SOA-C03 sample exam questions

15 exam-style questions for AWS SOA-C03: CloudOps Engineer Associate, with answers and explanations. Take them as a timed practice exam first if you want a score out of 1000.

Take the free practice exam SOA-C03 exam guide
  1. Question 1Single choiceOther
    A company applies user-defined tags to resources that are associated with the company's AWS workloads. Twenty days after applying the tags, the company notices that it cannot use the tags to filter views in the AWS Cost Explorer console.
    What is the reason for this issue?
    1. A
      It takes at least 30 days to be able to use tags to filter views in Cost Explorer.
    2. B
      The company has not activated the user-defined tags for cost allocation.
    3. C
      The company has not created an AWS Cost and Usage Report.
    4. D
      The company has not created a usage budget in AWS Budgets.
    Show answer

    Correct answer: B

    Why

    User-defined tags must be activated as cost allocation tags in the Billing console before Cost Explorer can filter on them. Activation takes hours rather than 30 days, and neither a Cost and Usage Report nor a budget is required.

  2. Question 2Single choiceSecurity and Compliance
    A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications.
    A CloudOps engineer must prevent users from launching Amazon EC2 instances that do not have a CostCenter-Project tag into any account in the application OU. The restriction must apply only to accounts in the application OU.
    Which solution will meet these requirements?
    1. A
      Create an IAM group that has a policy that allows the ec2:RunInstances action when the CostCenter-Project tag is present. Place all IAM users who need access to the application accounts in the IAM group.
    2. B
      Create a service control policy (SCP) that denies the oc2:RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the application OU.
    3. C
      Create an IAM role that has a policy that allows the oc2:RunInstances action when the CostCenter-Project tag is present. Attach the IAM role to the IAM users that are in the application OU accounts.
    4. D
      Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the root OU.
    Show answer

    Correct answer: B

    Why

    An SCP attached to the application OU applies to all its accounts and can deny ec2:RunInstances when the aws:RequestTag condition shows the tag is missing. Attaching it to the root would affect every account, and IAM groups or roles can be bypassed by other identities.

  3. Question 3Single choiceReliability and Business Continuity
    A CloudOps engineer is responsible for a company’s disaster recovery procedures. The company has a source Amazon S3 bucket in a production account, and it wants to replicate objects from the source to a destination S3 bucket in a nonproduction account. The CloudOps engineer configures S3 cross-Region, cross-account replication to copy the source S3 bucket to the destination S3 bucket. When the CloudOps engineer attempts to access objects in the destination S3 bucket, they receive an Access Denied error.
    Which solution will resolve this problem?
    1. A
      Modify the replication configuration to change object ownership to the destination S3 bucket owner.
    2. B
      Ensure that the replication rule applies to all objects in the source S3 bucket and is not scoped to a single prefix.
    3. C
      Retry the request when the S3 Replication Time Control (S3 RTC) has elapsed.
    4. D
      Verify that the storage class for the replicated objects did not change between the source S3 bucket and the destination S3 bucket.
    Show answer

    Correct answer: A

    Why

    By default, replicated objects keep the source account as owner, so the destination account can be denied access to them. Changing the replication configuration to make the destination bucket owner the object owner fixes this. Prefix scope, S3 RTC timing and storage class do not cause this access error.

  4. Question 4Single choiceNetworking and Content Delivery
    A company wants to use AWS Systems Manager to manage a large fleet of Amazon EC2 instances. The company hosts the instances in private subnets. The company follows the principle of least privilege to assign access permissions. All private subnets have internet connectivity through a NAT gateway.
    A CloudOps engineer installs the latest version of the Systems Manager Agent (SSM Agent). However, the EC2 instances do not appear in Systems Manager Fleet Manager. The CloudOps engineer must resolve this issue.
    Which solution will meet this requirement?
    1. A
      Replace the NAT gateway with a NAT instance that is deployed in the public subnet. Update the private subnet's route table to use the NAT instance.
    2. B
      Create a VPC endpoint for Systems Manager. Remove routes to the internet through the NAT gateway from the private subnet's route table.
    3. C
      Attach the AmazonSSMManagedInstanceCore AWS managed policy to the EC2 instance profile that is associated with the instances.
    4. D
      Attach a custom policy that allows all actions to ssm* to the EC2 instance profile that is associated with the instances.
    Show answer

    Correct answer: C

    Why

    SSM Agent needs permissions to register with Systems Manager, and AmazonSSMManagedInstanceCore provides them with least privilege. The instances already have outbound access through the NAT gateway, so the network is not the problem, and ssm* grants too much.

  5. Question 5Single choiceMonitoring, Logging, Analysis, Remediation, and Performance Optimization
    A developer uses an Amazon Linux Amazon Machine Image (AMI) to launch an EC2 instance that hosts a third-party application. The application occasionally becomes unstable. The CloudOps engineer needs a solution to automatically reboot the EC2 instance whenever utilization is above 90% for 15 minutes and to notify the developer about the reboot.
    Which solution will meet these requirements with the LEAST administrative effort?
    1. A
      Configure an Amazon CloudWatch alarm that evaluates the CPU utilization of the instance. Configure the alarm to invoke an AWS Lambda function to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when the CloudWatch alarm activates. Configure the Lambda function to reboot the EC2 instance. Subscribe the developer to the SNS topic.
    2. B
      Create an Amazon CloudWatch alarm that evaluates the CPU utilization of the instance. Configure the alarm to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic and to perform an EC2 action to reboot the instance. Subscribe the developer to the SNS topic.
    3. C
      Create an Amazon CloudWatch alarm that evaluates the CPU utilization of the instance Configure the alarm to invoke an AWS Systems Manager action to create an incident to notify the developer and request the reboot.
    4. D
      Create an AWS Systems Manager runbook script to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic and to reboot the EC2 instance. Subscribe the developer to the SNS topic. Configure an Amazon CloudWatch alarm to run the Systems Manager runbook when CPU utilization for the instance remains above 90% for more than 15 minutes.
    Show answer

    Correct answer: B

    Why

    A CloudWatch alarm has a built-in EC2 reboot action and can publish to SNS at the same time, with no code. Lambda functions and runbooks add unnecessary work, and an incident does not reboot the instance automatically.

  6. Question 6Multiple responseDeployment, Provisioning, and Automation
    A CloudOps engineer has an AWS CloudFormation template of the company's existing infrastructure in us-west-2. The CloudOps engineer attempts to use the template to launch a new stack in eu-west-1, but the stack only partially deploys, receives an error message, and then rolls back.
    Why would this template fail to deploy? (Choose two.)
    1. A
      The template referenced an IAM user that is not available in eu-west-1.
    2. B
      The template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1.
    3. C
      The template did not have the proper level of permissions to deploy the resources.
    4. D
      The template requested services that do not exist in eu-west-1.
    5. E
      CloudFormation templates can be used only to update existing services
    Show answer

    Correct answer: B, D

    Why

    AMI IDs are specific to a Region, and not every service or resource type is available in every Region, so a template from us-west-2 can fail in eu-west-1. IAM is global, permissions are unrelated to a template's Region, and CloudFormation can create new stacks.

  7. Question 7Single choiceDeployment, Provisioning, and Automation
    A company uses hundreds of Amazon EC2 On-Demand Instances and Spot Instances to run production and non-production workloads. The company installs and configures the AWS Systems Manager Agent (SSM Agent) on the EC2 instances.

    During a recent instance patch operation, some instances were not patched because the instances were either busy or down. The company needs to generate a report that lists the current patch version of all instances.

    Which solution will meet these requirements in the MOST operationally efficient way?
    1. A
      Use Systems Manager Inventory to collect patch versions. Generate a report of all instances.
    2. B
      Use Systems Manager Run Command to remotely collect patch version information. Generate a report of all instances.
    3. C
      Use AWS Config to track EC2 instance configuration changes by using output from the SSM Agents. Create a custom rule to check for patch versions. Generate a report of all unpatched instances.
    4. D
      Use AWS Config to monitor the patch status of the EC2 instances by using output from the SSM Agents. Create a configuration compliance rule to check whether patches are installed. Generate a report of all instances.
    Show answer

    Correct answer: A

    Why

    Systems Manager Inventory automatically collects software and patch information from managed instances, and its data can be reported on across the fleet, using the last collected data even if an instance is busy or down when you report. Run Command needs the instance to be available, and AWS Config is not designed to report patch versions.

  8. Question 8Single choiceNetworking and Content Delivery
    A CloudOps engineer creates a new VPC that contains a private subnet, a security group that allows all outbound traffic, and an endpoint for Amazon EC2 Instance Connect in a private subnet. The CloudOps engineer associates the security group with EC2 Instance Connect.

    The CloudOps engineer launches an EC2 instance from an Amazon Linux Amazon Machine Image (AMI) in the private subnet. The CloudOps engineer associates the instance with the same subnet that the security group uses. The CloudOps engineer launches the EC2 instance without an SSH key pair.

    The CloudOps engineer tries to connect to the instance by using the EC2 Instance Connect endpoint. However, the connection fails.

    How can the CloudOps engineer connect to the instance?
    1. A
      Create an inbound rule in the security group to allow HTTPS traffic on port 443 from the private subnet.
    2. B
      Create an inbound rule in the security group to allow SSH traffic on port 22 from the private subnet.
    3. C
      Create an IAM instance profile that allows AWS Systems Manager Session Manager to access the EC2 instance. Associate the instance profile with the instance.
    4. D
      Recreate the EC2 instance. Associate an SSH key pair with the instance.
    Show answer

    Correct answer: B

    Why

    An EC2 Instance Connect Endpoint reaches the instance over SSH, so the instance's security group must allow inbound port 22 from the endpoint or its subnet. HTTPS is not used for this hop, Session Manager is a different service, and EC2 Instance Connect pushes a temporary key so a key pair is not needed.

  9. Question 9Single choiceDeployment, Provisioning, and Automation
    A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems Manager Agent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows only outbound traffic.

    A CloudOps engineer needs to give a group of privileged administrators the ability to connect to the instance through SSH without exposing the instance to the internet.

    Which solution will meet this requirement?
    1. A
      Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to allow inbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
    2. B
      Create a Systems Manager endpoint in the private subnet. Update the security group to allow SSH traffic from the private network where the Systems Manager endpoint is connected. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
    3. C
      Create an EC2 Instance Connect endpoint in the public subnet. Update the security group to allow SSH traffic from the private network. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
    4. D
      Create a Systems Manager endpoint in the public subnet. Create an IAM role that has the AmazonSSMManagedInstanceCore permission for the EC2 instance. Create an IAM group for privileged administrators. Assign the AmazonEC2ReadOnlyAccess IAM policy to the IAM group.
    Show answer

    Correct answer: A

    Why

    An EC2 Instance Connect Endpoint in the private subnet provides SSH access to an instance with no public exposure, and the instance's security group must allow inbound SSH from the endpoint. The administrators also need IAM permission to use the endpoint. A Systems Manager endpoint with a security group rule does not provide this SSH path, and the instance has no role for Systems Manager in option B.

  10. Question 10Single choiceOther
    A company is attempting to manage its costs in the AWS Cloud. A CloudOps engineer needs specific company-defined tags that are assigned to resources to appear on the billing report.

    What should the CloudOps engineer do to meet this requirement?
    1. A
      Activate the tags as AWS generated cost allocation tags.
    2. B
      Activate the tags as user-defined cost allocation tags.
    3. C
      Create a new cost category. Select the account billing dimension.
    4. D
      Create a new AWS Cost and Usage Report. Include the resource IDs.
    Show answer

    Correct answer: B

    Why

    Company-defined tags are user-defined cost allocation tags, and they appear in billing reports once activated in the Billing console. AWS generated tags are created by AWS, while cost categories and resource IDs do not add these tags to reports.

  11. Question 11Single choiceMonitoring, Logging, Analysis, Remediation, and Performance Optimization
    A company has business-critical resources in one of its AWS accounts. The company wants to receive an email notification every time an AWS Management Console root user sign-in event occurs in the account.

    Which solution will meet this requirement with the MOST operational efficiency?
    1. A
      Create an Amazon CloudWatch alarm that detects AWS Management Console root user sign-in events. Configure the alarm to send email notifications directly through AWS Trusted Advisor.
    2. B
      Launch an Amazon EC2 instance. Schedule a script to run every hour to analyze AWS CloudTrail events. Configure the script to send email notifications to an Amazon SNS topic when AWS Management Console root user sign-in events occur.
    3. C
      Create an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in events. Configure the rule to send email notifications to an Amazon SQS queue.
    4. D
      Create an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in events. Configure the rule to send email notifications to an Amazon SNS topic.
    Show answer

    Correct answer: D

    Why

    An EventBridge rule can match root console sign-in events recorded by CloudTrail and send them to an SNS topic with an email subscription. SQS does not send email, Trusted Advisor does not send alarm email, and an hourly script is less timely and needs maintenance.

  12. Question 12Single choiceReliability and Business Continuity
    A company needs to deploy a MySQL database on AWS to support an application. The database must be highly available and recoverable. The database must meet a recovery time objective (RTO) of 15 minutes. The database must meet a recovery point objective (RPO) of 5 minutes.

    Which solution will meet these requirements in the MOST operationally effective manner?
    1. A
      Deploy a MySQL database in a single Availability Zone by using Amazon RDS. Enable automated backups.
    2. B
      Deploy a MySQL database across two Availability Zones by using Amazon RDS with a Multi-AZ deployment. Enable point-in-time restore.
    3. C
      Deploy a MySQL database across two Availability Zones by using Amazon EC2 instances. Configure database replication and Amazon EBS volume snapshots.
    4. D
      Deploy a MySQL database across two Availability Zones by using Amazon RDS. Enable automated backups and database replication.
    Show answer

    Correct answer: B

    Why

    RDS Multi-AZ fails over automatically within minutes, which supports the 15-minute RTO, and point-in-time restore has a recovery window as recent as about 5 minutes. A single AZ is not highly available, and managing MySQL on EC2 adds operational work.

  13. Question 13Single choiceMonitoring, Logging, Analysis, Remediation, and Performance Optimization
    A company uses two production environments for deployments. A blue stack and a green stack are each behind a unique Application Load Balancer (ALB). The company wants to use DNS to send some traffic to green and gradually increase traffic over time. The company wants automatic tailback if green becomes unhealthy.

    Which DNS configuration will meet these requirements?
    1. A
      Create Amazon Route 53 weighted alias records that point to each ALB. Attach health checks. Adjust the weights during deployment.
    2. B
      Use Amazon Route 53 latency-based alias records for both ALBs with health checks. Reduce TTL. Add a checker-latency dashboard. Rely on the policy to steer a small percentage of traffic to green during the ramp.
    3. C
      Point the apex at one ALB. Register blue and green as target groups. Use a listener rule with weighted targets for gradual shifts. Rely on target-group health to shift traffic.
    4. D
      Use an Amazon Route 53 failover record. Set green as primary and blue as secondary. Set both to 50/50.
    Show answer

    Correct answer: A

    Why

    Route 53 weighted alias records split DNS traffic by chosen percentages between the ALBs, and health checks remove the unhealthy one automatically. Latency routing cannot set percentages, a failover record does not split traffic, and listener rules with a single ALB are not a DNS configuration.

  14. Question 14Single choiceSecurity and Compliance
    A compliance team requires all administrator passwords for Amazon RDS DB instances to be changed at least annually.

    Which solution meets this requirement in the MOST operationally efficient manner?
    1. A
      Store the database credentials in AWS Secrets Manager. Configure automatic rotation for the secret every 365 days.
    2. B
      Store the database credentials as a parameter in the RDS parameter group. Create a database trigger to rotate the password every 365 days.
    3. C
      Store the database credentials in a private Amazon S3 bucket. Schedule an AWS Lambda function to generate a new set of credentials every 365 days.
    4. D
      Store the database credentials in AWS Systems Manager Parameter Store as a secure string parameter. Configure automatic rotation for the parameter every 365 days.
    Show answer

    Correct answer: A

    Why

    Secrets Manager integrates with RDS and can rotate database credentials automatically on a set schedule. Parameter groups and S3 are not for credentials, and Parameter Store has no built-in automatic rotation for this.

  15. Question 15Single choiceNetworking and Content Delivery
    An application is running on an Amazon EC2 instance in a VPC with the default DHCP option set. The application connects to an on-premises Microsoft SQL Server database with the DNS name mssql.example.com. The application is unable to resolve the database DNS name.

    Which solution will fix this problem?
    1. A
      Create an Amazon Route 53 Resolver inbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
    2. B
      Create an Amazon Route 53 Resolver inbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
    3. C
      Create an Amazon Route 53 Resolver outbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
    4. D
      Create an Amazon Route 53 Resolver outbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
    Show answer

    Correct answer: C

    Why

    Outbound endpoints send DNS queries from the VPC to on-premises resolvers, and a forwarding rule for example.com directs those queries there when associated with the VPC. Inbound endpoints handle the opposite direction, and system rules are not used to forward a domain to on-premises DNS.