Amazon SOA-C03 Online Practice Questions and Exam Preparation

Amazon SOA-C03 Online Questions & Answers

• Question 81:

  A company needs to automatically scale EC2 capacity based on application demand.

  Which AWS service should be configured?

  A. AWS Auto Scaling
  B. Amazon CloudFront
  C. AWS Batch
  D. Amazon ECS
  A. AWS Auto Scaling

  ---

  Explanation

  AWS Auto Scaling dynamically adjusts EC2 capacity based on defined metrics and scaling policies, ensuring availability and cost efficiency.

  AWS Auto Scaling - EC2 Scaling

• Question 82:

  A media company hosts a public news and video portal on AWS. The portal uses an Amazon DynamoDB table with provisioned capacity to maintain an index of video files that are stored in an Amazon S3 bucket. During a recent event, millions of visitors came to the portal for news. This increase in traffic caused read requests to be throttled in the DynamoDB table. Videos could not be displayed in the portal.

  The company's operations team manually increased the provisioned capacity on a temporary basis to meet the demand. The company wants the operations team to receive an alert before the table is throttled in the future. The company has created an Amazon Simple Notification Service (Amazon SNS) topic and has subscribed the operations team's email address to the SNS topic.

  What should the company do next to meet these requirements?

  A. Create an Amazon CloudWatch alarm that uses the ConsumedReadCapacityUnits metric. Set the alarm threshold to a value that is close to the DynamoDB table's provisioned capacity. Configure the alarm to publish notifications to the SNS topic.
  B. Turn on auto scaling on the DynamoDB table. Configure an Amazon EventBridge rule to publish notifications to the SNS topic during scaling events.
  C. Turn on Amazon CloudWatch Logs for the DynamoDB table. Create an Amazon CloudWatch metric filter to pattern match the THROTTLING_EXCEPTION status code from DynamoDB. Create a CloudWatch alarm for the metric. Select the SNS topic for notifications.
  D. Configure the application to store logs in Amazon CloudWatch Logs. Create an Amazon CloudWatch metric filter to pattern match the THROTTLING_EXCEPTION status code from DynamoDB. Create a CloudWatch alarm for the metric.Select the SNS topic for notifications.
  A. Create an Amazon CloudWatch alarm that uses the ConsumedReadCapacityUnits metric. Set the alarm threshold to a value that is close to the DynamoDB table's provisioned capacity. Configure the alarm to publish notifications to the SNS topic.

  ---

  Explanation

  Creating a CloudWatch alarm on ConsumedReadCapacityUnits with a threshold close to the ProvisionedReadCapacityUnits provides proactive notification before throttling occurs. Detecting THROTTLING_EXCEPTION is reactive and occurs after throttling. Auto scaling does not guarantee pre- throttling alerting.

• Question 83:

  A company builds golden AMIs for production. The CloudOps engineer must automate image creation, include hardening steps, and run validation tests before AMIs are used.

  Which solution will meet these requirements?

  A. Use EC2 Image Builder pipelines with components for hardening and testing.
  B. Use Amazon Inspector to build AMIs from findings.
  C. Use CloudTrail to generate a new AMI when API calls occur.
  D. Use AWS Config to create AMIs when a rule becomes noncompliant.
  A. Use EC2 Image Builder pipelines with components for hardening and testing.

  ---

  Explanation

  EC2 Image Builder is designed to automate the full lifecycle of image creation: defining build components, applying hardening configurations, validating with tests, and distributing approved images. This ensures consistency and reduces the risk of drift or unapproved software. It also aligns with operational excellence by turning manual image maintenance into a repeatable pipeline with documented steps and predictable outcomes.

  Inspector evaluates vulnerabilities but does not orchestrate AMI build pipelines. CloudTrail records API activity, not image build workflows. AWS Config can detect noncompliance, but it is not a dedicated image build and test service.

  EC2 Image Builder - Automated AMI build, hardening, and validation pipelines

• Question 84:

  A company uses AWS Systems Manager Session Manager to manage EC2 instances in the eu-west-1 Region. The company wants private connectivity using VPC endpoints.

  Which VPC endpoints are required to meet these requirements? (Select THREE.)

  A. com.amazonaws.eu-west-1.ssm
  B. com.amazonaws.eu-west-1.ec2messages
  C. com.amazonaws.eu-west-1.ec2
  D. com.amazonaws.eu-west-1.ssmmessages
  E. com.amazonaws.eu-west-1.s3
  F. com.amazonaws.eu-west-1.states
  A. com.amazonaws.eu-west-1.ssm
  B. com.amazonaws.eu-west-1.ec2messages
  D. com.amazonaws.eu-west-1.ssmmessages

  ---

  Explanation

  The AWS Cloud Operations and Systems Manager documentation states that to use Session Manager privately within a VPC (without internet access), three interface VPC endpoints must be configured:

  com.amazonaws.<region>.ssm - enables Systems Manager core API communication. com.amazonaws.<region>.ec2messages - allows the agent to send and receive messages between EC. and Systems Manager. com.amazonaws.<region>.ssmmessages - enables real-time interactive communication for Session Manager connections.

  These endpoints ensure secure, private connectivity over the AWS network, eliminating the need for public internet routing. Endpoints for, or EC2 API (Options C, E, F) are not required for Session Manager S3 Step Functions functionality.

  Thus, the correct combination is A, B, and D, aligning with AWS CloudOps best practices for secure, private Systems Manager access.

  AWS Cloud Operations & Systems Manager Guide - Configuring VPC Endpoints for Session Manager Private Connectivity

• Question 85:

  A company needs to enforce tagging requirements for Amazon DynamoDB tables in its AWS accounts. A CloudOps engineer must implement a solution to identify and remediate all DynamoDB tables that do not have the appropriate tags.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Create a custom AWS Lambda function to evaluate and remediate all DynamoDB tables. Create an Amazon EventBridge scheduled rule to invoke the Lambda function.
  B. Create a custom AWS Lambda function to evaluate and remediate all DynamoDB tables. Create an AWS Config custom rule to invoke the Lambda function.
  C. Use the required-tags AWS Config managed rule to evaluate all DynamoDB tables for the appropriate tags. Configure an automatic remediation action that uses an AWS Systems Manager Automation custom runbook.
  D. Create an Amazon EventBridge managed rule to evaluate all DynamoDB tables for the appropriate tags. Configure the EventBridge rule to run an AWS Systems Manager Automation custom runbook for remediation.
  C. Use the required-tags AWS Config managed rule to evaluate all DynamoDB tables for the appropriate tags. Configure an automatic remediation action that uses an AWS Systems Manager Automation custom runbook.

  ---

  Explanation

  AWS Cloud Operations, Governance, and Compliance documentation AWS Config provides managed rules that automatically evaluate resource configurations for compliance. The "required-tags" managed rule allows CloudOps teams to specify mandatory tags (e.g., Environment, Owner, CostCenter) and automatically detect non-compliant resources such as DynamoDB tables. Furthermore, AWS Config supports automatic remediation through AWS Systems Manager Automation runbooks, enabling correction actions (for example, adding missing tags) without manual intervention. This automation minimizes operational overhead and ensures continuous compliance across multiple accounts. Using a custom Lambda function (Options A or B) introduces unnecessary management complexity, while EventBridge rules alone (Option D) do not provide resource compliance tracking or historical visibility. Therefore, Option C provides the most efficient, fully managed, and compliant CloudOps solution.

  AWS Cloud Operations & Governance Guide - Section: Compliance Automation Using AWS Config Managed Rules and Systems Manager Remediation

• Question 86:

  A company runs a business application on more than 300 Linux-based instances. Each instance has the AWS Systems Manager Agent (SSM Agent) installed. The company expects the number of instances to grow in the future. All business application instances have the same user-defined tag.

  A CloudOps engineer wants to run a command on all the business application instances to download and install a package from a private repository. To avoid overwhelming the repository, the CloudOps engineer wants to ensure that no more than 30 downloads occur at one time.

  Which solution will meet this requirement in the MOST operationally efficient way?

  A. Use a secondary tag to create 10 batches of 30 instances each. Use a Systems Manager Run Command document to download and install the package. Run each batch one time.
  B. Use an AWS Lambda function to automatically run a Systems Manager Run Command document. Set reserved concurrency for the Lambda function to 30.
  C. Use a Systems Manager Run Command document to download and install the package. Use rate control to set concurrency to 30. Specify the target by using the user-defined tag.
  D. Use a parallel workflow state in AWS Step Functions. Set the number of parallel states to 30.
  C. Use a Systems Manager Run Command document to download and install the package. Use rate control to set concurrency to 30. Specify the target by using the user-defined tag.

  ---

  Explanation

  AWS Systems Manager Run Command includes a built-in rate control feature that allows administrators to control the maximum number of concurrent executions across target instances. This directly addresses the requirement to limit downloads to 30 at a time without custom orchestration or additional services.

  By targeting instances using tags, the solution automatically scales as new instances are added, which aligns with future growth expectations. Rate control ensures controlled concurrency and protects the private repository from overload.

  Option A is manual and does not scale operationally. Option B introduces unnecessary complexity with Lambda and concurrency management that does not map cleanly to instance execution concurrency. Option D significantly increases architectural complexity without added value.

  Run Command with rate control is the simplest, most native, and most scalable solution.

• Question 87:

  A CloudOps engineer needs to ensure that AWS resources across multiple AWS accounts are tagged consistently. The company uses an organization in AWS Organizations to centrally manage the accounts.

  The company wants to implement cost allocation tags to accurately track the costs that are allocated to each business unit.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Use Organizations tag policies to enforce mandatory tagging on all resources. Enable cost allocation tags in the AWS Billing and Cost Management console.
  B. Configure AWS CloudTrail events to invoke an AWS Lambda function to detect untagged resources and to automatically assign tags based on predefined rules.
  C. Use AWS Config to evaluate tagging compliance. Use AWS Budgets to apply tags for cost allocation.
  D. Use AWS Service Catalog to provision only pre-tagged resources. Use AWS Trusted Advisor to enforce tagging across the organization.
  A. Use Organizations tag policies to enforce mandatory tagging on all resources. Enable cost allocation tags in the AWS Billing and Cost Management console.

  ---

  Explanation

  Tagging is essential for governance, cost management, and automation in CloudOps operations. The AWS Organizations tag policies feature allows centralized definition and enforcement of required tag keys and accepted values across all accounts in an organization. the AWS CloudOps study guide under Deployment, Provisioning, and Automation, tag policies enable automatic validation of tags, ensuring consistency with minimal manual overhead.

  Once tagging consistency is enforced, enabling cost allocation tags in the AWS Billing and Cost Management console allows accurate cost distribution per business unit. AWS documentation states: "Use AWS Organizations tag policies to standardize tags across accounts. You can activate cost allocation tags in the Billing console to track and allocate costs." Option B introduces unnecessary complexity with Lambda automation. Option C detects but does not enforce tagging. Option D limits flexibility to Service Catalog resources only. Therefore, Option A provides a centrally managed, automated, and low-overhead solution that meets CloudOps tagging and cost- tracking requirements.

  References (AWS CloudOps Documents / Study Guide):

  AWS Certified CloudOps Engineer - Associate (SOA-C03) Exam Guide - Domain 3: Deployment, Provisioning and Automation AWS Organizations - Tag Policies AWS Billing and Cost Management - Cost Allocation Tags AWS Well-Architected Framework - Operational Excellence and Cost Optimization Pillars

• Question 88:

  A CloudOps engineer must ensure that S3 objects cannot be deleted for a defined retention period.

  Which solution should be used?

  A. S3 Versioning
  B. S3 Object Lock in compliance mode
  C. IAM deny policies
  D. S3 Lifecycle rules
  B. S3 Object Lock in compliance mode

  ---

  Explanation

  S3 Object Lock in compliance mode enforces WORM protection, preventing deletion even by the root user until the retention period expires.

  Amazon S3 - Object Lock

• Question 89:

  A CloudOps engineer needs to ensure that configuration drift on EC2 instances is detected continuously.

  Which AWS service should be used?

  A. AWS Config
  B. Amazon Inspector
  C. AWS CloudTrail
  D. AWS Trusted Advisor
  A. AWS Config

  ---

  Explanation

  AWS Config continuously evaluates resource configuration against defined rules and records drift over time.

  AWS Config - Continuous Compliance

• Question 90:

  A CloudOps engineer must deploy application updates to an Auto Scaling group with minimal downtime and the ability to stop and roll back if errors increase during deployment.

  Which solution will meet these requirements?

  A. Replace instances manually by terminating and relaunching them.
  B. Use AWS CodeDeploy with an in-place or blue/green deployment configuration for Auto Scaling groups.
  C. Use AWS Trusted Advisor to apply recommended changes.
  D. Use AWS Config to roll back the Auto Scaling group configuration.
  B. Use AWS CodeDeploy with an in-place or blue/green deployment configuration for Auto Scaling groups.

  ---

  Explanation

  CodeDeploy integrates with Auto Scaling groups to manage controlled deployments with health monitoring, phased rollouts, and rollback behavior. With appropriate deployment configuration, CodeDeploy can stop or roll back deployments when failures occur, minimizing downtime and operational risk. This directly satisfies "minimal downtime" and "ability to stop/roll back" requirements. Manual replacement is slow and increases downtime. Trusted Advisor does not perform deployments. AWS Config tracks and evaluates configuration but does not provide an application deployment orchestration engine with rollback controls.

  AWS CodeDeploy - Deployments to Auto Scaling groups with rollback