50 free AWS SOA-C03 practice questions from the CertStash pack of 200, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 50 free here, all 200 in the pack, and each step includes the one before it.
Get all 200 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A company applies user-defined tags to resources that are associated with the company's AWS workloads. Twenty days after applying the tags, the company notices that it cannot use the tags to filter views in the AWS Cost Explorer console.
What is the reason for this issue?
Show answer and explanation
Correct answer: B. The company has not activated the user-defined tags for cost allocation.
Applying user-defined tags to resources does not make them available for cost analysis on its own. The tag keys must also be activated as cost allocation tags, either on the Cost allocation tags page of the AWS Billing and Cost Management console or with the UpdateCostAllocationTagsStatus API operation. After tags are applied, a tag key can take up to 24 hours to appear on that page and up to another 24 hours to activate. Twenty days is far longer than this process requires, so the missing activation step is the cause of the problem.
Why the other options are wrong
- A. No 30-day waiting period exists, because a tag key becomes active within about a day or two of being applied and activated.
- C. An AWS Cost and Usage Report is a separate billing data export and is not a prerequisite for filtering by tags in Cost Explorer.
- D. AWS Budgets tracks spending or usage against thresholds, and a usage budget has no effect on which tags are available in Cost Explorer.
Question 2
An environment consists of 100 Amazon EC2 Windows instances. The Amazon CloudWatch agent is deployed and running on all EC2 instances with a baseline configuration file to capture log files. There is a new requirement to capture the DHCP log files that exist on 50 of the instances.
What is the MOST operationally efficient way to meet this new requirement?
Show answer and explanation
Correct answer: A. Create an additional CloudWatch agent configuration file to capture the DHCP logs. Use the AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file.
The CloudWatch agent supports multiple configuration files. An additional file that contains only the DHCP log settings can be added to the running agent with the append-config option, which combines it with the baseline file instead of replacing it. The additional file needs a different name from the baseline file, because a file with the same name overwrites the earlier one. AWS Systems Manager Run Command then applies the change and restarts the agent on each targeted instance, and only the 50 instances that need the DHCP logs are targeted, with no interactive login. The baseline configuration on all 100 instances stays intact.
Why the other options are wrong
- B. Logging in to each instance and maintaining a custom PowerShell script is manual work that duplicates what the installed CloudWatch agent already does.
- C. Running the interactive wizard on each instance is slow manual work, and it rebuilds log settings that the baseline file already holds.
- D. The detail level in the wizard selects which metrics the agent collects rather than log files, and running the wizard on each instance is manual work.
Question 3
A company is storing backups in an Amazon S3 bucket. The backups must not be deleted for at least 3 months after the backups are created.
What should a CloudOps engineer do to meet this requirement?
Show answer and explanation
Correct answer: B. Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
S3 Object Lock stores objects in a write-once-read-many model and prevents a locked object version from being deleted or overwritten during its retention period. In compliance mode, no user can delete a protected object version before the retention period ends, including the root user of the account, and the retention mode cannot be changed. The retention period also cannot be shortened. Placing the backups in a bucket with Object Lock enabled and a 3-month retention period therefore guarantees that each backup is kept for at least 3 months after it is created.
Why the other options are wrong
- A. A single deny policy cannot track the age of each object, and removing it after 3 months would also remove the protection from newer backups.
- C. S3 Versioning still allows a specific object version to be permanently deleted, and S3 Lifecycle rules manage transitions and expiration rather than prevent deletion.
- D. Governance mode lets users with the s3:BypassGovernanceRetention permission delete protected objects, so it does not guarantee that the backups remain for 3 months.
Question 4
A company's CloudOps engineer is troubleshooting communication between the components of an application. The company configured VPC flow logs to be published to Amazon CloudWatch Logs. However, there are no logs in CloudWatch Logs.
What could be blocking the VPC flow logs from being published to CloudWatch Logs?
Show answer and explanation
Correct answer: A. The IAM policy that is attached to the IAM role for the flow log is missing the logs:CreateLogGroup permission.
A flow log that delivers to Amazon CloudWatch Logs uses an IAM role, and the policy on that role must allow logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents, logs:DescribeLogGroups, and logs:DescribeLogStreams. If the policy lacks logs:CreateLogGroup, the flow logs service cannot create the destination log group when that group does not already exist, so no log data reaches CloudWatch Logs. The role must also have a trust policy that allows the vpc-flow-logs.amazonaws.com service to assume it. A gap in these permissions is the expected place to look when a flow log produces no logs.
Why the other options are wrong
- B. The logs:CreateExportTask permission exports log data from CloudWatch Logs to Amazon S3 and is not among the permissions required to deliver flow logs.
- C. VPC flow logs can capture traffic in a VPC that uses IPv6 addresses, so an IPv6 configuration does not block log delivery.
- D. VPC peering affects how traffic is routed between VPCs and has no effect on delivering flow logs to CloudWatch Logs.
Question 5
A company is migrating a legacy application to AWS. The company manually installs and configures the legacy application on Amazon EC2 instances across multiple Availability Zones. The company sets up an Application Load Balancer (ALB) for the application. The company sets the target group routing algorithm to weighted random. The application requires session affinity.
After the company deploys the application, users report random application errors that were not present in the legacy version of the application.
The target group health checks do not show any failures. The company must resolve the application errors.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: A. Set the routing algorithm of the target group to least outstanding requests.
The weighted random routing algorithm cannot be used with sticky sessions, so requests from one client can reach different targets. An application that requires session affinity then produces intermittent errors, even though every target passes its health checks because the targets themselves are healthy. Least outstanding requests is compatible with sticky sessions. With stickiness turned on for the target group, this algorithm selects the initial target, and later requests from the same client go to that same target. Changing the routing algorithm removes the restriction that prevents the application from receiving the session affinity it requires.
Why the other options are wrong
- B. Anomaly mitigation is available only with weighted random routing, which cannot be used with sticky sessions, so the session affinity problem would remain.
- C. Sticky sessions are not supported when cross-zone load balancing is turned off, so this change works against the session affinity requirement.
- D. Deregistration delay only controls how long in-flight requests can complete on a deregistering target and has no effect on session affinity.
Question 6
A company is using an Amazon Aurora MySQL DB cluster that has point-in-time recovery, backtracking, and automatic backup enabled. A CloudOps engineer needs to be able to roll back the DB cluster to a specific recovery point within the previous 72 hours. Restores must be completed in the same production DB cluster.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use backtracking to rewind the existing DB cluster to the desired recovery point.
Aurora backtracking rewinds an Aurora MySQL DB cluster in place to a chosen point in time, without restoring data from a backup and without creating a new cluster. The target backtrack window can be set to as long as 72 hours, which covers the required recovery range. Because the operation acts on the existing cluster, the rollback is completed in the same production DB cluster, which is the deciding requirement. Backtracking is already enabled on this cluster, so the CloudOps engineer only needs to specify the desired point in time.
Why the other options are wrong
- A. Promoting an Aurora Replica performs a failover within the cluster and leaves the shared data in its current state, so nothing returns to an earlier recovery point.
- B. Restoring an automatic backup creates a new DB cluster, so a Lambda function that calls this operation cannot complete the restore in the existing cluster.
- D. Point-in-time recovery restores the data to a new DB cluster, which fails the requirement to complete the restore in the same production DB cluster.
Question 7
A CloudOps engineer is troubleshooting an AWS CloudFormation stack creation that failed. Before the CloudOps engineer can identify the problem, the stack and its resources are deleted. For future deployments, the CloudOps engineer must preserve any resources that CloudFormation successfully created.
What should the CloudOps engineer do to meet this requirement?
Show answer and explanation
Correct answer: B. Set the value of the OnFailure parameter to DO_NOTHING during stack creation.
The OnFailure parameter of the CreateStack operation determines what CloudFormation does when stack creation fails, and its valid values are DO_NOTHING, ROLLBACK, and DELETE. The default value is ROLLBACK, which removes the resources that were created and explains why the resources disappeared before the investigation. Setting OnFailure to DO_NOTHING leaves the stack and every successfully created resource in place. The CloudOps engineer can then inspect those resources and the stack events to identify the cause of the failure in future deployments.
Why the other options are wrong
- A. A DisableRollback value of False is the default and keeps rollback turned on, so CloudFormation would still remove the created resources.
- C. Rollback triggers are Amazon CloudWatch alarms that CloudFormation monitors, and DO_NOTHING is not a trigger, so this configuration cannot preserve resources.
- D. ROLLBACK is the default behavior that already removed the resources, so setting it explicitly would change nothing.
Question 8
A company plans to run a public web application on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. The company’s security team wants to protect the website by using AWS Certificate Manager (ACM) certificates. The load balancer must automatically redirect any HTTP requests to HTTPS.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
An Application Load Balancer operates at the application layer and supports HTTP and HTTPS listeners, which makes it the right load balancer for protocol redirects. The HTTPS listener on port 443 uses an AWS Certificate Manager (ACM) certificate to terminate TLS connections from clients. The HTTP listener on port 80 accepts unencrypted requests and uses a redirect action to send those clients to HTTPS on port 443. Both listeners are necessary, because the load balancer must be able to receive a plain HTTP request before it can redirect that request.
Why the other options are wrong
- A. A single HTTPS listener on port 80 expects TLS connections, so it cannot accept plain HTTP requests from clients in order to redirect them.
- C. Application Load Balancers support HTTP and HTTPS listeners only, so two TCP listeners cannot be created on this load balancer type.
- D. A Network Load Balancer operates at the transport layer, so its TCP listeners cannot inspect HTTP requests or apply redirect rules.
Question 9
A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications.
A CloudOps engineer must prevent users from launching Amazon EC2 instances that do not have a CostCenter-Project tag into any account in the application OU. The restriction must apply only to accounts in the application OU.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter-Project tag is missing. Attach the SCP to the application OU.
A service control policy (SCP) sets guardrails on the maximum available permissions for accounts in AWS Organizations, and an SCP attached to an organizational unit (OU) affects every account in that OU and no accounts outside it. A deny statement for ec2:RunInstances, with a condition that matches requests missing the CostCenter-Project tag, blocks untagged launches. An explicit deny overrides any allow in IAM policies, so users in those accounts cannot launch untagged instances regardless of their own permissions. Attaching the policy to the application OU meets both the enforcement requirement and the scope requirement.
Why the other options are wrong
- A. An IAM group policy that allows the action does not stop other policies from granting it, and IAM groups must be maintained separately in each account.
- C. IAM roles are assumed rather than attached to IAM users, and an allow statement does not block launches that other policies permit.
- D. Attaching the SCP to the organization root applies it to all accounts, which breaks the requirement to restrict only the application OU.
Question 10
A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must ensure that all AWS resources meet specific security requirements.
The company must not deploy any EC2 instances in the ap-southeast-2 Region. The company must completely block root user actions in all member accounts. The company must prevent any user from deleting AWS CloudTrail logs, including administrators.
The company requires a centrally managed solution that the company can automatically apply to all existing and future accounts.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use AWS Control Tower for account governance. Configure Region deny controls. Use service control policies (SCPs) to restrict root user access.
AWS Control Tower provides central governance for a multi-account organization and applies its controls to accounts enrolled in or created through the landing zone, including future accounts. The Region deny control blocks activity in Regions that the company does not allow. Service control policies (SCPs) restrict the IAM users and roles in a member account, including the root user and administrators, so they can block root user actions and deny the deletion of AWS CloudTrail logs. These are preventive guardrails: a denied action never takes place, which is what the absolute requirements in the scenario demand.
Why the other options are wrong
- A. AWS Config rules detect violations after they occur and must be set up in each account, and IAM permissions boundaries cannot be applied to the root user.
- B. AWS Security Hub reports security findings and does not prevent actions, so remediating after the fact cannot block root user actions or log deletion.
- D. AWS Firewall Manager manages firewall and network protection rules, and AWS Config conformance packs only evaluate compliance, so neither blocks these actions.
What people say about the full SOA-C03 pack 5.0 from 5
Question 11
A CloudOps engineer needs to configure a caching layer for a read-heavy application that uses an Amazon RDS for PostgreSQL database. The application exists across three AWS Regions. Read and write activities occur in the primary Region. In the two secondary Regions, read-only activity occurs on RDS for PostgreSQL cross-Region read replicas.
The cache in each Region must consist of the same data to provide a consistent user experience across Regions.
Which solution for the caching layer will meet these requirements?
Show answer and explanation
Correct answer: A. Set up an Amazon ElastiCache (Redis OSS) global datastore. Include a read and write cluster in the primary Region. Include a read-only cluster in each secondary Region.
Global Datastore for Amazon ElastiCache (Redis OSS) provides fully managed, low-latency replication across AWS Regions. It uses one primary cluster that accepts reads and writes and up to two read-only secondary clusters in other Regions, which matches the three-Region design exactly. The cache is written in the primary Region and replicated to each secondary Region, so all three Regions hold the same cached data and users receive a consistent experience. This layout also mirrors the database topology, in which writes occur in the primary Region and the secondary Regions serve only reads through cross-Region read replicas.
Why the other options are wrong
- B. ElastiCache (Memcached) does not support global datastores or replication, so it cannot keep the same cache data in all three Regions.
- C. RDS for PostgreSQL offers no query cache replication to cross-Region read replicas, so this configuration is not available.
- D. ElastiCache (Memcached) has no cross-Region replication, and cluster mode is a feature of ElastiCache (Redis OSS), so this configuration cannot be built.
Question 12
A company has an internal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone. A CloudOps engineer must make the application highly available.
Which action should the CloudOps engineer take to meet this requirement?
Show answer and explanation
Correct answer: C. Update the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.
High availability requires the application to keep running when a single Availability Zone fails, and an Auto Scaling group confined to one Availability Zone cannot do that at any capacity. Adding a subnet in a second Availability Zone of the same AWS Region lets the group launch and balance instances across both zones and replace capacity in the healthy zone during a disruption. With the Application Load Balancer enabled in both zones, traffic goes only to healthy targets. This change needs no redesign because Auto Scaling groups and Application Load Balancers are built to span Availability Zones within a Region.
Why the other options are wrong
- A. A higher maximum only allows more instances to launch in the same Availability Zone, so the application still goes down when that zone fails.
- B. A higher minimum keeps more instances running in one Availability Zone, so that zone remains a single point of failure.
- D. An Auto Scaling group is a regional resource whose subnets must belong to one VPC, so it cannot launch instances in a second AWS Region.
Question 13
A company uses Amazon EC2 Auto Scaling across multiple Availability Zones. The company must ensure that EC2 instances are provisioned in private subnets.
The company recently optimized its cloud infrastructure by reducing the number of NAT gateways in the company’s VPC to one. Some EC2 instances lost internet connectivity after the infrastructure update. A CloudOps engineer must resolve the connectivity issue.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: B. Update VPC route tables to target the existing NAT gateway for internet traffic.
Instances in private subnets reach the internet through a route table entry that sends 0.0.0.0/0 traffic to a NAT gateway. When the company removed the extra NAT gateways, any route tables that pointed to them were left with routes to deleted gateways, which appear as blackhole routes, and the subnets using those tables lost connectivity. Updating every private subnet route table so that its default route targets the remaining NAT gateway restores outbound access, and the instances stay in private subnets as required.
Why the other options are wrong
- A. A NAT instance in the same subnet leaves the stale routes in place and adds a resource to manage, so the affected subnets still lack a working path.
- C. A route to an internet gateway would make the subnets public, which breaks the requirement that instances run in private subnets.
- D. Secondary IP addresses relate to connection capacity on the NAT gateway and do not fix routes that still point to removed NAT gateways.
Question 14
A company runs a web application on three Amazon EC2 instances behind an Application Load Balancer (ALB). The company notices that random periods of increased traffic cause a degradation in the application’s performance. A CloudOps engineer must scale the application to meet the increased traffic.
Which solution meets these requirements?
Show answer and explanation
Correct answer: C. Deploy the application to an Auto Scaling group of EC2 instances with a target tracking scaling policy. Attach the ALB to the Auto Scaling group.
Traffic that increases at random times requires scaling that reacts to current demand. An Auto Scaling group with a target tracking scaling policy continuously compares a chosen metric, such as average CPU utilization or requests per target, against a target value and adds or removes instances to stay close to that value. Attaching the ALB to the Auto Scaling group means that new instances are registered with the target group automatically and receive traffic after they pass health checks. This approach handles unpredictable surges without manual action, and it reduces capacity again when traffic subsides.
Why the other options are wrong
- A. Increasing the size of an instance requires stopping it, which interrupts service during a traffic surge, and a CloudWatch alarm has no built-in action to resize an instance.
- B. An EventBridge rule does not launch and register instances by itself, so this design requires custom automation that an Auto Scaling group already provides.
- D. Scheduled scaling changes capacity at predefined times, so it cannot respond to traffic increases that occur at random.
Question 15
A company hosts an ecommerce website on a fleet of Nitro-based Amazon EC2 Linux instances. During a recent sales event, some customers reported HTTP timeout errors.
To help identify the root cause of the errors, a CloudOps engineer needs more detailed network metrics from the Elastic Network Adapter (ENA) driver. The CloudOps engineer must obtain the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
Which solution will provide these metrics with the MOST operational efficiency?
Show answer and explanation
Correct answer: A. Install the Amazon CloudWatch agent on the instances. Filter by the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
Linux instances that use the Elastic Network Adapter expose network performance metrics through the ENA driver, and the Amazon CloudWatch agent can import them directly. The engineer installs the agent and adds an ethtool section under metrics_collected in the agent configuration file, listing conntrack_allowance_available and conntrack_allowance_exceeded in metrics_include. The agent then sends the metrics to CloudWatch with an ethtool_ prefix, where the engineer can graph them and set alarms. The metrics show whether the instances approached or exceeded their connection tracking allowance during the sales event. Because the ethtool plugin is built into the agent, no additional software is needed, which makes this the most operationally efficient choice.
Why the other options are wrong
- B. The collectd daemon is unnecessary because the CloudWatch agent collects these metrics through its ethtool plugin, so installing it only adds software to manage.
- C. VPC Flow Logs record information about IP traffic, and they do not contain ENA driver metrics such as connection tracking allowance values.
- D. Performance Insights is a database performance feature for Amazon RDS and Aurora, and it does not apply to EC2 instances or ENA driver metrics.
Question 16
A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems Manager Agent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows only outbound traffic.
A CloudOps engineer needs to give a group of privileged administrators the ability to connect to the instance through SSH without exposing the instance to the internet.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: A. Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to allow inbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
An EC2 Instance Connect Endpoint in the private subnet provides SSH access to the instance through a private tunnel, so the instance needs no public IP address and stays unexposed to the internet. The security group must be updated to allow inbound SSH traffic, because it currently allows only outbound traffic. Access to the tunnel is controlled through IAM, so an IAM group gives the privileged administrators one place to receive the necessary permissions. The PowerUserAccess managed policy gives this group the broad service access that includes opening a tunnel through the endpoint.
Why the other options are wrong
- B. A Systems Manager endpoint does not relay inbound SSH traffic to an instance, and this design gives the instance no role for registering with Systems Manager.
- C. An endpoint in the public subnet connects from a public subnet address, which a rule allowing only the private network does not match, and the placement adds no benefit.
- D. AmazonEC2ReadOnlyAccess does not allow administrators to start connections, and a Systems Manager endpoint does not by itself provide the SSH connection that the administrators need.
Question 17
A company stores critical information in an Amazon RDS for PostgreSQL database. The company notices degraded performance, high CPU utilization, increased query latency, and connection timeouts during peak shopping hours. The company also identifies surges in user connections during peak hours. The connection surges affect the read performance of the database.
The company wants to resolve the database performance issues.
Which combination of steps will meet this requirement? (Choose two.)
Show answer and explanation
Correct answer: A, E. Use Amazon RDS Performance Insights to analyze the SQL queries that most affect database performance. Update the SQL queries based on the analysis findings; Implement RDS Proxy with connection pooling.
The symptoms point to two separate causes: expensive queries and connection surges. Amazon RDS Performance Insights, whose dashboard is now part of Amazon CloudWatch Database Insights, visualizes database load and identifies the SQL statements that contribute most to it, so the company can tune those queries and lower CPU utilization and latency. RDS Proxy addresses the surges by maintaining a pool of established database connections and sharing them among application clients. This pooling reduces the CPU and memory overhead of opening new connections and helps prevent connection timeouts during peak shopping hours. Together, these steps reduce the load that each query places on the database and protect the database from sudden increases in connections.
Why the other options are wrong
- B. CloudWatch Logs Insights only searches log data that has been exported to CloudWatch Logs, and it lacks the database load analysis by SQL statement that Performance Insights provides.
- C. A single Availability Zone deployment has no standby and offers lower availability, and it does nothing to reduce query load or connection surges.
- D. Disabling connection pooling forces the database to handle every connection directly, which increases overhead and worsens the timeouts during surges.
Question 18
A financial services company stores customer images in an Amazon S3 bucket in the us-east-1 Region. To comply with regulations, the company must ensure that all existing objects are replicated to an S3 bucket in a second AWS Region. If an object replication fails, the company must be able to retry replication for the object.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Configure Amazon S3 Cross-Region Replication (CRR). Use S3 Batch Replication to replicate existing objects.
S3 Cross-Region Replication copies objects to a bucket in another AWS Region, but live replication applies only to new objects and object updates created after the configuration is in place. S3 Batch Replication runs on demand as a Batch Operations job and replicates objects that existed before the configuration, which meets the requirement for existing objects. It also handles objects that have failed replication: a job filtered on the FAILED replication status retries those objects. This combination therefore satisfies both the regulatory copy and the ability to retry failures.
Why the other options are wrong
- A. Live replication copies only newly created objects and updates, so it does not replicate objects that already exist in the bucket.
- C. S3 Replication Time Control adds a replication time objective and monitoring for new objects, and it does not copy existing objects or retry failed ones.
- D. S3 Lifecycle rules transition or expire objects within a bucket and cannot move objects to a bucket in another Region.
Question 19
A company uses an Amazon CloudFront distribution to serve a static website that the company hosts on an Amazon S3 bucket. The S3 bucket is the origin of the CloudFront distribution. The website has users all over the world.
The company updates some content for the website. After the update, users report that they are encountering the previous version of the content.
The company must ensure that website users receive only the most current content.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: D. Use CloudFront invalidation when new content is uploaded.
Amazon CloudFront edge locations keep cached copies of objects until they expire, so viewers can receive the previous version after the origin object changes. An invalidation removes specified objects from the edge caches before they expire, which means the next request for each path goes to the S3 origin and retrieves the updated content. Running an invalidation for the changed paths as part of each content release ensures that users all over the world receive only the current version. The S3 bucket needs no other changes, and the distribution continues to serve cached content for paths that have not changed.
Why the other options are wrong
- A. S3 ACLs control access to objects and do not remove outdated copies from CloudFront edge caches.
- B. S3 Versioning keeps object versions in the bucket and does not remove the previous version that CloudFront already holds in its edge caches.
- C. CloudFront serves content from a global network of edge locations and is not located in an Availability Zone, so upload location does not refresh its caches.
Question 20
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company needs an AWS Lambda function to perform a custom recovery procedure on the application server when the application returns an HTTP 500 status code.
A CloudOps engineer needs to design a solution that detects HTTP 500 status codes and runs the Lambda function reliably when errors are detected.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Configure an Amazon CloudWatch alarm on the HTTPCode_Target_5XX_Count ALB target group metric. Set the alarm action to run the Lambda function.
The HTTPCode_Target_5XX_Count metric counts the HTTP 5XX response codes that targets return through an Application Load Balancer, and the load balancer sends it to Amazon CloudWatch automatically. A CloudWatch alarm on this metric detects the errors without any log parsing or polling code. CloudWatch alarms support a Lambda function as a direct alarm action, so when the alarm enters the ALARM state, CloudWatch invokes the recovery function. The function needs a resource-based policy that allows CloudWatch alarms to invoke it. This approach uses managed monitoring and a managed trigger, which makes it a reliable way to run the recovery procedure.
Why the other options are wrong
- B. ALB access logs are delivered to Amazon S3 periodically, so a function that continuously scans them adds delay, cost, and custom polling logic to maintain.
- C. AWS CloudTrail records API activity for an AWS account and is not enabled on instances, so it does not capture HTTP status codes from the application.
- D. An ALB does not send individual request events to Amazon EventBridge, so a rule like this has no events to match.
Question 21
A company launches an application. The company hosts the application on Amazon EC2 instances. The instances are in a private subnet for security reasons.
An application team needs SSH access to the instances from corporate desktops in an office. The desktops are connected to the internet.
Which solution will provide this access?
Show answer and explanation
Correct answer: B. Create an AWS Site-to-Site VPN connection between the on-premises network and the VPC.
AWS Site-to-Site VPN creates an encrypted connection over the internet between the on-premises network and the VPC, so corporate desktops can reach private IP addresses in the VPC. With routes for the office network in the private subnet route table and a security group rule that allows SSH from that network, the application team can connect directly to the instances. The instances stay in the private subnet with no public IP addresses and no inbound exposure to the internet, which preserves the security design. The office needs a customer gateway device to terminate the VPN tunnels, and the desktops then use the tunnels without any per-user configuration.
Why the other options are wrong
- A. A NAT gateway only lets private instances start outbound connections, so it cannot carry inbound SSH sessions from the office.
- C. An internet gateway provides a path only for subnets that route to it and instances with public addresses, so it gives no access to instances in a private subnet.
- D. Security group rules only filter traffic and do not create a network path, and rules on resources in public subnets do not affect the private instances.
Question 22
A company uses hundreds of Amazon EC2 On-Demand Instances and Spot Instances to run production and non-production workloads. The company installs and configures the AWS Systems Manager Agent (SSM Agent) on the EC2 instances.
During a recent instance patch operation, some instances were not patched because the instances were either busy or down. The company needs to generate a report that lists the current patch version of all instances.
Which solution will meet these requirements in the MOST operationally efficient way?
Show answer and explanation
Correct answer: A. Use Systems Manager Inventory to collect patch versions. Generate a report of all instances.
AWS Systems Manager Inventory uses the SSM Agent that is already on the instances to collect metadata on a schedule, including installed applications, Windows updates, and patch summary and compliance data. An instance that was busy or down during one operation reports its data at a later collection, so the company does not need to reach each instance individually. The collected data can be queried centrally and aggregated across instances into a report. Because the agents are already in place and collection is managed, this approach is the most operationally efficient way to report on all instances.
Why the other options are wrong
- B. Run Command requires each instance to be available when the command runs and leaves the company to write the collection logic and combine the output into a report.
- C. A custom AWS Config rule requires development and maintenance, and it evaluates compliance and reports only unpatched instances rather than the patch version of all instances.
- D. An AWS Config compliance rule returns a compliant or noncompliant status rather than listing the current patch version of each instance.
Question 23
A company has a web application that is experiencing performance problems many times each night. A root cause analysis reveals sudden increases in CPU utilization that last 5 minutes on an Amazon EC2 Linux instance. A CloudOps engineer must find the process ID (PID) of the service or process that is consuming more CPU.
What should the CloudOps engineer do to collect the process utilization information with the LEAST amount of effort?
Show answer and explanation
Correct answer: A. Configure the Amazon CloudWatch agent procstat plugin to capture CPU process metrics.
The procstat plugin of the Amazon CloudWatch agent collects metrics from individual processes on Linux servers, including cpu_usage, cpu_time, and the pid process identifier. Processes are selected with an exe, pattern, or pid_file setting in the agent configuration file. Once configured, the agent captures these values continuously and sends them to CloudWatch, so the nightly 5-minute spikes are recorded without anyone watching the instance. The engineer can then review the metrics for the spike periods to see which process consumed the most CPU and identify its PID. This requires only a change to the agent configuration, which is the least effort.
Why the other options are wrong
- B. A Lambda function runs outside the instance and cannot inspect operating system processes without custom integration, which is far more work than configuring a plugin.
- C. Logging in every night and running top is manual, depends on catching short spikes at unpredictable times, and demands far more effort than automatic collection.
- D. The default EC2 CPUUtilization metric reports CPU usage for the whole instance from the hypervisor level and contains no per-process detail or PID.
Question 24
A company deploys AWS infrastructure in a VPC that has an internet gateway. The VPC has public subnets and private subnets. An Amazon RDS for MySQL DB instance is deployed in a private subnet. An AWS Lambda function uses the same private subnet and connects to the DB instance to query data.
A developer modifies the Lambda function to require the function to publish messages to an Amazon Simple Queue Service (Amazon SQS) queue.
After these changes, the Lambda function times out when it tries to publish messages to the SQS queue.
Which solutions will resolve this issue? (Choose two.)
Show answer and explanation
Correct answer: C, D. Deploy a NAT gateway. Update the private subnet's route table to route all traffic to the NAT gateway; Create an interface endpoint for Amazon SQS in the VPC.
A Lambda function attached to a VPC uses private network interfaces and has no direct path to public AWS service endpoints, so calls to the Amazon SQS API time out from a private subnet that has no route out. A NAT gateway resolves this by giving the private subnet outbound internet access: the NAT gateway resides in a public subnet, and the private subnet route table sends internet-bound traffic to it. An interface VPC endpoint for Amazon SQS resolves the problem in a different way by placing a private entry point to the service inside the VPC, so traffic reaches SQS without leaving the AWS network. Either change restores connectivity while the function retains its database access.
Why the other options are wrong
- A. Disconnecting the function from the VPC removes its network path to the RDS DB instance in the private subnet, so its database queries would fail.
- B. An RDS proxy only manages connections to the database and does not create any network path to Amazon SQS.
- E. Gateway endpoints are available only for Amazon S3 and Amazon DynamoDB, so a gateway endpoint cannot be created for Amazon SQS.
Question 25
A company runs a workload in an Amazon VPC. The company configures Amazon CloudWatch Logs for the workload. The company needs a solution to automatically detect unusual API activity and security events in the company's AWS account.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: C. Implement AWS CloudTrail Insights.
AWS CloudTrail Insights continuously analyzes CloudTrail events to establish a baseline of normal API call volume and error rates for the account. When activity deviates from that baseline, such as a sudden spike in calls or errors, CloudTrail generates Insights events automatically, without any custom detection logic. This directly meets the need to detect unusual API activity and related security events in the account. The CloudWatch Logs configured for the workload hold application logs and play no part in this analysis, because the detection relies on the CloudTrail record of API activity.
Why the other options are wrong
- A. Amazon Inspector scans workloads for software vulnerabilities and network exposure, and it does not analyze VPC flow logs for unusual API activity.
- B. Amazon GuardDuty analyzes its own data sources, such as CloudTrail events, VPC Flow Logs, and DNS logs, and it does not monitor logs in CloudWatch Logs.
- D. AWS Config records resource configurations and evaluates them against rules, and it has no automatic anomaly detection feature for API activity.
Question 26
An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A CloudOps engineer must ensure that the application can read, write, and delete messages from the SQS queues.
Which solution will meet these requirements in the MOST secure manner?
Show answer and explanation
Correct answer: D. Create and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues.
Attaching an IAM role to the EC2 instance through an instance profile gives the application temporary credentials that AWS rotates automatically, so no long-term secret is stored on the instance or in the application. Scoping the role policy to sqs:SendMessage, sqs:ReceiveMessage, and sqs:DeleteMessage on the specific queues grants only the write, read, and delete abilities that the application needs. That combination applies the principle of least privilege to both the credential type and the permissions, which makes it the most secure design for this workload.
Why the other options are wrong
- A. Embedding long-term IAM user access keys in application configuration leaves permanent secrets that can leak and must be rotated by hand, which is far less secure than role credentials.
- B. Environment variables still hold long-term IAM user access keys on the instance, so the secrets can be exposed and lack the automatic rotation of instance role credentials.
- C. The sqs:* wildcard also allows actions the application does not need, such as deleting or purging queues, which violates least privilege.
Question 27
A CloudOps engineer must ensure that all of a company's current and future Amazon S3 buckets have logging enabled. If an S3 bucket does not have logging enabled, an automated process must enable logging for the S3 bucket.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Use the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that uses the AWS-ConfigureS3BucketLogging AWS Systems Manager Automation runbook to enable logging.
The s3-bucket-logging-enabled AWS Config managed rule evaluates S3 buckets for logging, and it covers both existing buckets and buckets that are created later. AWS Config remediation actions run AWS Systems Manager Automation runbooks. The AWS-ConfigureS3BucketLogging runbook is an AWS-owned runbook that enables logging on a specified bucket, so a noncompliant bucket can be corrected automatically with no custom code. Pairing the managed rule with this runbook provides the continuous detection and the automated process that the requirements specify, using only managed components.
Why the other options are wrong
- A. AWS Trusted Advisor checks report recommendations and cannot be configured to change the logging settings of a bucket.
- B. An S3 bucket policy controls access to one bucket and cannot require or enable logging on current and future buckets.
- C. AWS Config remediation actions run Systems Manager Automation runbooks rather than Lambda functions directly, so this design adds custom code that the AWS-owned runbook makes unnecessary.
Question 28
A CloudOps engineer creates a new VPC that includes a public subnet and a private subnet. The CloudOps engineer successfully launches 11 Amazon EC2 instances in the private subnet. The CloudOps engineer attempts to launch one more EC2 instance in the same subnet. However, the CloudOps engineer receives an error message that states that not enough free IP addresses are available.
What must the CloudOps engineer do to deploy more EC2 instances?
Show answer and explanation
Correct answer: D. Create a new private subnet to hold the required EC2 instances.
AWS reserves five IP addresses in every subnet, so a /28 subnet with 16 addresses provides exactly 11 usable addresses, which matches the failure on the twelfth instance. The CIDR block of an existing subnet cannot be resized, so the private subnet cannot grow to hold more instances. The CloudOps engineer must create a new private subnet from unused address space in the VPC, with a CIDR block large enough for the required instances, and then launch the additional EC2 instances in that subnet.
Why the other options are wrong
- A. A subnet CIDR block cannot be changed after the subnet is created, so the existing subnet cannot be edited to use a /27 range.
- B. A subnet exists in exactly one Availability Zone and cannot be extended into a second Availability Zone.
- C. Elastic IP addresses are public IPv4 addresses that associate with instances or network interfaces, and they do not add private addresses to a subnet.
Question 29
A company manages a set of accounts on AWS by using AWS Organizations. The company's security team wants to use a native AWS service to regularly scan all AWS accounts against the Center for Internet Security (CIS) AWS Foundations Benchmark.
What is the MOST operationally efficient way to meet these requirements?
Show answer and explanation
Correct answer: D. Designate an AWS Security Hub administrator account. Configure new accounts in the organization to automatically become member accounts. Enable CIS AWS Foundations Benchmark scans.
AWS Security Hub is the native service that evaluates AWS accounts against the CIS AWS Foundations Benchmark through automated security checks. Security Hub integrates with AWS Organizations, so a designated administrator account can manage the member accounts centrally. Turning on automatic enablement makes new accounts in the organization become member accounts without invitations or any other manual step. Enabling the CIS AWS Foundations Benchmark standard then provides regular checks across the organization. This combination requires no scripts to run or maintain, which makes it the most operationally efficient approach.
Why the other options are wrong
- A. A script for invitations must be maintained and run for each new account, which is unnecessary overhead given the integration with AWS Organizations.
- B. Amazon Inspector assesses workloads such as Amazon EC2 instances and Lambda functions for vulnerabilities and does not check accounts against the CIS AWS Foundations Benchmark.
- C. Amazon GuardDuty is a threat detection service and does not run CIS AWS Foundations Benchmark checks, and the invitation script adds further overhead.
Question 30
A CloudOps engineer is using AWS Compute Optimizer to generate recommendations for a fleet of Amazon EC2 instances. Some of the instances use newly released instance types, while other instances use older instance types.
After the analysis is complete, the CloudOps engineer notices that some of the EC2 instances are missing from the Compute Optimizer dashboard.
What is the likely cause of this issue?
Show answer and explanation
Correct answer: B. Compute Optimizer does not support the instance types of the missing instances.
AWS Compute Optimizer generates EC2 recommendations only for the instance types on its supported list, and the documentation states that an instance type not on the list is not supported. The fleet in the scenario mixes newly released types with older types, and the analysis has already finished, which points to instance type support as the reason that only some instances are absent. Comparing the missing instances against the supported instance types confirms the cause, and moving them to a supported type allows Compute Optimizer to analyze them.
Why the other options are wrong
- A. Nothing in the scenario points to a shortage of metric data, whereas the mix of newly released and older instance types points directly to instance type support.
- C. Compute Optimizer lists well-sized instances with a finding of Optimized, so being optimized does not remove an instance from view.
- D. Compute Optimizer analyzes Windows instances as well as Linux instances, so the operating system does not cause instances to go missing.
Question 31
A company uses AWS CloudFormation to manage a stack of Amazon EC2 instances on AWS. A CloudOps engineer needs to keep the instances and all of the instances’ data, even if someone deletes the stack.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Set the DeletionPolicy attribute to Retain for the EC2 instance resource in the CloudFormation template.
The DeletionPolicy attribute tells CloudFormation what to do with a resource when its stack is deleted or when the resource is removed from the stack. Setting it to Retain on the AWS::EC2::Instance resource makes CloudFormation keep the instance, and therefore its attached volumes and their data, when someone deletes the stack. The instance continues to exist outside of stack management. This approach preserves both the instances and all of their data, whereas backups alone would still leave the instances terminated.
Why the other options are wrong
- A. The Snapshot deletion policy is not supported for EC2 instance resources, and snapshots would keep only volume data rather than the instances themselves.
- B. Amazon DLM automates EBS snapshots and EBS-backed AMIs but does nothing to stop stack deletion from terminating the instances.
- C. AWS Backup plans create recovery points but do not stop stack deletion from terminating the instances, so the instances themselves are lost.
Question 32
A company runs an application on Amazon EC2 instances. The application stores and retrieves data from an Amazon Aurora PostgreSQL database. A developer accidentally drops a table from the database, which causes application errors. Two hours later, a CloudOps engineer needs to recover the data and make the application function again.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: C. Perform a point-in-time recovery and create a new database to restore the database to a specified point in time, 2 hours in the past. Reconfigure the application to use a new database endpoint.
Aurora point-in-time recovery restores a DB cluster from continuous backups to any chosen time within the backup retention period. The restore always creates a new DB cluster and never overwrites the existing one. Selecting a time just before the table was dropped, about 2 hours in the past, recovers the lost data. Because the restored cluster has its own endpoint, the CloudOps engineer must then reconfigure the application to connect to the new endpoint before the application can function normally. This is the supported recovery method for Aurora PostgreSQL after an accidental change such as a dropped table.
Why the other options are wrong
- A. Aurora Backtrack is available only for Aurora MySQL, so it cannot rewind an Aurora PostgreSQL database.
- B. Point-in-time recovery always creates a new DB cluster and cannot restore in place on the existing database.
- D. Restoring from an S3 bucket does not replay log files to a chosen time, and the continuous backups already provide that recovery without building a separate data source.
Question 33
A company is implementing security and compliance by using AWS Trusted Advisor. The company’s CloudOps team is validating the list of Trusted Advisor checks that it can access.
Which factor will affect the quantity of available Trusted Advisor checks?
Show answer and explanation
Correct answer: B. The AWS Support plan
The AWS Support plan determines how many AWS Trusted Advisor checks an account can use. Basic Support includes all checks in the Service Limits category and selected checks in the Security and Fault tolerance categories. Business Support+, Enterprise Support, and AWS Unified Operations plans unlock the full set of checks, along with access through the Trusted Advisor API. A team validating its list of available checks should therefore confirm the plan on the account first, because moving to a higher plan is what increases the number of checks.
Why the other options are wrong
- A. A running EC2 instance can influence what checks report, not how many checks the account can access.
- C. An SCP limits what principals in member accounts are permitted to do and does not change the set of checks that the support plan includes.
- D. Root user MFA status is something Trusted Advisor evaluates, and it changes the result of that check rather than the number of checks available.
Question 34
A CloudOps engineer is preparing to deploy an application to Amazon EC2 instances that are in an Auto Scaling group. The application requires dependencies to be installed. Application updates are issued weekly.
The CloudOps engineer needs to implement a solution to incorporate the application updates on a regular basis. The solution also must conduct a vulnerability scan during Amazon Machine Image (AMI) creation.
What is the MOST operationally efficient solution that meets these requirements?
Show answer and explanation
Correct answer: C. Use EC2 Image Builder with a custom recipe to install the application and its dependencies.
EC2 Image Builder is a managed service for building and maintaining AMIs without custom automation. A custom recipe defines the components that install the application and its dependencies, and a pipeline can run on a weekly schedule so that each new application release is built into a fresh AMI. Image Builder also integrates with Amazon Inspector to scan for vulnerabilities during the build, which satisfies the scanning requirement without additional tooling. Because the build, scan, and schedule are all handled inside one managed pipeline, this approach requires the least ongoing effort from the CloudOps engineer, and the Auto Scaling group can launch instances from the resulting AMI.
Why the other options are wrong
- A. A Packer script on a cron job requires the team to host, maintain, and monitor its own tooling and to add vulnerability scanning separately, which is less operationally efficient than a managed pipeline.
- B. Manually preparing an instance and creating an AMI must be repeated for every weekly update and includes no vulnerability scan.
- D. A scheduled API call only captures an AMI of an existing instance, so it neither installs the application updates nor scans for vulnerabilities.
Question 35
A company uses Amazon ElastiCache (Redis OSS) to cache application data. A CloudOps engineer must implement a solution to increase the resilience of the cache. The solution also must minimize the recovery time objective (RTO).
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create a read replica in a second Availability Zone. Enable Multi-AZ for the ElastiCache (Redis OSS) replication group.
Enabling Multi-AZ on an ElastiCache (Redis OSS) replication group with a read replica in a second Availability Zone provides both resilience and a low RTO. ElastiCache detects a primary node failure and automatically promotes the replica to primary, then propagates the DNS name of the promoted replica to the primary endpoint so the application can keep using the same endpoint without administrator intervention. Because the replica already holds a copy of the cache through asynchronous replication, recovery takes far less time than building a new cluster from a backup. This design also protects against the loss of an entire Availability Zone.
Why the other options are wrong
- A. Memcached does not support replication or automatic failover, so this change would reduce resilience and lengthen recovery from a node failure.
- B. Restoring an hourly backup means seeding a new cluster, which takes far longer than automatic failover, so the RTO is not minimized.
- D. Automatic backups still require a restore to recover, which keeps the application waiting far longer than automatic failover and does not minimize the RTO.
Question 36
A retail company runs a web application. The application uses an Application Load Balancer (ALB) to distribute traffic across multiple Amazon EC2 instances in two Availability Zones. The application experiences high traffic during flash sales. The company needs to ensure even distribution of requests across all healthy instances. Additionally, the company requires session persistence for shopping cart functionality.
Which configuration will meet these requirements with the LEAST administrative effort?
Show answer and explanation
Correct answer: A. Configure the ALB target group to use the round robin algorithm. Enable stickiness and cross-zone load balancing.
An Application Load Balancer provides everything required through built-in target group and load balancer settings. The round robin algorithm routes requests to healthy targets in turn, and cross-zone load balancing distributes traffic across all registered targets in both Availability Zones instead of dividing it by zone. Enabling target group stickiness uses a cookie to route a client to the same target, which preserves shopping cart sessions. No code, additional services, or extra routing rules are needed, so this configuration delivers even distribution and session persistence with the least administrative effort.
Why the other options are wrong
- B. Network Load Balancer target groups do not offer the least outstanding requests algorithm, and disabling cross-zone load balancing works against even distribution across all healthy instances.
- C. Building session storage with Lambda functions and DynamoDB adds custom code and services when ALB stickiness provides session persistence natively.
- D. Path-based routing with a dedicated target group adds listener rules and another target group to manage, which is more effort than one target group with stickiness.
Question 37
A company is implementing Cross-Region Replication (CRR) for the company’s Amazon S3 buckets. The S3 buckets are in the us-east-1 Region.
The company uses server-side encryption with Amazon S3 managed keys (SSE-S3) to secure the data in the buckets.
A CloudOps engineer creates a new AWS account to store backups in S3 buckets. All backup buckets are in the us-west-2 Region. The CloudOps engineer enables versioning on the source buckets and the destination buckets. The CloudOps engineer creates an IAM role in the source account for s3.amazonaws.com. The CloudOps engineer grants the IAM role permissions to perform read actions in the source buckets, replicate actions in the destination buckets, and encrypt actions that use the destination bucket's key. The destination bucket policy allows the IAM role to perform replicate and read actions.
After the replication configuration is complete, the CloudOps engineer notices that objects are not replicating.
What is the likely reason the objects are not replicating?
Show answer and explanation
Correct answer: A. The IAM role and bucket policies must have the ObjectOwnerOverrideToBucketOwner permission.
Replicating backups to a separate account can include changing replica ownership to the destination account. When a replication rule changes object ownership, Amazon S3 requires the s3:ObjectOwnerOverrideToBucketOwner permission in two places: the IAM role used for replication and the destination bucket policy. The role grants only read, replicate, and encrypt actions and the destination bucket policy grants only replicate and read actions, so neither carries this permission and the objects do not replicate. Adding the permission to both resolves the failure. The encryption type is not the cause, because Amazon S3 replicates objects encrypted with SSE-S3 by default.
Why the other options are wrong
- B. Amazon S3 treats multi-Region keys as single-Region keys, and objects encrypted with SSE-S3 do not use AWS KMS keys at all.
- C. Replication runs within the Amazon S3 service under the IAM role, so gateway VPC endpoints are not part of the configuration.
- D. Replicas of SSE-S3 objects use the same encryption type as the source objects, so the destination buckets do not need SSE-KMS.
Question 38
A finance company stores confidential data in an Amazon S3 bucket. The company uses Amazon QuickSight to analyze the data and create dashboard reports. The company requires that all data access and connections to QuickSight remain within the company's VPC network boundary.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create an interface VPC endpoint for QuickSight. Configure the endpoint to connect to QuickSight within the VPC by using AWS PrivateLink. Create a manifest file that points to the S3 data. Grant QuickSight permission to access the S3 bucket.
Interface VPC endpoints powered by AWS PrivateLink give resources in a VPC private access to the Amazon QuickSight website and APIs, so connections do not traverse the public internet. For S3 data, QuickSight uses a manifest file that identifies the objects to import, and granting QuickSight permission to the S3 bucket allows it to read them. Together, these steps keep connections on the private path required by the company while making the confidential data available for analysis and dashboard reports, which satisfies the requirement to stay within the VPC network boundary.
Why the other options are wrong
- B. An EC2 proxy adds a component to manage and a possible point of failure, and QuickSight reads S3 data through a manifest and bucket permission rather than a file on an instance.
- C. A gateway endpoint handles only traffic from the VPC to Amazon S3, so it provides no private path for connections to QuickSight itself.
- D. A NAT gateway provides outbound connectivity toward the internet, which takes traffic across the network boundary that the company requires it to stay within.
Question 39
A CloudOps engineer wants to provide access to AWS services by attaching an IAM policy to multiple IAM users. The CloudOps engineer also wants to be able to change the policy and create new versions.
Which combination of actions will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Add the users to an IAM user group. Attach the policy to the group; Create a customer managed policy.
An IAM user group applies permissions to every member at once, so attaching one policy to the group gives all the users the same access and new members inherit it automatically. A customer managed policy is a standalone policy that the account creates and controls, and IAM keeps a version history for it. The CloudOps engineer can edit the policy, which creates a new version, set a different version as the default, and roll back when needed. Together, these two actions provide shared access for multiple users and full control over policy versions.
Why the other options are wrong
- A. A service-linked role is predefined for a specific AWS service to assume, and IAM users cannot be added as members of any role.
- C. AWS creates and maintains AWS managed policies, so a customer cannot edit them or create new versions of them.
- E. An inline policy is embedded in a single identity and has no version history, so it cannot provide policy versions.
Question 40
A company has a microservice that runs on a set of Amazon EC2 instances. The EC2 instances run behind an Application Load Balancer (ALB).
A CloudOps engineer must use Amazon Route 53 to create a record that maps the ALB URL to example.com.
Which type of record will meet this requirement?
Show answer and explanation
Correct answer: C. An alias record
A Route 53 alias record maps a domain name directly to selected AWS resources, including an Application Load Balancer. The IP addresses of an ALB change as the load balancer scales, and an alias record follows those changes automatically because Route 53 automatically recognizes changes in the resource. Alias records are also valid at the zone apex, which is the requirement here because example.com is the root of the hosted zone. An alias that points to the ALB in this way gives the microservice a stable domain name without any ongoing DNS maintenance.
Why the other options are wrong
- A. A standard A record maps a name to fixed IPv4 addresses, but the IP addresses of an ALB change over time.
- B. A standard AAAA record maps a name to fixed IPv6 addresses, so it has the same problem with the changing addresses of an ALB.
- D. A CNAME record cannot be created at the zone apex, so it cannot be used for example.com.
Question 41
A company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company has configured an Amazon CloudWatch alarm to monitor the HTTPCode_Target_5XX_Count metric. The application crashes every few days during business hours. The crashes trigger the CloudWatch alarm and result in service disruption.
The cause of the crashes is a memory leak in the application. While developers work to fix the problem, a CloudOps engineer needs to implement a temporary solution. The solution must automatically reboot the EC2 instances every day and must minimize application disruption during business hours.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Use AWS Systems Manager to create a daily maintenance window that is outside of business hours. Register the EC2 instances as a target. Assign the AWS-RestartEC2Instance runbook to the maintenance window.
An AWS Systems Manager maintenance window runs tasks on a defined schedule, so a daily window outside business hours performs the restart when it causes the least disruption. Registering the EC2 instances as targets and assigning the AWS-RestartEC2Instance Automation runbook restarts each instance every day with no manual effort. The daily restart clears the memory that the leaking application has consumed before it can build up enough to crash the application during business hours. This is a proactive, scheduled action that is simple to remove after developers release the fix, which suits a temporary solution.
Why the other options are wrong
- A. The StartInstances operation only starts stopped instances, so it has no effect on instances that are already running and does not reboot them.
- C. The StatusCheckFailed_System metric tracks AWS infrastructure problems, not application memory leaks, and the alarm is not a daily reboot schedule.
- D. An alarm that reacts to crashes acts only after disruption occurs during business hours, and EC2 alarm actions cannot restart an application.
Question 42
A company has multiple AWS accounts. A CloudOps engineer uses a sandbox account to create and verify IAM policies for use in a production account. The CloudOps engineer uses AWS CloudFormation to deploy policies to the sandbox account for testing.
When tests pass, the CloudOps engineer deploys the policies to production. The CloudOps engineer has configured AWS CloudTrail in both the sandbox account and the production account.
The CloudOps engineer wants to detect any changes to the IAM policies after the policies have been deployed by CloudFormation. The CloudOps engineer must receive notifications for any changes to the policies.
Which solution will meet these requirements with the LEAST administrative effort?
Show answer and explanation
Correct answer: B. Create an Amazon EventBridge rule to invoke an AWS Lambda function to check the CloudFormation stack for drift. Configure the function to use Amazon Simple Notification Service (Amazon SNS) to notify the CloudOps engineer if the function detects any drift.
CloudFormation drift detection compares the current configuration of stack resources with the expected configuration from the template, so it reveals changes made to the deployed IAM policies outside of CloudFormation. An Amazon EventBridge rule can invoke an AWS Lambda function that starts drift detection with the DetectStackDrift API and checks the result, and the function then sends an Amazon SNS notification when it finds drift. Because CloudFormation already holds the expected state and performs the comparison, the solution needs only a small function and no separate copies of the policies. That gives it the least administrative effort.
Why the other options are wrong
- A. CloudTrail records API activity but has no feature for emailing an engineer when specific IAM policies change, so it cannot meet the notification requirement by itself.
- C. IAM Access Analyzer policy generation suggests policies from past activity rather than detecting changes, so comparing its output with sandbox policies would not reliably reveal modifications and adds significant effort.
- D. Storing a copy of the policies and writing custom comparison logic duplicates what drift detection provides, which requires more administrative effort and still lacks any notification.
Question 43
A company is planning to host an application on a set of Amazon EC2 instances that are distributed across multiple Availability Zones. The application must be able to scale to millions of requests each second.
A CloudOps engineer must design a solution to distribute the traffic to the EC2 instances. The solution must be optimized to handle sudden and volatile traffic patterns while using a single static IP address for each Availability Zone.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Network Load Balancer
A Network Load Balancer operates at the connection level (Layer 4) and is designed to handle millions of requests each second with very low latency. It is built to absorb sudden and volatile traffic patterns, which matches the stated workload. A Network Load Balancer also provides one static IP address for each Availability Zone that is enabled for the load balancer, and an Elastic IP address can be assigned to each of those zones if required. It distributes traffic to EC2 instances across multiple Availability Zones through its target groups, so it satisfies both the performance requirement and the static IP requirement.
Why the other options are wrong
- A. Amazon SQS is a message queuing service that decouples application components, and it does not distribute incoming client traffic to EC2 instances.
- B. An Application Load Balancer does not provide a static IP address for each Availability Zone because its node addresses change as it scales.
- C. AWS Global Accelerator provides static anycast IP addresses for the accelerator as a whole, not a single static IP address for each Availability Zone.
Question 44
A CloudOps engineer needs to ensure that AWS resources across multiple AWS accounts are tagged consistently. The company uses an organization in AWS Organizations to centrally manage the accounts. The company wants to implement cost allocation tags to accurately track the costs that are allocated to each business unit.
Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Use Organizations tag policies to enforce mandatory tagging on all resources. Enable cost allocation tags in the AWS Billing and Cost Management console.
AWS Organizations tag policies define tagging rules centrally, including tag keys, case treatment, and allowed values, and they can prevent noncompliant tagging operations on specified resource types. Attaching the policies at the organization level applies them across all member accounts without any code or per-account tooling. Activating the tags as cost allocation tags in the AWS Billing and Cost Management console then makes them available for tracking costs by business unit. Both steps are native, managed features, so this approach requires the least operational overhead.
Why the other options are wrong
- B. A custom AWS Lambda function with CloudTrail triggers and tagging rules must be built and maintained, which adds far more overhead than a native policy.
- C. AWS Config only evaluates tagging compliance, and AWS Budgets tracks spending against thresholds and cannot apply tags to resources.
- D. AWS Service Catalog covers only resources provisioned through it, and AWS Trusted Advisor provides recommendations rather than enforcing tagging across an organization.
Question 45
A CloudOps engineer wants to configure observability of specific metrics for a public website that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The CloudOps engineer wants to observe latency, traffic, errors, and saturation metrics. The CloudOps engineer wants to define service level objectives (SLOs) and to monitor service level indicators (SLIs). The CloudOps engineer also wants to correlate metrics, logs, and traces to support faster time to issue resolution.
Which solution will meet these requirements with the LEAST operational effort?
Show answer and explanation
Correct answer: A. Use Amazon CloudWatch Application Signals to automatically collect and monitor the specified metrics for the EKS workloads.
Amazon CloudWatch Application Signals automatically collects metrics and traces from applications on Amazon EKS and displays call volume, latency, faults, and errors without custom code or dashboards. It is enabled through the Amazon CloudWatch Observability EKS add-on, which also provides Container Insights resource metrics that show saturation. Engineers create SLOs directly in Application Signals and track SLI status in the services list. Selecting a point on a service graph opens correlated traces and related logs, which shortens the time to find a root cause. Because one managed feature delivers the signals, the SLOs, and the correlation, it requires the least operational effort.
Why the other options are wrong
- B. Configuring AWS Distro for OpenTelemetry, Amazon Managed Service for Prometheus, and Amazon Managed Grafana requires building and maintaining the pipeline and dashboards, which is far more effort than a built-in feature.
- C. CloudWatch RUM measures client-side experience and Synthetics canaries run scripted checks, so neither one collects the server-side metrics of the EKS workloads or manages SLOs.
- D. CloudWatch Application Insights focuses on detecting application problems and anomalies, and it does not provide the SLO and SLI monitoring that the engineer needs.
Question 46
A company hosts a web application on an Amazon EC2 instance. The web server logs are published to Amazon CloudWatch Logs. The log events have the same structure and include the HTTP response codes that are associated with the user requests. The company needs to monitor the number of times that the web server returns an HTTP 404 response.
What is the MOST operationally efficient solution that meets these requirements?
Show answer and explanation
Correct answer: A. Create a CloudWatch Logs metric filter that counts the number of times that the web server returns an HTTP 404 response.
Amazon CloudWatch Logs metric filters search incoming log events for a pattern and turn matches into values on a CloudWatch metric. Because the web server log events share one structure, a filter can match the HTTP status field on 404 and increment a custom metric each time it appears. The result is a continuously updated count that can be graphed on dashboards or used in alarms, with no code, servers, or schedules to manage. This built-in configuration is the most operationally efficient way to track the response code over time.
Why the other options are wrong
- B. Subscription filters deliver log events to destinations such as AWS Lambda or Amazon Kinesis and do not count anything themselves, so extra custom processing would be required.
- C. A Lambda function requires code, scheduling, and maintenance, and it yields only periodic query results, which is less efficient than the continuous built-in count from a metric filter.
- D. A script requires somewhere to run, scheduling, and upkeep, and it returns only hourly snapshots, which adds operational work that a built-in metric filter avoids.
Question 47
A CloudOps engineer must troubleshoot performance issues for a web application that is delivered through Amazon CloudFront. The metrics show a consistently low cache hit ratio that leads to many requests being forwarded to the origin.
Which configuration will increase the cache hit ratio?
Show answer and explanation
Correct answer: C. Reduce the number of request headers, query strings, and cookies included in the cache key.
Amazon CloudFront stores and looks up each object by its cache key. By default, the cache key includes the distribution domain name and the URL path of the requested object, and a cache policy can add request headers, query strings, and cookies. Every additional value creates more variations, so identical content is stored as separate objects and more requests miss the cache and go to the origin. Limiting the cache key to only the values that change the response lets more viewers share the same cached object. Values that the origin needs but that do not change the content can be forwarded with an origin request policy.
Why the other options are wrong
- A. A Cache-Control value of max-age=0 makes objects stale immediately, which sends more requests to the origin and lowers the cache hit ratio.
- B. A shorter TTL makes cached objects expire sooner, so CloudFront returns to the origin more often and the cache hit ratio falls.
- D. Signed URLs and signed cookies restrict who can access content, and they do nothing to increase the reuse of cached objects.
Question 48
An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The application takes up to 2 minutes to populate a local cache after the application is started. The application reports as healthy in the target group health check a few seconds after starting.
A CloudOps engineer observes that after some of the instances are rebooted, the instances receive an equal share of the traffic immediately after each instance reports as healthy. The application needs to receive a gradually increasing share of the traffic while the application cache is populated.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: A. Change the slow_start.duration_seconds target group attribute to 120 seconds. Before rebooting the instances, deregister the instances from the target group. After rebooting the instances, register the instances with the target group.
Slow start mode gives targets time to warm up before they receive a full share of requests. With the slow_start.duration_seconds attribute set to 120 seconds, the load balancer linearly increases the requests that it sends to a target during that period, which matches the 2-minute cache population time. A target enters slow start mode when it is registered and considered healthy by the target group, so deregistering each instance before the reboot and registering it again afterward ensures that the ramp applies. At least one other healthy target must be outside slow start mode, which is the case when only some of the instances are rebooted.
Why the other options are wrong
- B. HealthCheckTimeoutSeconds only sets the time allowed for a health check response, so it does not gradually increase traffic to a target.
- C. Restarting instances on failed health checks does not ramp traffic, and the weighted random algorithm cannot be used with slow start mode.
- D. A lifecycle hook only delays when an instance enters service, and the instance then receives a full share of requests with no gradual increase.
Question 49
A global company runs a critical primary workload in the us-east-1 Region. The company wants to ensure business continuity with minimal downtime in case of a workload failure. The company wants to replicate the workload to a second AWS Region.
A CloudOps engineer needs a solution that achieves a recovery time objective (RTO) of less than 10 minutes and a zero recovery point objective (RPO) to meet service level agreements.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Implement an active-active architecture that provides real-time data replication across two Regions. Use Amazon Route 53 health checks and a weighted routing policy.
A multi-site active/active architecture runs the full workload in both Regions at the same time and serves production traffic from each. Real-time data replication keeps both copies current, which supports the zero RPO requirement. Because the second Region already runs at production capacity, no resources need to be started or scaled before it can take over. Amazon Route 53 health checks detect a failed Region and stop returning its weighted record, so the remaining Region receives all traffic quickly and recovery stays well under 10 minutes. This strategy offers the lowest RTO and RPO of the standard disaster recovery strategies.
Why the other options are wrong
- A. A pilot light keeps application servers switched off until failover, so starting and scaling them puts the 10-minute RTO at risk.
- B. Regular data replication leaves a window of unreplicated writes when a failure occurs, so this warm standby design cannot achieve a zero RPO.
- D. Periodic backups lose all data written since the last backup, and launching the application from them takes too long, so both objectives are missed.
Question 50
A company has deployed Amazon EC2 instances from custom Amazon Machine Images (AMIs) in two AWS Regions. The company registered all the instances with AWS Systems Manager.
The company discovers that the operating system on some instances has a significant zero-day exploit. However, the company does not know how many instances are affected.
A CloudOps engineer must implement a solution to deploy operating system patches for the affected EC2 instances.
Which solution will meet this requirement with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Define a patch baseline in Systems Manager Patch Manager. Use a Patch Manager scan to identify the affected instances. Use the Patch Now option in each Region to update the affected instances.
AWS Systems Manager Patch Manager is the native tool for operating system patching, and all the instances are already registered with Systems Manager. A patch baseline defines which patches are approved, and a scan compares each instance against that baseline and reports which instances are missing patches. This answers how many instances are affected without any additional service. The Patch now option then applies the patches to those instances, and it is run in each of the two Regions. No custom automation or instance replacement is needed, which results in the least operational overhead.
Why the other options are wrong
- B. AWS Config adds a second service that depends on Systems Manager patch data for this check, while a Patch Manager scan identifies the instances directly.
- C. An EventBridge rule requires custom automation and can only react to compliance events, which do not exist until a scan has already run.
- D. Updating AMIs and manually replacing instances in both Regions is labor-intensive, and AWS Config does not identify operating system vulnerabilities.
That was 50 of 200.
The full AWS SOA-C03 pack has all 200 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 100 free as one PDF by email. Get the Half Pack →