here.

  Together, enabling cookie forwarding in CloudFront and sticky sessions at the ALB target group resolves the logout issue by maintaining consistent session routing from the user through CloudFront to the same backend instance.

• Question 70:

  A CloudOps engineer must ensure that all Amazon EBS snapshots are retained even if the originating CloudFormation stack is deleted. The snapshots must be created automatically during stack deletion.

  Which CloudFormation feature should be used?

  A. Stack termination protection
  B. DeletionPolicy: Retain
  C. DeletionPolicy: Snapshot
  D. UpdateReplacePolicy: Retain
  C. DeletionPolicy: Snapshot

  ---

  Explanation

  For Amazon EBS volumes and RDS resources, DeletionPolicy: Snapshot instructs CloudFormation to automatically create a final snapshot when the stack is deleted. Retain leaves the resource intact but does not guarantee a snapshot. Termination protection only blocks deletion. UpdateReplacePolicy applies during resource replacement, not stack deletion.

  AWS CloudFormation - DeletionPolicy Attribute