SOA-C03 Practice Questions — Free

Question 1 of 25

An engineer wants to organize and view CloudWatch metrics, alarms, and other AWS resources for a specific application together, based on tags, without manually building a custom dashboard from scratch. What feature supports this?

• A.Systems Manager Patch Manager, which is scoped to patch baselines
• B.AWS Config aggregators, which are scoped to compliance data across accounts
• C.AWS Resource Groups, which can group resources by tag and surface associated CloudWatch dataCorrect
• D.CloudTrail Lake, which is scoped to querying historical API activity

Question 2 of 25

What is the purpose of an SNS dead-letter queue configured on a CloudWatch alarm's notification topic?

• A.Increasing the priority of a failed notification for redelivery
• B.Capturing notifications that fail delivery to a subscriber after retries are exhaustedCorrect
• C.Automatically resolving the alarm after a failed delivery
• D.Permanently storing all successfully delivered notifications

Question 3 of 25

An engineer needs to know exactly when a security group's inbound rules changed and who made the change. Which service provides this?

• A.AWS Trusted Advisor
• B.Amazon CloudWatch Logs
• C.AWS CloudTrailCorrect
• D.Amazon Inspector

Question 4 of 25

A specific Lambda function's cold starts might be contributing meaningfully to overall API latency. Which combination of signals helps confirm this?

• A.AWS Config's compliance evaluation history recorded for the function
• B.VPC Flow Logs collected for the subnet the function's ENI resides in
• C.IAM Access Analyzer findings related to the function's execution role
• D.X-Ray initialization segments correlated with the function's Duration metric over timeCorrect

Question 5 of 25

A scheduled Lambda function has been silently failing for a week with no alerts raised. What CloudWatch-based approach would have surfaced this earlier?

• A.Increasing the function's timeout setting
• B.Enabling VPC Flow Logs on the function's execution role
• C.Manually checking the function's return value each day
• D.An alarm on the function's Errors metric with an SNS notification actionCorrect

Question 6 of 25

An engineer is deciding whether to use an Application Load Balancer target group with instance targets or IP targets. When are IP targets specifically useful?,

• A.IP targets are only supported when the load balancer itself is internet-facing, never internal
• B.IP targets can only be used when there is exactly one target registered in the group
• C.IP targets are required for every single Application Load Balancer configuration without exception
• D.When targets exist outside the VPC, in a peered VPC, or are container tasks with their own IP addressesCorrect

Question 7 of 25

What is a key cost advantage of AWS Elastic Disaster Recovery compared to running a full warm standby environment continuously?

• A.DRS requires paying for full-scale recovery instances to run continuously at all times
• B.DRS has no cost at all under any circumstances, regardless of usage
• C.DRS eliminates the need for any replication traffic between source and target
• D.DRS keeps only lightweight staging infrastructure running continuously, launching full-scale recovery instances only when actually neededCorrect

Question 8 of 25

A CloudOps engineer must verify that backups are actually restorable. What fits?

• A.A count of how many recovery points currently exist
• B.Scheduled restore tests validating the recovered data each periodCorrect
• C.Confirmation that the backup job reported success each night
• D.A check of the total size of the stored backup data

Question 9 of 25

What is a key limitation of relying solely on scheduled scaling actions for an Auto Scaling group, without any dynamic scaling policy?

• A.Scheduled scaling cannot react to unexpected traffic spikes that fall outside the predefined scheduleCorrect
• B.Scheduled scaling requires disabling all health checks on the group entirely
• C.Scheduled scaling can only reduce capacity, never increase it under any configuration
• D.Scheduled scaling actions are limited to a maximum of one action per Auto Scaling group ever

Question 10 of 25

A team is deciding between Multi-AZ RDS and Aurora for a new relational workload requiring high availability. What is a reason Aurora might be preferred specifically for its storage-layer resilience?

• A.Aurora's storage layer is distributed and self-healing across multiple AZs by design, independent of the compute instanceCorrect
• B.Aurora is the only RDS engine option that supports automated backups at all
• C.Aurora requires manually configuring Multi-AZ, unlike standard RDS which enables it by default
• D.Aurora cannot be used with read replicas under any circumstances

Question 11 of 25

A CloudOps engineer must keep production and staging templates from diverging. What fits?

• A.Manual synchronization performed whenever differences are found
• B.One template promoted to both with only parameter values differingCorrect
• C.Staging configured once and then left unchanged thereafter
• D.Separate templates maintained independently for each environment

Question 12 of 25

AWS CodeDeploy supports several deployment configurations for EC2/on-premises deployments. What does the 'AllAtOnce' deployment configuration do?

• A.It deploys only during a specific maintenance window defined in advance
• B.It requires manual approval before deploying to each individual instance
• C.It deploys to all instances simultaneously, maximizing speed but offering no gradual rollout safetyCorrect
• D.It deploys to exactly one instance at a time, regardless of how many instances exist

Question 13 of 25

A CloudOps engineer must ensure infrastructure changes cannot be applied outside the pipeline. What fits?

• A.A team convention that engineers should always use the pipeline
• B.A naming convention that identifies the pipeline's own role
• C.A monthly review of who made changes to production resources
• D.IAM permissions granting resource changes only to the pipeline roleCorrect

Question 14 of 25

A container image must be stored privately and scanned for vulnerabilities on push. Which service fits?

• A.Amazon ECR with scan-on-push enabled for the repositoryCorrect
• B.Amazon EFS mounted by the build host during the image build
• C.Amazon S3 with server-side encryption applied to the objects
• D.AWS CodeArtifact configured with a container package format

Question 15 of 25

An engineer is automating EC2 instance provisioning and wants newly launched instances to automatically register themselves as managed nodes in Systems Manager without any manual step. What is required for this?

• A.Automatic registration is only possible for instances launched via the AWS CLI, not the console
• B.Systems Manager automatically manages every EC2 instance in an account with zero configuration
• C.The instance must be manually registered through the Systems Manager console after every launch
• D.The instance must have the SSM Agent installed and an attached IAM role granting the necessary Systems Manager permissionsCorrect

Question 16 of 25

An engineer wants a CloudFormation template to conditionally create a resource only when deploying to a specific environment (such as only creating a NAT Gateway in production, not in dev). What CloudFormation feature supports this?

• A.Deploying two entirely separate, unrelated templates is the only way to achieve this
• B.Conditions, defined using Fn::If and a Conditions section referencing input parametersCorrect
• C.CloudFormation templates cannot conditionally create resources under any circumstances
• D.Stack policies, which restrict updates rather than controlling initial resource creation

Question 17 of 25

Enabling MFA specifically on the AWS account root user serves what purpose?

• A.MFA on the root user is required before any IAM user can ever be created in the account
• B.Adding a second authentication factor to the most privileged identity in the account, reducing risk if the root password is compromisedCorrect
• C.Root user MFA is only relevant for accounts that do not use IAM roles at all
• D.Enabling root MFA automatically enables MFA for every IAM user in the account as well

Question 18 of 25

An IAM role has both a trust policy and a permissions policy attached. How do these two documents differ in what they control?

• A.The trust policy defines who (which principal) is allowed to assume the role; the permissions policy defines what the role can do once assumedCorrect
• B.The trust policy defines what actions are allowed, while the permissions policy defines who can assume the role
• C.The trust policy and permissions policy are simply two different names for the identical document
• D.Only IAM users have a trust policy; IAM roles only ever have a permissions policy

Question 19 of 25

What does IAM Access Analyzer's policy validation feature check for, separate from its external-access-finding capability?

• A.Whether a policy document is syntactically valid and follows IAM policy best practicesCorrect
• B.Whether the resources referenced in the policy currently exist in the account
• C.Whether the account has exceeded its total allowed number of IAM policies
• D.Whether the policy has been attached to at least one IAM role or user

Question 20 of 25

An EC2 instance must read from S3 without any stored credentials. What should be configured?

• A.A bucket policy granting anonymous read access to the objects
• B.A NAT gateway route allowing the instance to reach S3
• C.An instance profile carrying an IAM role with the required accessCorrect
• D.Access keys written to a configuration file on the instance

Question 21 of 25

A CloudFront distribution serves an S3 origin, but users can still reach the bucket URL directly. What closes this?

• A.Origin Access Control with a bucket policy scoped to the distributionCorrect
• B.A presigned URL generated for every object served by the site
• C.Blocking public access on the bucket without changing the policy
• D.Disabling static website hosting on the origin S3 bucket

Question 22 of 25

An engineer must allow only HTTPS from the corporate office range to a public ALB. Which configuration fits?

• A.An IAM policy restricting who may invoke the application
• B.A network ACL allowing all traffic from any source address
• C.A route table entry directing office traffic to the balancer
• D.A security group rule permitting TCP 443 from the office CIDRCorrect

Question 23 of 25

A CloudFront distribution must pass a custom header to the origin so the origin can reject direct requests. What fits?

• A.A signed URL generated for each individual object requested
• B.An origin failover group listing the origin twice for safety
• C.A custom origin header added by CloudFront and validated at the originCorrect
• D.A cache policy that forwards every request header to the origin

Question 24 of 25

An engineer must ensure that instances in two subnets cannot communicate with each other at all. What should be applied?

• A.A security group allowing traffic only within the same subnet
• B.Network ACLs on each subnet denying the other subnet's CIDRCorrect
• C.Separate route tables associated with each of the two subnets
• D.Placement of the subnets in different Availability Zones

Question 25 of 25

An engineer must confirm whether a Direct Connect virtual interface is passing traffic. Which signal is most direct?

• A.Direct Connect CloudWatch metrics for the virtual interface stateCorrect
• B.The Route 53 health check status for the application endpoint
• C.The count of NAT gateway connections in the same account
• D.The number of instances currently running inside the VPC