Free AWS SOA-C03 practice questions

10 free AWS SOA-C03 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 200 questions. Work through them, then open each answer to check your reasoning.

Get all 200 questions (US$39) · Download these 10 as a PDF

Question 1

A CloudOps engineer is examining the following AWS CloudFormation template:

Why will the stack creation fail?

Exhibit for question 1

  1. The Outputs section of the CloudFormation template was omitted.
  2. The Parameters section of the CloudFormation template was omitted.
  3. The PrivateDnsName cannot be sot from a CloudFormation template.
  4. The VPC was not specified in the CloudFormation template.
Show answer and explanation

Correct answer: C. The PrivateDnsName cannot be sot from a CloudFormation template.

CloudFormation template. The PrivateDnsName is not a valid property that can be set directly in a CloudFormation EC2 instance resource definition. PrivateDnsName is an attribute that is automatically assigned by AWS when an EC2 instance is launched within a VPC with DNS hostnames enabled, but it cannot be explicitly configured as a property in the template. This will cause the stack creation to fail because CloudFormation will reject the unknown property.

Why the other options are wrong

  • A. The Outputs section is optional in CloudFormation templates and its omission does not cause stack creation to fail.
  • B. The Parameters section is optional in CloudFormation templates and is not required for stack creation to succeed.
  • D. A VPC is not required to be explicitly specified in the template; if omitted, the instance will be launched in the default VPC.

Question 2

A company applies user-defined tags to resources that are associated with the company's AWS workloads. Twenty days after applying the tags, the company notices that it cannot use the tags to filter views in the AWS Cost Explorer console.

What is the reason for this issue?

  1. It takes at least 30 days to be able to use tags to filter views in Cost Explorer.
  2. The company has not activated the user-defined tags for cost allocation.
  3. The company has not created an AWS Cost and Usage Report.
  4. The company has not created a usage budget in AWS Budgets.
Show answer and explanation

Correct answer: B. The company has not activated the user-defined tags for cost allocation.

User-defined tags must be explicitly activated for cost allocation in AWS before they can be used to filter views in Cost Explorer. By default, tags are created but not enabled for cost allocation purposes. The activation process takes some time to propagate through the billing system, which is why tags applied 20 days ago are still not appearing as filter options. Once activated, tags typically become available within 24 hours.

Why the other options are wrong

  • A. While Cost Explorer data is delayed, tags can be activated and used much sooner than 30 days if they are properly enabled.
  • C. AWS Cost and Usage Reports are separate from tag activation and not required to use tags in Cost Explorer filtering.
  • D. AWS Budgets are independent of tag activation and do not control tag availability in Cost Explorer.

Question 3

An environment consists of 100 Amazon EC2 Windows instances. The Amazon CloudWatch agent is deployed and running on all EC2 instances with a baseline configuration file to capture log files. There is a new requirement to capture the DHCP log files that exist on 50 of the instances.

What is the MOST operationally efficient way to meet this new requirement?

  1. Create an additional CloudWatch agent configuration filo to capture the DHCP logs. Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file.
  2. Log in to each EC2 instance with administrator rights. Create a PowerShell script to push the needed baseline log files and DHCP log files to CloudWatch.
  3. Run the CloudWatch agent configuration file wizard on each EC2 instance. Verify that the baseline log files are included and add the DHCP log files during the wizard creation process.
  4. Run the CloudWatch agent configuration file wizard on each EC2 instance and select the advanced detail level. This will capture the operating system log files.
Show answer and explanation

Correct answer: A. Create an additional CloudWatch agent configuration filo to capture the DHCP logs. Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file.

The most operationally efficient approach is to create an additional configuration file for DHCP logs and use AWS Systems Manager Run Command with the append-config option to apply it to the 50 instances. This method avoids manual intervention on each instance, preserves the existing baseline configuration, and leverages automation at scale. The append-config option allows you to add new log sources without overwriting the existing configuration.

Why the other options are wrong

  • B. Manually logging into each of 50 instances and creating custom PowerShell scripts is not operationally efficient and does not scale well.
  • C. Running the configuration wizard on each of 50 instances is time-consuming and manual, lacking operational efficiency compared to Systems Manager automation.
  • D. The advanced detail level of the wizard does not specifically target DHCP logs and would not be a precise solution to the stated requirement.

Question 4

A company is storing backups in an Amazon S3 bucket. The backups must not be deleted for at least 3 months after the backups are created.

What should a CloudOps engineer do to meet this requirement?

  1. Configure an IAM policy that denies the s3:DeleteObject action for all users. Three months after an object is written, remove the policy.
  2. Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
  3. Enable S3 Versioning on the existing S3 bucket. Configure S3 Lifecycle rules to protect the backups.
  4. Enable S3 Object Lock on a new S3 bucket in governance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
Show answer and explanation

Correct answer: B. Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.

S3 Object Lock in compliance mode is the appropriate solution for enforcing non-deletable backups with a fixed retention period. In compliance mode, the retention period cannot be shortened by any user, including the AWS account root user, making it suitable for regulatory requirements. The 3-month retention period applied to all backups ensures they cannot be deleted before that time expires.

Why the other options are wrong

  • A. IAM policies can be modified and do not provide enforcement that persists automatically; manual policy removal would need to be tracked and executed.
  • C. S3 Versioning and Lifecycle rules do not prevent object deletion; they manage versions and transitions but lack the legal-hold compliance guarantees.
  • D. Governance mode allows the root user to override retention settings and delete objects before the retention period expires, which does not meet the hard requirement.

Question 5

A company's CloudOps engineer is troubleshooting communication between the components of an application. The company configured VPC flow logs to be published to Amazon CloudWatch Logs However, there are no logs in CloudWatch Logs.

What could be blocking the VPC flow logs from being published to CloudWatch Logs?

  1. The IAM policy that is attached to the IAM role for the flow log is missing the logs:CreateLogGroup permission.
  2. The IAM policy that is attached to the IAM role for the flow log is missing the logs:CreateExportTask permission.
  3. The VPC is configured for IPv6 addresses.
  4. The VPC is peered with another VPC in the AWS account
Show answer and explanation

Correct answer: A. The IAM policy that is attached to the IAM role for the flow log is missing the logs:CreateLogGroup permission.

VPC Flow Logs requires the IAM role to have the logs:CreateLogGroup permission to create the CloudWatch Logs log group where flow logs are published. Without this permission, the flow log service cannot initialize the log group, and no logs will appear in CloudWatch Logs even though the flow log itself may be active.

Why the other options are wrong

  • B. The logs:CreateExportTask permission is for exporting log data, not for publishing flow logs to CloudWatch Logs.
  • C. IPv6 configuration does not block VPC Flow Logs from being published; flow logs function with both IPv4 and IPv6 traffic.
  • D. VPC peering does not prevent flow logs from being published to CloudWatch Logs; it is unrelated to the logging mechanism.

Question 6

A company is migrating a legacy application to AWS. The company manually installs and configures the legacy application on Amazon EC2 instances across multiple Availability Zones. The company sets up an Application Load Balancer (ALB) for the application. The company sets the target group routing algorithm to weighted random. The application requires session affinity.

After the company deploys the application, users report random application errors that were not present in the legacy version of the application.

The target group health checks do not show any failures. The company must resolve the application errors.

Which solution will meet this requirement?

  1. Set the routing algorithm of the target group to least outstanding requests.
  2. Turn on anomaly mitigation for the target group.
  3. Turn off the cross-zone load balancing attribute of the target group.
  4. Increase the deregistration delay attribute of the target group.
Show answer and explanation

Correct answer: A. Set the routing algorithm of the target group to least outstanding requests.

The weighted random routing algorithm spreads requests across targets without any regard for prior requests, and it is not compatible with the sticky session behavior this application depends on, so users lose server-side session state and see random errors even though every target is healthy. Changing the target group routing algorithm to least outstanding requests puts the target group back on an algorithm that works with target group stickiness, so session affinity can be applied and the errors stop. The health checks stay green throughout because the targets themselves are functioning correctly, the problem is purely how requests are distributed.

Why the other options are wrong

  • B. Anomaly mitigation shifts traffic away from targets showing elevated error or connection anomalies and depends on the weighted random algorithm, so it neither restores session affinity nor addresses the real cause here.
  • C. Cross-zone load balancing controls whether targets in all Availability Zones receive traffic and has no influence on whether a user's requests keep landing on the same target.
  • D. Deregistration delay only governs how long in-flight requests are allowed to complete while a target is being removed from the target group.

Question 7

A company is using an Amazon Aurora MySQL DB cluster that has point-in-time recovery, backtracking, and automatic backup enabled. A CloudOps engineer needs to be able to roll back the DB cluster to a specific recovery point within the previous 72 hours. Restores must be completed in the same production DB cluster.

Which solution will meet these requirements?

  1. Create an Aurora Replica. Promote the replica to replace the primary DB instance.
  2. Create an AWS Lambda function to restore an automatic backup to the existing DB cluster.
  3. Use backtracking to rewind the existing DB cluster to the desired recovery point.
  4. Use point-in-time recovery to restore the existing DB duster to the desired recovery point.
Show answer and explanation

Correct answer: C. Use backtracking to rewind the existing DB cluster to the desired recovery point.

Aurora backtracking is the feature specifically designed to rewind an existing DB cluster to a previous point in time within the last 72 hours without creating a new cluster. It allows you to restore the production cluster in-place to a specific recovery point quickly, which directly meets the requirement to restore within the same production DB cluster.

Why the other options are wrong

  • A. Creating and promoting a replica creates a separate DB cluster, not a restoration of the existing production cluster to a previous state.
  • B. Lambda functions restoring automatic backups would create a new cluster, not restore the existing production cluster in-place.
  • D. Point-in-time recovery creates a new DB cluster; it does not restore the existing production cluster in-place as required.

Question 8

A CloudOps engineer is troubleshooting an AWS CloudFormation stack creation that failed. Before the CloudOps engineer can identify the problem, the stack and its resources are deleted. For future deployments, the CloudOps engineer must preserve any resources that CloudFormation successfully created.

What should the CloudOps engineer do to meet this requirement?

  1. Set the value of the DisableRollback parameter to False during stack creation.
  2. Set the value of the OnFailure parameter to DO_NOTHING during stack creation.
  3. Specify a rollback configuration that has a rollback trigger of DO_NOTHING during stack creation
  4. Set the value of the OnFailure parameter to ROLLBACK during stack creation.
Show answer and explanation

Correct answer: B. Set the value of the OnFailure parameter to DO_NOTHING during stack creation.

DO_NOTHING during stack creation. The OnFailure parameter of the CreateStack operation controls what CloudFormation does when stack creation fails, and DO_NOTHING leaves every resource that was successfully created in place. The engineer can then inspect the partially created stack and its resources to find the cause of the failure before cleaning up manually. The other OnFailure values, ROLLBACK and DELETE, remove the created resources and destroy the evidence.

Why the other options are wrong

  • A. DisableRollback set to False leaves automatic rollback enabled, so CloudFormation still deletes the successfully created resources after a failure.
  • C. A rollback configuration defines CloudWatch alarm based rollback triggers for monitoring a stack operation, and DO_NOTHING is not a valid rollback trigger.
  • D. Setting OnFailure to ROLLBACK is the default behavior that deletes the created resources, which is exactly the outcome the engineer needs to avoid.

Question 9

A company plans to run a public web application on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. The company’s security team wants to protect the website by using AWS Certificate Manager (ACM) certificates. The load balancer must automatically redirect any HTTP requests to HTTPS.

Which solution will meet these requirements?

  1. Create an Application Load Balancer that has one HTTPS listener on port 80. Attach an SSL/TLS certificate to listener port 80. Create a rule to redirect requests from HTTP to HTTPS.
  2. Create an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
  3. Create an Application Load Balancer that has two TCP listeners on port 80 and port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
  4. Create a Network Load Balancer that has two TCP listeners on port 80 and port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
Show answer and explanation

Correct answer: B. Create an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.

HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443. An Application Load Balancer supports HTTP and HTTPS listeners and can attach ACM certificates to the HTTPS listener. Configuring an HTTP listener on port 80 and an HTTPS listener on port 443 with the ACM certificate on port 443 lets you add a redirect action on the port 80 listener that sends all HTTP requests to HTTPS on port 443. This is the standard way to force encrypted traffic while still accepting plain HTTP connections from clients.

Why the other options are wrong

  • A. Configuring port 80 as an HTTPS listener means plain HTTP requests arriving on that port fail the TLS handshake instead of being redirected, because there is no HTTP listener to process and redirect them.
  • C. Application Load Balancer listeners only support the HTTP and HTTPS protocols, so a TCP listener cannot be created on an ALB.
  • D. A Network Load Balancer operates at Layer 4 and does not inspect HTTP requests, so it cannot apply listener rules that redirect HTTP to HTTPS.

Question 10

A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications.

A CloudOps engineer must prevent users from launching Amazon EC2 instances that do not have a CostCenter-Project tag into any account in the application OU. The restriction must apply only to accounts in the application OU.

Which solution will meet these requirements?

  1. Create an IAM group that has a policy that allows the ec2:RunInstances action when the CostCenter-Project tag is present. Place all IAM users who need access to the application accounts in the IAM group.
  2. Create a service control policy (SCP) that denies the oc2:RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the application OU.
  3. Create an IAM role that has a policy that allows the oc2:RunInstances action when the CostCenter-Project tag is present. Attach the IAM role to the IAM users that are in the application OU accounts.
  4. Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the root OU.
Show answer and explanation

Correct answer: B. Create a service control policy (SCP) that denies the oc2:RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the application OU.

Service Control Policies (SCPs) are the correct mechanism for enforcing organizationa-ide restrictions across multiple accounts within specific OUs. An SCP attached to the application OU will deny the ec2:RunInstances action when the CostCenter-Project tag is missing, effectively preventing any user or role in those accounts from launching untagged instances. This approach works across all identities in the affected accounts without requiring individual IAM configuration.

Why the other options are wrong

  • A. IAM groups are account-local constructs and cannot enforce restrictions across multiple accounts in an OU.
  • C. IAM roles attached to users are account-local and cannot enforce organization-wide restrictions across the application OU.
  • D. Attaching the SCP to the root OU would apply the restriction to all accounts in the organization, not just the application OU as required.

That was 10 of 200.

The full AWS SOA-C03 pack has all 200 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack