Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 71:

  A company uses an Auto Scaling group with target tracking based on CPU utilization. During traffic spikes, application latency increases before scaling occurs. The workload processes messages from an Amazon SQS queue.

  Which change will MOST EFFECTIVELY improve scaling responsiveness?

  A. Reduce the Auto Scaling cooldown period.
  B. Switch from target tracking to simple scaling.
  C. Use CloudWatch metric math to scale on SQS backlog per instance.
  D. Increase the maximum capacity of the Auto Scaling group.
  C. Use CloudWatch metric math to scale on SQS backlog per instance.

  ---

  Explanation

  For queue-based workloads, CPU utilization is an indirect signal and often lags behind actual demand. AWS recommends scaling based on queue backlog per instance using CloudWatch metric math, which directly reflects processing pressure.

  Cooldown tuning or capacity limits do not correct the fundamental signal mismatch, and simple scaling is less adaptive than target tracking.

  Amazon EC2 Auto Scaling - Scaling on Amazon SQS Backlog

• Question 72:

  A company runs an application on Amazon EC2 instances behind an Elastic Load Balancer (ELB) in an Auto Scaling group. The application performs well except during a 2-hour period of daily peak traffic, when performance slows.

  A CloudOps engineer must resolve this issue with minimal operational effort.

  What should the engineer do?

  A. Adjust the minimum capacity of the Auto Scaling group to the size required to meet the increased demand during the 2-hour period.
  B. Adjust the launch template that is associated with the Auto Scaling group to be more sensitive to increases in user traffic.
  C. Create a scheduled scaling action to scale out the number of EC2 instances shortly before the increase in user traffic occurs.
  D. Manually add a few more EC2 instances to the Auto Scaling group to support the increase in user traffic. Enable instance scale-in protection on the Auto Scaling group.
  C. Create a scheduled scaling action to scale out the number of EC2 instances shortly before the increase in user traffic occurs.

  ---

  Explanation

  the AWS Cloud Operations and Compute documentation, when workloads exhibit predictable traffic patterns, the best practice is to use scheduled scaling for Amazon EC2 Auto Scaling groups. With scheduled scaling, administrators can predefine the desired capacity of an Auto Scaling group to increase before anticipated demand (in this case, before the 2-hour peak) and scale back down afterward. This ensures that sufficient compute capacity is provisioned proactively, avoiding performance degradation while maintaining cost efficiency.

  AWS notes: "Scheduled actions enable scaling your Auto Scaling group at predictable times, allowing you to pre-warm instances before demand spikes."

  Manual scaling (Option D) adds operational overhead. Adjusting launch templates (Option B) doesn't affect scaling behavior, and permanently increasing minimum capacity (Option A) wastes resources outside of peak hours.

  Thus, Option C provides an automated, cost-effective, and operationally efficient CloudOps solution.

  AWS Cloud Operations & Compute Optimization Guide - Using Scheduled Scaling for Predictable Workload Patterns

• Question 73:

  A company requires the rotation of administrative credentials for production workloads on a regular basis. A CloudOps engineer must implement this policy for an Amazon RDS DB instance's master user password.

  Which solution will meet this requirement with the LEAST operational effort?

  A. Create an AWS Lambda function to change the RDS master user password. Create an Amazon EventBridge scheduled rule to invoke the Lambda function.
  B. Create a new SecureString parameter in AWS Systems Manager Parameter Store. Encrypt the parameter with an AWS Key Management Service (AWS KMS) key. Configure automatic rotation.
  C. Create a new String parameter in AWS Systems Manager Parameter Store. Configure automatic rotation.
  D. Create a new RDS database secret in AWS Secrets Manager. Apply the secret to the RDS DB instance. Configure automatic rotation.
  D. Create a new RDS database secret in AWS Secrets Manager. Apply the secret to the RDS DB instance. Configure automatic rotation.

  ---

  Explanation

  AWS Secrets Manager natively supports credential management and automatic rotation for Amazon RDS master user passwords. When a secret is associated with an RDS instance, Secrets Manager automatically updates the password both in the secret and on the database, without downtime or manual scripting.

  AWS documentation confirms:

  "AWS Secrets Manager can automatically rotate the master user password for Amazon RDS databases. Rotation is fully managed and integrated, requiring no custom code or maintenance." Option A introduces unnecessary Lambda automation. Option B and C use Parameter Store, which does not provide direct RDS password rotation. Therefore, Option D achieves secure, automatic credential rotation with least operational effort, fully aligned with CloudOps security automation principles.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 4: Security and Compliance AWS Secrets Manager - Rotating Secrets for Amazon RD. AWS Well-Architected Framework

  - Security Pillar

  Amazon RDS User Guide - Managing Master User Passwords

• Question 74:

  A company must ensure that any new IAM policy granting public access to resources is detected quickly and investigated. The CloudOps engineer needs near real-time visibility into policy changes and the identity that made the change.

  Which solution will meet these requirements?

  A. Enable AWS CloudTrail and monitor IAM policy-related API calls; send notifications when specific events occur.
  B. Use VPC Flow Logs to detect policy changes.
  C. Enable Amazon Inspector to scan IAM policies continuously.
  D. Use EC2 instance recovery to restore prior IAM state.
  A. Enable AWS CloudTrail and monitor IAM policy-related API calls; send notifications when specific events occur.

  ---

  Explanation

  CloudTrail records IAM control-plane API activity, including who made a change (user/role/session), when it occurred, and the request parameters. By monitoring relevant IAM API calls (for example, Put*Policy, CreatePolicyVersion, AttachRolePolicy) and sending notifications when changes meet defined criteria, the CloudOps engineer can quickly detect risky permission changes and preserve an authoritative audit trail for investigations.

  VPC Flow Logs cannot see IAM API calls. Inspector does not evaluate IAM policies as its primary function. Instance recovery is unrelated to IAM configuration management.

  AWS CloudTrail - Monitoring IAM policy changes and alerting

• Question 75:

  A company's security policy requires incoming SSH traffic to be restricted to a defined set of addresses. The company is using an AWS Config rule to check whether security groups allow unrestricted incoming SSH traffic.

  A CloudOps engineer discovers a noncompliant resource and fixes the security group manually. The CloudOps engineer wants to automate the remediation of other noncompliant resources.

  What is the MOST operationally efficient solution that meets these requirements?

  A. Create a CloudWatch alarm for the AWS Config rule and invoke a Lambda function to remediate.
  B. Configure an automatic remediation via AWS Config rule using AWS- DisableIncomingSSHOnPort22.
  C. Create an EventBridge rule for AWS Config events and invoke a Lambda function.
  D. Run a scheduled Lambda function to inspect and remediate security groups.
  B. Configure an automatic remediation via AWS Config rule using AWS- DisableIncomingSSHOnPort22.

  ---

  Explanation

  AWS Config supports automatic remediation for both managed and custom rules. When a resource is found noncompliant, AWS Config can automatically invoke an AWS Systems Manager Automation document to remediate the issue. The managed automation document AWS- DisableIncomingSSHOnPort22 is specifically designed to remove unrestricted SSH access (0.0.0.0/0) from security group inbound rules.

  This approach is the most operationally efficient because it requires no custom code, no event orchestration, and no ongoing maintenance. The remediation runs immediately when AWS Config detects noncompliance and ensures consistent enforcement of security policy across all applicable resources.

  Options A, C, and D rely on Lambda functions and event-driven glue logic, which significantly increase operational overhead, complexity, and long-term maintenance costs. These approaches are unnecessary when AWS provides a fully managed remediation capability.

  Therefore, configuring an automatic remediation action directly on the AWS Config rule is the correct and most efficient solution.

• Question 76:

  A user working in the Amazon EC2 console increased the size of an Amazon Elastic Block Store (Amazon EBS) volume attached to an Amazon EC2 Windows instance. The change is not reflected in the file system.

  What should a CloudOps engineer do to resolve this issue?

  A. Extend the file system with operating system-level tools to use the new storage capacity.
  B. Reattach the EBS volume to the EC2 instance.
  C. Reboot the EC2 instance that is attached to the EBS volume.
  D. Take a snapshot of the EBS volume. Replace the original volume with a volume that is created from the snapshot.
  A. Extend the file system with operating system-level tools to use the new storage capacity.

  ---

  Explanation

  When an Amazon EBS volume is resized, the new storage capacity is immediately available to the attached EC2 instance. However, EBS does not automatically extend the file system. The CloudOps engineer must manually extend the file system within the operating system to utilize the additional space.

  AWS documentation for EC2 and EBS specifies:

  "After you increase the size of an EBS volume, use file system-specific tools to extend the file system so that the operating system can use the new storage capacity." On Windows instances, this can be achieved through Disk Management or diskpart commands. On Linux systems, utilities such as growpart and resize2fs are used. Options B and C do not modify file system metadata and are ineffective. Option D unnecessarily replaces the volume, which adds risk and downtime. Thus, Option A aligns with the Monitoring and Performance Optimization practices of AWS CloudOps by properly extending the file system to recognize the new capacity.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 1 Amazon EBS - Modifying EBS Volumes Amazon EC2 User Guide - Extending a File System After Resizing a Volume AWS Well-Architected Framework - Performance Efficiency Pillar

• Question 77:

  A CloudOps engineer must optimize storage performance for an Amazon EC2 Linux instance. The instance uses an Amazon EBS gp3 volume, and the workload experiences sustained high IOPS demand at predictable times each day. The engineer wants to avoid changing instance type.

  Which solution will MOST directly address the bottleneck?

  A. Enable EC2 hibernation to reduce disk usage.
  B. Increase the gp3 volume's provisioned IOPS and throughput settings.
  C. Convert the gp3 volume to magnetic storage for cost savings.
  D. Create an AMI of the instance and relaunch it in a different Availability Zone.
  B. Increase the gp3 volume's provisioned IOPS and throughput settings.

  ---

  Explanation

  For gp3 volumes, performance (IOPS and throughput) can be provisioned independently of volume size. If a workload is I/O bound and the performance requirement is predictable, increasing the gp3 provisioned IOPS and throughput is the most direct way to remove the storage bottleneck without modifying the instance type. This aligns with performance optimization best practices: tune the constrained component first, and use configurable EBS performance where supported. Hibernation affects instance state management, not sustained I/O performance. Magnetic storage is slower and would worsen the problem. Moving AZs is not a targeted storage-performance action and introduces operational risk and downtime.

  Amazon EBS - gp3 performance configuration (IOPS/throughput)

• Question 78:

  A CloudOps engineer needs to detect a recurring application error pattern in Amazon CloudWatch Logs and reduce alert noise.

  The engineer must send only one notification if the error occurs across multiple log groups within a short time window.

  Which solution will meet this requirement?

  A. Create a CloudWatch Logs subscription filter for each log group and send all matches to email.
  B. Create one CloudWatch alarm per log group and configure all alarms to send notifications directly to Amazon SNS.
  C. Create metric filters for each log group, create CloudWatch alarms for the derived metrics, and use a CloudWatch composite alarm to notify only when multiple alarms are in ALARM.
  D. Enable VPC Flow Logs and alert when traffic increases.
  C. Create metric filters for each log group, create CloudWatch alarms for the derived metrics, and use a CloudWatch composite alarm to notify only when multiple alarms are in ALARM.

  ---

  Explanation

  Metric filters convert specific log patterns into CloudWatch metrics, which can then drive CloudWatch alarms. To reduce noise when the same failure pattern appears across multiple components/log groups, a CloudWatch composite alarm can combine underlying alarms and trigger a single action when defined conditions are met (for example, "ALARM if any two of these alarms are ALARM," or "ALARM if all are ALARM"). This consolidates notifications and prevents alert storms while preserving signal quality. Option B increases noise because each alarm independently notifies. Option A is log streaming, not stateful alarming, and it does not inherently reduce duplication. Option D is unrelated to application error patterns in logs.

  Amazon CloudWatch - Metric filters, alarms, and composite alarms

• Question 79:

  A company wants to monitor the p95 latency of an application based on log data.

  Which CloudWatch feature should be used?

  A. Contributor Insights
  B. Metric filters
  C. Subscription filters
  D. Anomaly detection
  B. Metric filters

  ---

  Explanation

  Metric filters extract numerical values from logs and publish them as CloudWatch metrics, enabling percentile statistics such as p95.

  CloudWatch Logs - Metric Filters

• Question 80:

  An errant process is known to use an entire processor and run at 100% CPU. A CloudOps engineer wants to automate restarting an Amazon EC2 instance when the problem occurs for more than 2 minutes.

  How can this be accomplished?

  A. Create an Amazon CloudWatch alarm for the EC2 instance with basic monitoring. Add an action to restart the instance.
  B. Create an Amazon CloudWatch alarm for the EC2 instance with detailed monitoring. Add an action to restart the instance.
  C. Create an AWS Lambda function to restart the EC2 instance, invoked on a scheduled basis every 2 minutes.
  D. Create an AWS Lambda function to restart the EC2 instance, invoked by EC2 health checks.
  B. Create an Amazon CloudWatch alarm for the EC2 instance with detailed monitoring. Add an action to restart the instance.

  ---

  Explanation

  To detect CPU utilization issues within a 2-minute window, detailed monitoring is required. Basic monitoring publishes metrics at 5-minute intervals, which is too coarse to reliably detect a condition lasting only 2 minutes. Detailed monitoring publishes metrics at 1-minute granularity, allowing precise detection.

  Amazon CloudWatch alarms support EC2 reboot actions directly, eliminating the need for custom Lambda functions. This minimizes administrative overhead and leverages native AWS integrations.

  Options C and D introduce unnecessary complexity and delay. Option A cannot meet the timing requirement due to metric granularity.

  Therefore, using a CloudWatch alarm with detailed monitoring and an EC2 reboot action is the correct solution.